IT Security Audit Checklist Template

What the IT Security Audit Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope, Plan & Approve the Audit

   6 tasks

   Owned by the audit lead. The last task is an approval: the CISO or IT director signs off the scope before any evidence is requested.

   • Set the audit objective, scope and period — entities, systems, cloud tenants and dates
   • Choose the audit criteria — your own policies first, then any framework you have committed to
   • Pull forward open findings from the last audit — anything not closed is retested
   • Rank the domains by risk with IT and security leads — test hardest where failure hurts most
   • Agree the timetable, audit team and independence — nobody audits a control they run
   • CISO or IT director approves the audit scope — before any evidence is requested
2. 2
   Phase 2

   Phase 2: Request Evidence & Walk Through the Controls

   6 tasks

   Assigned to the audit lead, with each evidence item owned by the control owner who has to supply it.

   • Send the evidence request list with owners and due dates — grouped by domain
   • Collect the policy set, risk register and asset inventory — most later tests depend on them
   • Obtain the Statement of Applicability or SOC 2 system description — certification-mapped audits only
   • Walk through each domain with its control owner — how it really works, not how the policy says it works
   • Pull populations and agree sample sizes — joiners, leavers, changes, patches and incidents
   • Log evidence gaps and chase them before testing starts — a missing item can be a finding
3. 3
   Phase 3

   Phase 3: Test Governance, Risk & People Controls

   5 tasks

   • Test governance and policy — policies approved, owned and reviewed; security reported to leadership
   • Test the risk assessment — current, complete, and every high risk has an owner and a treatment
   • Test the asset inventory — trace devices, cloud accounts and SaaS apps found in use back to it
   • Test third-party security — critical suppliers assessed, contracted and reviewed
   • Test security awareness training — completion, joiners trained on time, phishing follow-up
4. 4
   Phase 4

   Phase 4: Test Access, Endpoints & Infrastructure

   6 tasks

   • Test joiner, mover and leaver access — leavers disabled within the policy deadline
   • Test privileged access and MFA — admin accounts justified, separate and protected by MFA
   • Test patching and vulnerability management — critical fixes on time, exceptions approved
   • Test endpoint protection and secure configuration — anti-malware, disk encryption, hardening baseline
   • Review network and cloud security at summary level — a network audit goes deeper
   • Test data protection and encryption — classification applied, sensitive data encrypted
5. 5
   Phase 5

   Phase 5: Test Detection, Response & Recovery

   5 tasks

   • Test logging and monitoring — coverage, retention and alert triage
   • Trace a sample of security incidents end to end — from detection to lessons learned, including notification decisions
   • Confirm the incident response plan was exercised — a tabletop or live test in the period
   • Test backup and restore — one copy offline or immutable, and a restore actually tested
   • Check business continuity and disaster recovery testing — recovery targets met or explained
6. 6
   Phase 6

   Phase 6: Findings, Report & Sign-Off

   7 tasks

   Finding owners approve their responses; the head of internal audit and the CISO approve the report.

   • Rate each finding high, medium or low — using the risk register’s scale
   • Map each finding to the affected framework control — certification-mapped audits only
   • Agree each finding and action with its management owner — the fix, the owner and a target date
   • Management owners sign off their responses — returned if the action misses the cause
   • Issue the draft report and hold the closing meeting — record corrections and disputed ratings
   • Head of internal audit and CISO sign off the final report — then send it to the audit or risk committee
   • Schedule follow-up testing for every agreed action — a retest date, not just a due date
7. 7
   Phase 7 — High-Risk Findings Only

   Phase 7: Escalate & Track High-Risk Remediation

   5 tasks

   Conditional: its tasks appear only when Phase 6 records a high-risk finding.

   • Escalate high-risk findings to the audit or risk committee — record who was told and what they decided
   • Record interim risk acceptance or compensating controls — signed by the risk owner
   • Review remediation progress every month — slipped dates go back to the committee
   • Retest each high-risk fix before closing it — proof it works, not a closed ticket
   • Report closure to the committee and feed lessons into next year’s audit plan