What does a security audit involve, step by step?

Key information

• Assigning roles has practical consequences —a named person owns each stage’s outcome, while undefined scope leads to disputes about what the audit missed.
• Scope is agreed at the start —the opening meeting connects business objectives with systems and regulatory requirements.
• Evidence matters more than declarations —the auditor asks for a log, ticket or service-recovery test report.
• The report includes an action plan —each finding receives a priority, owner, deadline and verification method.
• The result emerges after the audit —the report sets the work order, while a change in risk becomes visible only at the next review of the same area.

Stage one—understanding the organization

The opening meeting has one business purpose: establish which management questions the final report must answer. At this stage, the IT security audit is a discussion of objectives, critical systems and regulatory requirements. The parties also agree working rules: who supplies evidence and when testing may take place.

We start with services the company cannot stop for more than a few hours, then identify the systems supporting them. This creates a hierarchy of areas linked to business impact. This single list already shows what the audit will look like in the organization.

Seven stages and what each leaves behind:

Stage	What the organization receives
1. Understanding the organization	documented scope, working rules and schedule
2. Environment inventory	an asset register linked to services and owners
3. Configuration analysis	a list of deviations from adopted rules and exceptions
4. Vulnerability verification	confirmed findings with impact assessments
5. Process assessment	an assessment of operational readiness and role gaps
6. Report and recommendations	a risk map with a prioritized action plan
7. Post-audit work	confirmation that identified weaknesses have been eliminated

For management, the second column matters more than the stage names: it shows the written output left with the company. If nobody can identify that output for a stage, clarify it in the scope before work begins.

Environment inventory

Protection extends only as far as asset knowledge, so an IT infrastructure audit starts by identifying what actually runs in the company. ENISA’s June 2025 guidance covers hardware, software, data and services, both on-premises and in the cloud.

The asset register usually includes:

• Servers and specialist business systems —linked to the business services they support.
• Network and perimeter devices —routers, firewalls and internet connections.
• Identity and access —Active Directory and privileged accounts.
• Cloud services —the Microsoft 365 tenant and resources outside the server room.
• Endpoints —workstations, laptops and maintenance equipment.

The auditor compares the register with the actual environment and adds systems created outside the official process. Linking each asset to a service and owner provides the basis for assessing the organization’s security.

Configuration and security-control analysis

A control protects only as well as it is configured, so IT security analysis examines settings and exceptions. The auditor reviews MFA deployment, administrative privileges and backup policies. A separate area is the network audit: segmentation and traffic rules between systems of differing criticality.

What does the auditor check in Microsoft 365?

A Microsoft 365 audit checks tenant configuration; a license sets no rules by itself. It examines privileged access, sign-in conditions, log retention, email and file-sharing settings. Configuration can be compared with published CISA benchmarks, although that comparison covers only one part of the environment.

For EDR (Endpoint Detection and Response) and SIEM (Security Information and Event Management), the auditor requests different evidence: how many assets the agent covers, whether events arrive and what happens to an alert. Settings show how the environment was built. The next stage checks what can be exploited.

Vulnerability verification

A vulnerability scanner generates hypotheses that become audit findings only after verification. Some results are false positives or concern decommissioned systems. Remediation order follows the importance of the affected service; technical severity is only one factor. Penetration testing checks whether a weakness can be exploited within agreed limits— penetration testing differs from vulnerability scanning in purpose and depth.

A well-run IT security audit leaves the organization with a risk map and a prioritized action plan. Technical findings are the raw material for that plan. VigilHorizon orders them by business-service impact, available resources and regulatory requirements.

Assessing processes and procedures

Response delays usually stem from missing decisions, so this stage concerns people and working practices. The auditor reviews incident response, change management, access reviews and business continuity plans.

Polish legislation implementing NIS2 sets an audit cycle for essential entities. The Act published on 2 March 2026 requires an audit at least every three years. This is covered separately in NIS2 compliance auditing and organizational preparation.

How does an auditor check whether a procedure works?

By asking for execution evidence: a response-exercise record or a service-restoration report assessed against RTO (Recovery Time Objective) and RPO (Recovery Point Objective).

An exercise record and recovery report meeting the stated RTO show that the procedure works beyond the document. For ISO 27001, a technical audit supplies evidence for the information security management system but does not replace it.

We learn most when we ask for proof that a procedure was performed. A policy statement is then supported by a log, ticket or test report—or revealed as an intention that has never been tested.

Report and recommendations

The final report should support decisions. Alongside findings, it includes an action plan ordered by organizational impact. Each item records the finding, evidence, business consequence, priority, owner, deadline and verification method. The audit concludes by discussing this list with IT and management because a priority assigned without discussing resources rarely leads to completion.

Illustrative audit results and priorities—actual priorities always depend on organizational context:

Area	Outcome	Priority
Active Directory	Needs improvement	High
MFA	Partially implemented	Medium
Backup	Compliant	Low
Monitoring	No 24/7 monitoring	High

We treat a recommendation as actionable only when it has an owner, deadline and agreed verification method. A bare „needs improvement” label returns unchanged in the next assessment, so we ensure each item has an assigned person and a point at which someone will check the outcome.

What happens after an audit?

A report changes the company’s situation only when it triggers work, so the following weeks involve implementation and verification. Work usually begins with high-priority items, while vulnerability management is established as an ongoing practice. Some organizations add penetration testing or periodic configuration reviews.

A useful example: an organization starts an assessment believing its environment is secure, but analysis reveals excessive administrator privileges, missing 24/7 monitoring and outdated response procedures. Addressing these areas shortens the time it takes to notice an event and make a decision. That is why monitoring starts providing protection when someone owns alert handling.

Lack of after-hours response is the most common reason organizations engage continuous SOC coverage: a 24/7 SOC service adds people, initial alert-assessment procedures and response playbooks to the tools.

Summary

For management, an audit’s value lies in a list of issues ordered by their impact on service continuity. After the audit, management selects changes, assigns leads and sets deadlines. Risk falls only when that work is completed. At VigilHorizon, we conduct security audit or NIS2 compliance auditing and turn findings into a recommendation implementation plan with deadlines. Start with the services that cannot stop.

Frequently asked questions (FAQ)

How long does a security audit take?​

Duration depends on agreed scope, environmental complexity and the availability of people and evidence. The schedule is developed after the opening meeting.

Does an audit require downtime?​

The test plan establishes business impact, considering system criticality and permitted windows. A blanket promise that testing will cause no disruption is not justified.

Does the audit include Microsoft 365?​

Yes, if the tenant is within the agreed scope and the auditor receives read access to configuration and logs. Time from the environment administrator is also useful.

How often should audits be performed?​

Frequency depends on risk profile and the pace of environmental change. Vulnerability scanning follows a separate, often much shorter cycle.

Does NIS2 require audits?​

The Directive lists audits among supervisory tools. A particular company’s obligation follows its status under Poland’s National Cybersecurity System legislation. Each organization has its own status and transitional deadlines.

How does an audit differ from penetration testing?​

An audit identifies risk across the environment; a penetration test examines a selected part for exploitable weaknesses. Companies usually commission them in that order.

Learn more

• The first 60 minutes of a cyberattack — what really happens and why every minute matters
• Why most security alerts are never analysed
• A cyberattack starts earlier than you think: the first signs nobody notices