IT Security Assessment List DATE

CUSTOMER NAME
AUDIT BY
N OF ENDPOINTS

ASSETS
Hardware (in-house)
Condition Problem Result

Hardware (remote)
Condition Problem Result

Software (in-house)
Condition Problem Result

Software (external applications)

Condition Problem Result

Web applications
Condition Problem Result

INTERNET ACCESS SECURITY

Malware detection system
Condition Possible threat Mitigation

Inbound/outbound filter lists

Condition Possible threat Mitigation

Bandwidth restrictions
Condition Possible threat Mitigation
VULNERABILITIES / THREATS
RMM
Condition Possible threat Mitigation

Servers
Condition Possible threat Mitigation

Internet connection
Condition Possible threat Mitigation

Firewalls
Condition Possible threat Mitigation

Content filters
Condition Possible threat Mitigation

Remote desktops
Condition Possible threat Mitigation

Billing system
Condition Possible threat Mitigation

Credentials
Condition Possible threat Mitigation

Third-parties applications
Condition Possible threat Mitigation

Network infrastructure
Condition Possible threat Mitigation

Security configuration
Condition Possible threat Mitigation
SECURITY 1/2
Default passwords have been disabled
Condition Possible threat Mitigation

Password strength
Condition Possible threat Mitigation

Number of failed login attempts is limited/disabled

Condition Possible threat Mitigation

Antivirus
Condition Possible threat Mitigation

Content filter
Condition Possible threat Mitigation

Remote desktops
Condition Possible threat Mitigation

Phishing email filters

Condition Possible threat Mitigation

Patching
Condition Possible threat Mitigation

Remote authorization control

Condition Possible threat Mitigation

Encryption
Condition Possible threat Mitigation

Automatic lock of desktops

Condition Possible threat Mitigation
SECURITY 2/2
Anti-malware software
Condition Possible threat Mitigation

Verified software
Condition Possible threat Mitigation

Security updates are installed

Condition Possible threat Mitigation

Administrator account's password is rotated regularly

Condition Possible threat Mitigation

No remote access to admin account

Condition Possible threat Mitigation

Temporary files are removed

Condition Possible threat Mitigation

SUGGESTIONS
Policies amendments
Condition Possible threat Mitigation

Users' authorization corrections

Condition Possible threat Mitigation

Changes in procedures/operations
Condition Possible threat Mitigation

Replacement of outdated technology

Condition Possible threat Mitigation

Incidence response plan

Condition Problem Result
 DATE

CUSTOMER NAME
IT Security Assessment List AUDIT BY

NETWORK
Wireless access point
Condition Problem Result

Firewall
Condition Problem Result

Switches
Condition Problem Result

IP addresses management
Condition Problem Result

Network configuration
Condition Problem Result

Up-to-date VPN software

Condition Possible threat Mitigation

RMM
Condition Possible threat Mitigation

SNMP
Condition Possible threat Mitigation
WORKSPACE AND EQUIPMENT
Up-to-date workstations
Condition Possible threat Mitigation

Remote endpoints
Condition Possible threat Mitigation

Disk space
Condition Possible threat Mitigation

Patching
Condition Possible threat Mitigation

Printers/scanners
Condition Possible threat Mitigation

Total workstations
Total workstations

NOTES
USER ACCOUNTS
Authentication is mandatory for all users
Condition Possible threat Mitigation

Unique accounts for users

Condition Possible threat Mitigation

Shared accounts
Condition Possible threat Mitigation

MFA
Condition Possible threat Mitigation

Least priviledge policy

Condition Possible threat Mitigation

Disabled stale accounts

Total workstations

Set password rotation

Total workstations

No shared credentials between environments (if multiple)

Total workstations

All default accounts are deleted

Total workstations

NOTES
DOCUMENTATION
Regulatory compliance (e.g. HIPAA)
Condition Possible threat Mitigation

Privacy policy
Condition Possible threat Mitigation

Password policy
Condition Possible threat Mitigation

BYOD policy
Condition Possible threat Mitigation

Remote access policy

Condition Possible threat Mitigation

Warranties
Condition Possible threat Mitigation

Remote access policy

Condition Possible threat Mitigation

Licensing
Condition Possible threat Mitigation

Disaster recovery plan

Condition Possible threat Mitigation

Business continuity plan

Condition Possible threat Mitigation

Business continuity plan

Condition Possible threat Mitigation

Document maintenance
Condition Possible threat Mitigation
SERVERS AND EQUIPMENT
Modern servers
Condition Possible threat Mitigation

Power supply
Condition Possible threat Mitigation

Storage capacity
Condition Possible threat Mitigation

Server racks/cabinets
Condition Possible threat Mitigation

NTP servers
Condition Possible threat Mitigation

Patch management
Condition Possible threat Mitigation

DHCP
Condition Possible threat Mitigation

Separate server room(-s)

Condition Possible threat Mitigation

Wire management
Condition Possible threat Mitigation

Physical security
Condition Possible threat Mitigation

Temperature control
Condition Possible threat Mitigation

Proper labelling
Condition Possible threat Mitigation
 Workstations equipped
Condition Possible threat Mitigation

EOL dates
Condition Possible threat Mitigation

TOTAL SERVERS
Total servers

NOTES
DATA MAINTENANCE
Software used
Condition Possible threat Mitigation

RTO/RPO
Condition Possible threat Mitigation

Frequency of backups
Condition Possible threat Mitigation

Destination for critical data

Condition Possible threat Mitigation

Backups destination
Condition Possible threat Mitigation

Encryption
Condition Possible threat Mitigation

Secure offsite storage

Condition Possible threat Mitigation

№ of data copies
Condition Possible threat Mitigation

Retention time
Condition Possible threat Mitigation

NOTES
QUESTIONS TO ASK
1 Do you have security plan? How many Comments
times/year it is reviewed? Who has access?

2 Do you track the accesses given to the Comments

employees? (least priviledge policy)

3 How do you control credentials? MFA/2FA? Comments

4 Do you have any of the security products? Comments

Which ones?

5 How do you control remote employees? Do Comments

they have autolock/physical security/shared
accounts/access to the critical data?

6 How often do you monitor and review Comments

logbooks? How do you track vulnerable data?
How do you detect suspicious activity?

7 Do you encrypt data? If yes, how? Comments

8 How do you perform backups? Do you use 3-2- Comments

1 policy? What kind of data is backed up? What
kind of storages you use?

9 Who has access to the servers where backed Comments

data is stored?

10 Do you run tests? (Data recovery, penetration Comments

tests, etc.) How often? All data or only certain
types?

11 Do you have security awareness trainings for Comments

employees? If yes, how often? What kind of
trainings?
Title:

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result

Condition Problem Result