Information System Audit Checklist
1. Governance and Compliance
2. Information Security Management
3. IT Infrastructure and Operations
- Review device settings for compliance with security policies.
- Ensure strong passwords and authentication methods are enforced.
- Confirm firmware is up to date.
- Check for unnecessary open ports and services.
- Document configurations and changes.
- Review access controls and permissions for all users.
- Ensure encryption is implemented for sensitive data.
- Check for default settings and harden configurations.
- Validate logging functions are enabled for security events.
- Conduct regular security assessments.
- Verify backup schedules and retention policies.
- Ensure backups are stored securely and off-site.
- Test recovery procedures for effectiveness.
- Document backup logs and verify successful completion.
- Review access controls for backup data.
- Confirm that event logging is enabled for all systems.
- Ensure logs are stored securely and monitored regularly.
- Review alerting mechanisms for critical events.
- Assess the retention period of log data.
- Conduct periodic log analysis for anomalies.
- Review firewall rules for unnecessary access.
- Ensure IDS/IPS signatures are updated regularly.
- Test systems against known vulnerabilities.
- Document changes to firewall and IDS/IPS configurations.
- Monitor alerts for unusual activity.
- Schedule regular vulnerability scans.
- Assess findings and prioritize remediation.
- Document testing methodologies used.
- Review results with stakeholders.
- Ensure retesting of remediated vulnerabilities.
- Review patch management policies and procedures.
- Verify timely application of critical patches.
- Assess testing procedures for patches before deployment.
- Document all applied patches and updates.
- Monitor for new vulnerabilities post-patching.
- Ensure all assets are logged in an inventory system.
- Verify the accuracy of asset details (e.g., model, version).
- Conduct periodic audits of physical assets.
- Document asset lifecycle management processes.
- Assess compliance with licensing agreements.
- Review network diagrams for segmentation effectiveness.
- Validate access control lists for critical systems.
- Test firewall rules between segments.
- Document exceptions and justifications for access.
- Monitor traffic between segments for anomalies.
- Review policies and procedures for compliance.
- Conduct regular audits against standards.
- Document non-compliance issues and remediation plans.
- Provide training on compliance requirements.
- Engage external auditors for objective assessments.
- Review deployment of antivirus and antimalware solutions.
- Verify regular updates and definitions are current.
- Test endpoint protection against common threats.
- Document incident response procedures for infected devices.
- Monitor for alerts and respond accordingly.
- Ensure hypervisor settings comply with security policies.
- Verify isolation between virtual machines.
- Check for unnecessary services running on hypervisors.
- Document configurations and changes to virtual environments.
- Conduct assessments for vulnerabilities in virtualized systems.
- Verify that monitoring tools are configured for critical systems.
- Review performance metrics and establish baselines.
- Document incidents of performance degradation.
- Schedule regular reviews of monitoring configurations.
- Assess the response time to alerts.
- Review incident response plans for completeness.
- Ensure roles and responsibilities are clearly defined.
- Document escalation procedures and communication plans.
- Conduct regular training and simulation exercises.
- Update plans based on lessons learned from incidents.
Use in Manifestly