IT security audit — what it covers and when to carry one out

An audit is complete when the organization knows what to fix first, who owns it and by when. After a first IT security audit, a company with no incident history usually receives a list: outdated servers, former administrators’ accounts, missing second-factor authentication and untested backups. There was no attack, but risk had existed for months; human decisions and a consistent process closed the gaps. Learn the scope of an audit and when to schedule one.

Key information:

• An audit compares evidence against criteria —without criteria, all that remains is a list of impressions.
• Scope extends beyond infrastructure —identities, permissions, backups and response processes matter as much as device configuration.
• The report is the halfway point —value comes from prioritizing gaps and verifying fixes.
• Statutory audit deadlines depend on entity status —the legal obligation applies to specified essential entities.
• Effectiveness depends on people, process and timely response —tools provide the signal; the organization does the rest.

What is an IT security audit?

Management commissioning an audit receives an evidence-based view of the organization: configuration exports, logs, interview records and test results. Security audit IT compares reality with agreed criteria: policies, contractual terms, legal requirements and adopted configuration standards. Criteria, purpose and scope are established before the work, not afterward. Without criteria, the result is a list of the auditor’s impressions that cannot be defended before management or a regulator.

The idea that an audit is merely a document for management comes from reviews that end with a fault list. Good IT security analysis has technical, process and organizational layers. Each finding is translated into risk: downtime cost, data loss or interrupted customer service. A finding without an owner and deadline does not reduce risk.

What does a professional security audit cover?

The answer is broader today than five years ago. Established frameworks—NIST Cybersecurity Framework 2.0 and CIS Controls—cover the full cycle from asset inventory to response and recovery. An IT infrastructure audit covers only part of that list.

Area	What the audit checks	Typical finding
Assets	inventory completeness, owners and versions	unrecorded systems
Accounts and permissions (Active Directory, Microsoft 365)	privileged accounts, file sharing and access reviews	active accounts belonging to former employees
Network, firewall and VPN	alignment of rules with architecture, segmentation and remote access	internet-exposed management panels
Backups	backup isolation, restore tests and agreed times	backups stored on production resources
Logging and monitoring	log retention, correlation and the path from alert to decision	alerts without an after-hours recipient
Policies and suppliers	current documentation and subcontractor oversight	a policy that does not match the actual process

Active Directory and Microsoft 365 audits are often among the most time-consuming areas because years of accumulated privileges reside there. Firewall and network audits check whether segmentation limits lateral movement after a workstation is compromised. The logging layer determines the rest, because deploying SIEM in a company (Security Information and Event Management) does not improve security without a team analyzing alerts.

The audit assesses backup condition and restore testing. SecureVault handles data recovery and post-incident business continuity; VigilHorizon handles detection and incident response.

What does an audit involve, step by step?

The audit process directly affects how much work remains afterward. Established methodologies separate planning, evidence gathering and analysis because each stage involves different people on the client side.

1. Purpose, scope and criteria —which systems are included and the requirements against which they will be assessed.
2. Information gathering —asset inventory, documentation and administrator interviews.
3. Environment analysis —configurations, permissions, network rules, backups and logs.
4. Risk identification —connecting technical findings with business processes.
5. Vulnerability assessment —scans and tests with agreed scope and timing.
6. Report and recommendations —findings supported by evidence, risk severity, an owner and a deadline.

At VigilHorizon, the report starts our work. Completion means closing the remediation list. When security audit is led by an external partner, we work with the client team to sequence findings: what closes this week, what needs a maintenance window and what needs budget. We take responsibility for conclusions. Every item receives an owner and deadline; a document closes nothing by itself.

The most common problems found in audits

Audits of medium-sized organizations regularly uncover similar problem categories, regardless of industry or IT budget.

• Missing multi-factor authentication —MFA does not cover VPN, email or administration panels.
• Excessive privileges —service accounts with administrator privileges and former employees in privileged groups.
• Missing segmentation —workstations can reach production servers across one flat network.
• Outdated systems —servers past vendor support, retained because they „still work.”
• Monitoring without a recipient —alerts reach a mailbox nobody reads after hours.
• Backups without restore tests —backups run every night, but nobody has checked whether they can restore a service in time.

The last two points matter most because they concern an incident already in progress. A backup becomes evidence of readiness only after a restore test. The test addresses two questions: how quickly the service must return—RTO (Recovery Time Objective), and how much data loss is acceptable—RPO (Recovery Point Objective).

In practice, these areas divide into two roles: VigilHorizon handles detection and response, while SecureVault handles data recovery and restoration of business continuity. Read more in our guide: Incident Response — responding to a cyberattack step by step.

Security audits vs. penetration testing

An organization ordering a penetration test instead of an audit receives an answer to a narrower question than it asked. Within an agreed scope, a penetration test checks whether a selected attack path can actually be completed —which is how penetration testing differ from vulnerability scanning. An audit evaluates a broader set of controls, processes and evidence.

Criterion	Security audit	Penetration testing
Question	whether controls and processes meet the criteria	whether an agreed attack path can be completed
Scope	technology, processes, organization and suppliers	specified systems or network segments
Evidence	configurations, logs, documents and interviews	a record of the attack sequence
System impact	usually non-invasive	active work requiring a window and rules
Outcome	risk assessment and a remediation plan with owners	a list of confirmed attack vectors

An audit starts a process that genuinely changes risk levels. Penetration tests are planned separately because they require agreed scope and timing. At VigilHorizon, we first ask which assets are missing from the inventory, who receives signals after hours and how long the path from alert to decision takes.

