A useful IT audit checklist for a small business is six plain questions, one for each area in the Cybersecurity and Infrastructure Security Agency’s Cyber Essentials guide, that an owner should be able to answer. No scoring sheet required. A question you can’t answer is a finding, and it’s one to take to your IT provider.
Without those answers, a business can keep unsupported equipment in use and leave accounts open for people who’ve left. It may also be unable to tell an insurer, a customer or an incoming IT provider what it has and how it’s protected. So the practical task is a short one. Ask the six questions, then have the IT provider put the answers in writing.
What Goes on an IT Audit Checklist for a Small Business?
It’s six questions, one for each area in CISA’s Cyber Essentials guide: leaders, staff, devices and software, access, data and crisis response. Each is a question an owner should be able to answer, with help from the IT provider. That’s the audit. Gathering the evidence behind the answers is the work.
- Leaders: how much of the daily work depends on IT, and who owns IT policies and spending?
- Staff: do employees get basic security awareness, and do they know who to tell about something suspicious?
- Devices and software: is there a current list of every computer, server, phone and program, and is anything on it no longer supported?
- Access: is there a current list of everyone with an account, vendors included, and what happens to access when someone changes role or leaves?
- Data: is the sensitive information located, and are key systems backed up automatically with protected copies kept offline?
- Crisis response: is there a written plan with named roles, has it been tried, and does the business know who to call?
As a general rule, a question you can’t answer is a finding rather than a failure. Write it down and ask for the answer.
Do You Know What Devices and Software You Have?
CISA’s Cyber Essentials guide asks leaders to learn what is on the network and to keep inventories of hardware and software assets. It also asks that unsupported or unauthorized hardware and software be taken off systems. In practice, the question comes down to one list and whether it’s current.
Both points come from CISA’s Cyber Essentials guide, which is written for leaders of small businesses and for leaders of small and local government agencies. It’s guidance, not a legal duty. An owner can read it and check the business against it.
Keeping that record accurate is a job of its own, and it’s not the audit question. O&O Systems has a separate post on how to keep an equipment record current, and the method lives there. For the audit, the question is simpler: does a current list exist?
The guide also lists automatic updates for operating systems and third-party software. So an owner can ask for three things, as a general rule: the device and program list, which items are unsupported, and whether updates run on their own. If one of those has no answer, that’s the finding.
Who Can Sign In to Your Systems?
CISA’s Cyber Essentials guide asks leaders to learn who is on the network and to keep an inventory of the accounts on it, vendors and business partners included. It also says to grant access on a need-to-know, least-privilege basis. A good answer isn’t complicated. It’s a list of people and what each can reach.
The guide also asks for IT policies and procedures that address changes in user status, such as transfers and termination. The steps belong in their own place, and O&O Systems has a post on what should happen when an employee leaves. For the audit, the question is whether those procedures are written down.
The guide asks for multi-factor authentication for all users, starting with privileged, administrative and remote-access users. In plain terms, that’s a second sign-in step on top of the password. It also asks for unique passwords on every account. An owner doesn’t need to know how that gets switched on. The question is whether it’s on, and for whom.
As a general rule, an owner can ask the IT provider for the account list, vendors included, and for the name of whoever removes access when someone leaves. That’s two answers, and both belong in writing.
Where Is Your Data, and Is It Protected?
CISA’s Cyber Essentials guide asks leaders to learn what information resides on the network and to keep inventories of critical or sensitive information. It also says to establish regular automated backups and redundancies of key systems. So a good answer has two halves. It names where the sensitive information lives, and it says what copies exist.
The guide also asks for protections on the backups themselves: physical security, encryption and offline copies. An offline copy is one way around a backup that sits beside the systems it protects and may be open to the same trouble.
As a general rule, an owner can ask the IT provider to point at the places sensitive information sits. Then ask where the backups are kept, and who can reach them. Both answers belong in writing.
What Is the Plan if Something Goes Wrong?
CISA’s Cyber Essentials guide says leaders should lead development of an incident response and disaster recovery plan that outlines roles and responsibilities, and should test it often. A good answer covers three things: a written plan exists, people are named in it, and someone has tried it.
The guide also asks leaders to use business impact assessments to decide which systems must be recovered first, and to learn who to call for help. In plain words: which system can the business least do without, and who gets the first phone call?
As a general rule, an owner can ask three short questions. Who makes the first call? Where is the written plan kept? When was it last tried? If the last one has no answer, that’s worth knowing.
Who Should Keep the Answers?
As a general rule, one named person on the business side should keep the six answers. That might be the owner or an operations lead. That person asks the IT provider to supply written evidence for each answer and checks that it matches how the business works. Spread the job around and it’s nobody’s job.
CISA’s Cyber Essentials guide starts with the leader. It asks leaders to determine how much of the organization’s operations depend on IT, and to develop a culture of awareness that encourages employees to make good choices online. That’s where the first two questions come from. Neither one is a technical question.
O&O Systems’ Cybersecurity and Compliance page says its team performs in-depth assessments and audits to uncover vulnerabilities.
If the six answers come back thin, these four requests to the IT provider are a reasonable place to start:
- Give me the current list of devices, programs and accounts.
- Tell me which items are unsupported or no longer needed.
- Show me where the backups are kept and who can reach them.
- Show me where the written plan is and when it was last tried.
Keep the written answers in one place. As a general rule, ask for them again whenever the IT provider changes or the office moves, because that’s when lists go stale.
Frequently Asked Questions About an IT Audit Checklist
Is an IT audit the same as a security scan?
Not necessarily. A business-level review looks at what the company has, who can reach it and how it’s protected, and the answers come from records and from the IT provider. A technical scan is a different job, and a provider may offer it separately. So it’s worth asking which one is on the table, and what written result comes back at the end.
How often should a business go through the questions?
As a general rule, two triggers work. One is change: a change of IT provider, a move to another office, a shift in who holds the main accounts, or a customer or insurer asking something it hasn’t asked before. The other is a rhythm the owner picks, such as once a year, so the lists don’t go stale between those changes.
Who should answer the questions inside the business?
One named person on the business side, as a general rule. It’s a role for the owner or an operations lead. The IT provider supplies the evidence; the person on the business side confirms it matches how the company runs. That second half matters, because a list can be right on paper and still miss the laptop someone keeps at home.
What if we can’t answer several of the questions?
That’s a useful result, not a failure. Each unanswered question is a finding, and findings are what an audit is for. A reasonable place to start is the lists of devices and accounts, since the other answers may build on them. Ask the IT provider for those in writing, then take the rest one at a time.
Does CISA’s guide apply to a private business?
It’s written for leaders of small businesses as well as leaders of small and local government agencies, so it’s aimed at organizations like yours. It stays guidance, though. It isn’t a legal duty, and following it doesn’t make a business secure on its own. A fair next step is to ask the IT provider which of its points your systems already meet.
Turn the Six Questions Into Written Answers
Write each question down with its answer, the name of the person who gave it and anything still unknown. Keep that page with the IT provider’s own records. As a general rule, the unknowns are the part that’s worth working through first.
If you want an IT audit checklist turned into written answers for your own office, contact O&O Systems about your IT audit and start with the systems your staff use every day.