We audit the complete set of security controls in NIST 800-53 (18 security domains, a whole week of discussions with your team) or NIST 800-171, depending on your requirements.
On top of that, we will audit your cloud environments – Azure, Microsoft 365, and Amazon AWS.
If you are a software development company, we will audit your Secure Software Development and your DevSecOps practices.
Our IT security audit is a great place to start and will highlight many vulnerabilities in your IT infrastructure that could leave you at risk of a dangerous cyber attack.
Our IT security audit examines your IT department against 965 elements present in the U.S. standard NIST 800-53 or NIST 800-171. We compare its security controls with what is present in your organization, giving urgent recommendations to implement against the risks to your business. This means you can rest assured your business is safe allowing you to focus on other parts of the business.
An IT Security audit is an audit of how resilient your information technology systems are to an attack or human error. Its scope depends on the size of your company and your objectives. A security audit might mean a quick assessment of a few systems or a comprehensive security review of your on-premise and cloud infrastructure.
We audit the controls in place (or their absence). These controls might be administrative, or in other words, the practices employed by your administrators, and they could also be technical or even physical.
Physical security controls are not necessarily related to preventing theft by an outside party. Preventing people from plugging in various unknown devices in servers and computers can also be seen as a physical security control.
Planning for the audit execution
Before conducting an IT Cybersecurity Security Audit, we have readiness meetings with your management team and the IT administrative personnel.
These meetings help establish the reasons behind the audit and its strategic security objectives. Is regulatory compliance driving your desire to audit your IT systems? Were you a victim of a security breach? Or do you want to have full visibility into how prepared you are for a hacking attack?
Here is our IT Security Audit Preparation Process:
“Give me six hours to chop down a tree, and I will spend the first four sharpening my ax.”
― Abraham Lincoln
Besides the mandatory pre-audit meetings with management, the client must undergo internal preparation for the IT Security assessment service.
On the client’s side, the following items need to be taken care of:
There might be technical details such as what is the auditor allowed to access and what information can they ask for as proof, as well as how this information will be stored and analyzed safely.
Communication is critical in every business process.
IT security audits are no exception; we need to add a few extra requirements and dependencies.
Do you suspect a security breach happened before initiating the IT security audit? In that case, can the attackers listen in on any internal email communication? In that case, most audit-related communications need to happen off-the-record. In other words, they must happen over the phone or secure instant messaging, avoiding your corporate email service.
There are several critical stages during which communication is vital:
The report you receive tends to heat political discussions and start blaming each other for the faults discovered, which is unproductive.
What we encourage our customers to do is to see the audit report as an excellent opportunity to get better at everything you do and beat your competition at it. Rest assured, if we went to your competitors, we might find similar or even worse findings. So be happy you were first to discover your faults and get ready to be the first one to fix them!
Your Audit Report will contain an executive section for senior management and a technical part for the IT and security personnel.
The Executive Section of the report usually focuses on the business impact of the findings and prioritization advice. This way, management can request specific actions to be expedited and will know about their responsibility to fund these efforts. Sometimes this also means hiring extra pairs of hands.
The technical section of the report will also be split in High Criticality, Medium Criticality, and Low criticality findings.
We pair each finding with its respective advice on fixing it – focus on the fix rather than finding who to blame for the vulnerability; it is the only productive way to read and act upon your IT security audit report.
We go beyond asking questions — and turn our security audits into half-audit, half-security consulting sessions. While there are hundreds of topics to go through, we identified the need to explain and discuss them so that your team would better understand why we ask this question and how it could affect your company.
Usually, it takes 2-3 days for data collection and a week to prepare a report and your unique Information Security Program plan. An IT security audit from start to finish usually takes around 2 weeks, excluding any prior logistics preparations and clarification meetings after you get your results.
We welcome you to record the sessions on your own — we discuss so many topics and our team provides such valuable input, that it would be a huge loss if you couldn’t watch the sessions later and extract valuable insight from them.
If you ask us, we will also record the sessions for you and provide you with the recordings. We will delete the recordings after the IT Security Audit is complete.