Cybersecurity Audit Checklist

An internal audit checklist for IT security leads, internal auditors and small teams preparing for an ISO 27001, RBI or client audit. Audit yourself the way an attacker would look at you. Pull the firewall export and ask who approved each allow-any rule. Then match every admin account to someone who still works here.

Each control area is a list of questions you answer yes, partly or no, with a column for the evidence you would show an auditor: a config export, a log extract, a signed review. Start with what is reachable from the internet, then identity, then endpoints, because that is the order attackers usually work in. A typical first pass finds stale admin accounts, firewall rules nobody can explain, and backups that have never been restored in a test.

What's inside:

• Network security and architecture review: what is reachable from the internet that should not be
• Access control and identity management assessment
• Endpoint security and configuration baselines, compared with what is actually running
• Data classification and protection controls
• Incident response plan evaluation, including whether the on-call numbers still work
• Logging and monitoring: which systems send logs, how long they are kept, and who reads the alerts
• Backup and recovery, including the date of the last restore that was actually tested
• Third-party and vendor access: who has a VPN account or an API key, and when it was last reviewed
• Compliance status across major frameworks (ISO 27001, NIST, RBI)
• Physical security and operational controls, such as who can walk into the server room