Unveil the IT Secrets!

AceYourGeneral IT
AuditwithThis
Ultimate Checklist
Don't overlook what matters.
Dive into a meticulous IT audit. Swipe for golden
nuggets of audit wisdom!

Towshin Sharier, CISA

@towshinst
01
IS PolicyandProcedure
Lack of comprehensive policies
Strategic/Operational
Unauthorized access, data breaches

1. Are the security policies in line with industry

standards and regulatory requirements?
2. How are policies communicated and enforced across
the organization?
3. What is the frequency and process for policy reviews
and updates?
4. What training mechanisms are in place for employees
regarding security policies and procedures?

Towshin Sharier, CISA

@towshinst
02
AccessControl
Management
Inadequate access restrictions
Operational/Technical
Compromised user credentials

1. How often are user access privileges reviewed and

adjusted?
2. What is the process for user account lifecycle
management?
3. Are access control activities documented and subject
to audits?
4. What measures are in place to thwart unauthorized
access attempts?

Towshin Sharier, CISA

@towshinst
03
NetworkSecurity
Assurance
Unsecured network communications
Technical
Network intrusion, data interception

1. Are network devices configured according to security

best practices?
2. How are intrusion detection and prevention systems
utilized?
3. What security measures are in place for wireless
networks?
4. How are remote access methods secured and
monitored?

Towshin Sharier, CISA

@towshinst
04
DataProtection
Strategies
Ineffective data encryption
Technical
Data loss, theft

1. How is sensitive data identified and safeguarded?

2. Are backup and recovery processes periodically
verified?
3. Is encryption employed for data at rest and in transit?
4. What data loss prevention mechanisms are
implemented?

Towshin Sharier, CISA

@towshinst
05
ApplicationSecurity
Protocols
Poor application design
Technical
Application vulnerabilities, exploits

1. Are secure coding guidelines adhered to?

2. How are third-party applications vetted for security?
3. Are web applications assessed for vulnerabilities?
4. What is the procedure for application server
maintenance?

Towshin Sharier, CISA

@towshinst
06
Incident Response:
ChaosInto Order
Slow incident response
Operational
Prolonged system downtime, reputational
damage

1. Is there an established incident response plan?

2. How are security incidents managed and resolved?
3. Who comprises the incident response team?
4. What is the protocol for external communication
during incidents?

Towshin Sharier, CISA

@towshinst
07
PhysicalSecurity
Measures
Inadequate physical barriers
Operational
Theft, unauthorized physical access

1. What physical access controls are in place for IT

infrastructure?
2. Is surveillance used to monitor and prevent
unauthorized access?
3. How are environmental threats to IT equipment
mitigated?
4. What is the process for the secure disposal of IT
assets?

Towshin Sharier, CISA

@towshinst
08
ITRiskManagement
Framework
Incomplete risk assessments
Strategic
Overlooked threats, insufficient resource
allocation.

1. How are IT risks identified and prioritized?

2. What risk management strategies are employed?
3. How is the effectiveness of risk treatments
monitored?
4. What is the frequency and format of risk reporting to
leadership?

Towshin Sharier, CISA

@towshinst
09
VendorManagement
Protocol
Reliance on third-party services
Operational/Strategic
Third-party breaches, service interruptions

1. Are vendors evaluated for security before

engagement?
2. How are vendor contracts managed to align with
security requirements?
3. What is the process for ongoing vendor performance
review?

Towshin Sharier, CISA

@towshinst
10
ComplianceAssurance
Incomplete risk assessments
Strategic
Overlooked threats, insufficient resource
allocation.

1. How are IT risks identified and prioritized?

2. What risk management strategies are employed?
3. How is the effectiveness of risk treatments
monitored?
4. What is the frequency and format of risk reporting to
leadership?

Towshin Sharier, CISA

@towshinst
11
MonitoringandLogging
Procedures
Insufficient monitoring
Operational
Undetected breaches, non-compliance
issues

1. Are monitoring systems in place for security events?

2. How frequently are logs reviewed for anomalies?
3. What is the log retention and secure storage
strategy?
4. Are there automated systems for alerting on critical
security events?

Towshin Sharier, CISA

@towshinst
12
ITInfrastructure
Security
Outdated infrastructure
Technical
System failures, compatibility issues

1. Are IT components secured against known threats?

2. What is the schedule for vulnerability assessments?
3. How are security patches managed and applied?
4. Is there a disaster recovery plan for IT failures?

Towshin Sharier, CISA

@towshinst
13
TrainingandAwareness
Initiatives
Lack of employee training
Operational
Human error, phishing attacks

1. Are regular security trainings conducted for

employees?
2. Is there a method to evaluate employee security
awareness?
3. How are employees prepared for incident response?
4. Are security policies actively communicated to staff?

Towshin Sharier, CISA

@towshinst
14
CloudSecurity
Management
Insecure cloud configurations
Technical
Cloud breaches, data leaks

1. Are cloud services monitored for security

compliance?
2. Is cloud data encrypted and access-controlled?
3. How are cloud providers audited for security
adherence?
4. What governance is in place for cloud service usage?

Towshin Sharier, CISA

@towshinst
15
MobileDeviceSecurity
Unprotected mobile devices
Technical
Device theft, mobile malware

1. Are mobile devices managed centrally for security?

2. What measures prevent unauthorized data access on
mobile devices?
3. How is data on lost/stolen devices handled?

Towshin Sharier, CISA

@towshinst
16
BCP and DR Planning
Inadequate backup strategies
Operational
Inability to recover from disasters.

1. How often are continuity and recovery plans tested?

2. What is the recovery time objective for critical
systems?
3. Is there a communication strategy for disaster
scenarios?
4. Are backups secure and tested for integrity?

Towshin Sharier, CISA

@towshinst
17
Documentation and
Record-Keeping
Poor documentation practices
Operational
Loss of critical information, non-
compliance

1. Are IT processes and controls documented

comprehensively and kept current?
2. How are records of security incidents and audits
maintained for compliance?
3. What strategies are in place for secure documentation
storage and management?

Towshin Sharier, CISA

@towshinst
Comment if we
missed anything!
For more deep dives into IT governance and security,
my journey.

Towshin Sharier, CISA

@towshinst