Checklist template

IT Security & Cybersecurity Audit

A ready-to-use checklist with 31 items in 5 sections, covering Physical Security & Access, Network & Device Security, Data Protection & Backup, Identity & Access Management, Incident Response & Training. Use it as-is in Bindy, or adapt it to your own standards in minutes.

  • 5 Sections
  • 31 Items
  • 25 Yes / No checks
  • 5 Scored ratings
  • 271 Points

Use this template How audits work

1. Physical Security & Access 6 items

  1. Is the server room/IT closet locked and accessible only to authorized staff? Yes / No 10 pts
  2. Are security cameras positioned to monitor all entry points to IT infrastructure? Yes / No 8 pts
  3. Is there a visitor log for any external vendors entering restricted IT areas? Yes / No 7 pts
  4. Are all unused network ports in public areas (lobby/meeting rooms) disabled? Yes / No 9 pts
  5. Is a "Clean Desk" policy enforced (no passwords on sticky notes)? Yes / No 10 pts
  6. Physical Defense: Rating
    • Highly Secure 10 pts
    • Minor Gaps 5 pts
    • Critical Vulnerability 0 pts

2. Network & Device Security 6 items

  1. Is Multi-Factor Authentication (MFA) required for all remote logins? Yes / No 10 pts
  2. Are all workstations and servers running current, patched OS versions? Yes / No 10 pts
  3. Is a corporate firewall active with "Deny All" as the default rule? Yes / No 9 pts
  4. Are Guest and Corporate Wi-Fi networks physically or logically separated? Yes / No 9 pts
  5. Is an Endpoint Detection & Response (EDR) or Antivirus active on all devices? Yes / No 8 pts
  6. Network Resilience: Rating
    • Fully Hardened 10 pts
    • Patches Pending 5 pts
    • Unsecured 0 pts

3. Data Protection & Backup 6 items

  1. Are daily backups performed and stored in a separate, off-site location? Yes / No 10 pts
  2. Has a "Restoration Test" been successfully performed in the last 90 days? Yes / No 10 pts
  3. Is sensitive data (PII/Financials) encrypted at rest and in transit? Yes / No 10 pts
  4. Is there a formal process for wiping data from decommissioned hardware? Yes / No 8 pts
  5. Are cloud storage permissions audited for "Least Privilege" access? Yes / No 7 pts
  6. Data Integrity: Rating
    • Zero Loss Risk 10 pts
    • Backup Untested 5 pts
    • No Redundancy 0 pts

4. Identity & Access Management 6 items

  1. Are user accounts for terminated employees disabled within 24 hours? Yes / No 10 pts
  2. Is there a quarterly audit of "Admin" level privileges? Yes / No 9 pts
  3. Are strong password complexity requirements enforced via Group Policy? Yes / No 8 pts
  4. Do employees use a managed Password Manager for company credentials? Yes / No 7 pts
  5. Is remote access restricted to a secure VPN or Zero-Trust Gateway? Yes / No 9 pts
  6. Access Control: Rating
    • Strict/Audited 10 pts
    • Over-privileged Users 5 pts
    • Unmanaged Access 0 pts

5. Incident Response & Training 7 items

  1. Is there a written Incident Response Plan (IRP) accessible to key staff? Yes / No 10 pts
  2. Have all employees completed Phishing Awareness training this year? Yes / No 9 pts
  3. Are "Disaster Recovery" contact lists current and available offline? Yes / No 8 pts
  4. Is there a formal process for reporting lost or stolen company devices? Yes / No 9 pts
  5. Are software "Supply Chain" vendors vetted for their own security standards? Yes / No 7 pts
  6. Preparedness Level: Rating
    • Response Ready 10 pts
    • Low Awareness 5 pts
    • No Plan in Place 0 pts
  7. Final summary Comments

About this template

This checklist is part of the Bindy template library. Yes / No checks score 1 point when met; ratings score the points shown for each option. The overall score is the percentage of points earned, with N/A answers excluded. In Bindy you can add photos, assign corrective actions, require sign-off and compare results across sites.

Categories

Related templates

← All templates

Brand standards

At every site, every time

Start Free Contact us