What Is an IT Security Audit? What It Covers, What It Costs, and a Checklist
An IT security audit is a structured review of how well your business protects its systems and data, from passwords and backups to firewalls, laptops and the people using them. It tells you where you’re exposed before an attacker, an auditor or your cyber insurer finds out. Here’s what a good audit covers, how it differs from a penetration test, roughly what it costs, and a checklist you can use to prepare.
What an IT security audit covers
A thorough audit looks at people, processes and technology:
- User accounts and access: who has access to what, admin rights, accounts belonging to former employees, and multi-factor authentication (MFA)
- Network security: firewall configuration, Wi-Fi, remote access and VPN, open ports
- Devices: patching, antivirus or endpoint protection, encryption and unsupported operating systems on laptops, desktops and servers
- Microsoft 365 or Google Workspace: sharing settings, email security (SPF, DKIM, DMARC) and admin roles
- Backups and recovery: whether backups run, are protected from ransomware, and have been tested
- Policies and training: password rules, incident response, and phishing awareness training
- Compliance: requirements that apply to you, such as HIPAA, PCI DSS or your cyber insurance questionnaire
Many auditors organize findings around the NIST Cybersecurity Framework 2.0 and its six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Security audit vs. vulnerability scan vs. penetration test
| Type | What it does | Best for |
|---|---|---|
| Vulnerability scan | Automated tool checks systems for known weaknesses | Ongoing monthly or quarterly checks |
| IT security audit | Reviews settings, policies and practices against a standard | A full picture of your security and compliance gaps |
| Penetration test | A specialist actively tries to break in | Testing defenses after the basics are fixed |
Most small businesses should start with an audit, fix the findings, and then consider a penetration test.
How much does an IT security audit cost?
Cost depends on how many users, devices and locations you have, and on whether compliance (HIPAA, PCI DSS) is in scope. A small business audit is far smaller in scope than an enterprise one. Ask for a fixed-price quote with a clear scope, and make sure it includes a written report with prioritized fixes, not just a scan printout.
For context, IBM’s 2026 Cost of a Data Breach report puts the global average cost of a breach at $4.99 million. An audit costs a small fraction of that.
12-point IT security audit checklist
Use this to prepare, or as a quick self-check:
- ☐ MFA turned on for email, Microsoft 365 and remote access
- ☐ No active accounts for former employees
- ☐ Admin rights limited to the people who need them
- ☐ All computers and servers receiving security updates (no unsupported Windows versions)
- ☐ Endpoint protection on every device, monitored centrally
- ☐ Firewall firmware up to date, with unused ports closed
- ☐ Guest Wi-Fi separated from the business network
- ☐ Email protected with SPF, DKIM and DMARC
- ☐ Backups running, protected from ransomware, and restore-tested
- ☐ Laptops encrypted
- ☐ Staff phishing training in the last 12 months
- ☐ A written incident response plan: who to call if something happens
How often should you do an IT security audit?
At least once a year, and after any major change, such as a new office, a merger, a move to the cloud or a security incident. Many cyber insurers and compliance standards also expect regular reviews. Pair it with a tested business continuity plan, so you know how to recover if something does get through.
Free help for some organizations
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers free Cyber Hygiene vulnerability scanning to government bodies and critical infrastructure organizations. It’s a useful scan, not a full audit.
Get an IT security audit from ITsoft
ITsoft performs IT security audits and compliance reviews for businesses across the U.S., with onsite support in the Oklahoma City area. You get a plain-English report with fixes ranked by risk and cost, and help fixing them if you want it.
FAQs
How long does an IT security audit take?
For a small business, usually one to three weeks from kickoff to the final report, depending on size and how quickly information is available.
Will an audit disrupt our work?
No. Most of the review happens remotely or after hours, with short interviews with key staff.
Do we need an audit for cyber insurance?
Many insurers now ask detailed security questions, such as about MFA, backups and endpoint protection. An audit makes sure your answers are accurate, which matters if you ever file a claim.
Related reading: Cybersecurity protection for companies · HIPAA compliance IT services · PCI DSS audit and remediation · Security & compliance