Security audits and NIS2

Article 20 of NIS2 requires management bodies to approve and oversee risk-management measures. Article 21 requires incident handling, access control and assessment of implemented security measures’ effectiveness. An audit helps management verify that effectiveness, which is why preparing for NIS2 starts with a compliance audit.

In Poland, the amendment to the National Cybersecurity System Act has applied since 3 April 2026, with self-registration by 3 October 2026. The first statutory audit, due by 3 April 2028, applies to specified essential entities, with subsequent audits at least every three years. Therefore, an NIS2 compliance audit starts by determining the entity’s status.

ISO 27001 certification helps but does not settle the matter—the similarities and key differences between ISO 27001 and NIS2 affect audit scope. The law concerns the ability to detect and handle incidents, so compliance evidence is an operating process supported by the people running it.

A gap can be found in hours. Establishing who will close it and by when takes the rest of the project—and that is the part that reduces risk.

VigilHorizon expert

When should you conduct an audit?

Audit timing rarely follows the calendar alone. The schedule reflects risk profile, legal requirements and the pace of environmental change. IT risk analysis is the starting point: it identifies processes that cannot tolerate several hours of interruption.

• Before implementing NIS2 requirements —to understand the starting point and extent of gaps.
• After an acquisition or merger —two environments mean two sets of policies and unfamiliar dependencies.
• Before cloud migration —the responsibility model changes, and old access rules rarely transfer without adjustment.
• After a cyberattack —response findings must become lasting changes.
• Before ISO 27001 certification —a review reduces the list of nonconformities.
• Periodically —at a frequency suited to environmental change.

A typical scenario: an organization commissions a routine review with no recent incident. The audit finds an administrator-level service account with a years-old password, a management port exposed after migration and a backup stored on a production resource. The same findings after an attack would mean downtime, notifications and response-team work. Organizations maintaining readiness for NIS2 and ISO 27001 therefore schedule reviews alongside architectural changes.

In such a scenario, VigilHorizon detects the incident and leads response, while SecureVault handles recovery from backups and restoration of business continuity.

Does your organization need an audit?

The answer usually lies in five checks you can make before speaking to an external provider. Each concerns something that determines losses during an incident—including whether round-the-clock monitoring is backed by a team capable of responding.

• Assets —is there a current list of systems, applications and devices with their owners?
• Permissions —do you know who currently has administrator rights and when these were last reviewed?
• Last review —has an audit or another formal assessment taken place in the past year?
• Monitoring —are events analyzed around the clock, including weekends and holidays?
• Recovery —have service-restoration procedures been tested and results recorded?

Two „I don’t know” answers are usually enough to justify establishing the current position. At VigilHorizon, we start with roles: who confirms ticket closure, who approves emergency changes and what happens to a task when its owner is away. Playbooks and triage structure the rest, but first, ownership must be clear.

From audit findings to a security improvement plan

Much of the risk lies in vulnerabilities the organization does not yet know about. An IT security audit reveals them, assesses their business impact and prioritizes fixes before someone exploits them. Tools provide signals; people, processes and timely response build protection.

If even one checklist answer was uncertain, start with risk analysis and a structured response process, then discuss findings with VigilHorizon experts. The next steps follow the evidence: close gaps, assign owners and review implemented changes.

Contact us

Frequently asked questions (FAQ)

What is an IT security audit?​

It is a documented assessment comparing the organization’s state against agreed criteria. The same criteria become the reference for the next audit, allowing results to be compared over time.

How long does an audit take?​

Duration depends on scope, system count and interview availability, so there is no universal number of days. The speed at which the organization provides documentation and access is often decisive.

Does an audit require shutting down systems?​

Interviews and configuration reviews usually do not affect operations. Scans and active tests are planned separately because they require a time window and system-owner approval.

How often should audits be performed?​

Frequency follows risk profile and the pace of change. Even without changes, time matters: aging risk information becomes unreliable sooner than expected.

How does an audit differ from a penetration test?​

The distinction is the question asked and the evidence used. A useful sequence is to audit first to identify where to look, then penetration-test a selected high-risk path highlighted by the findings.

Does NIS2 require audits?​

The Directive requires assessment of risk-management measures’ effectiveness—regular checks that controls work. Beyond statutory duties, business partners and insurers increasingly expect the same, so establish entity status before an external request arrives.

Who should participate in the audit from the organization?​

In addition to administrators, business-process owners and a management representative are needed. Without them, findings enter the IT task queue and remain there.

Does ISO 27001 certification replace a security audit?​

Certification confirms a management system within a defined scope, often narrower than the entire IT environment. A technical audit reaches areas beyond that certification scope.

What should an audit report contain?​

Every finding needs evidence, business-impact assessment, a recommendation, an owner and a deadline. Separate immediate fixes from changes requiring a project.

Does an audit guarantee that no incident will occur?​

There are no such guarantees in cybersecurity, and no credible report promises one. An audit reduces unknown vulnerabilities and structures response when an incident occurs.

Learn more

• NIS2 compliance audit — how to prepare your organisation
• SIEM in your company — why deployment alone does not improve security
• What is SOC 24/7? How a Security Operations Center works and why monitoring is not enough
• The first 60 minutes of a cyberattack — what really happens and why every minute matters