A branch network security checklist scores one site at a time, on the security controls that site can fail by itself. This one has ten checks, and each names the record that shows a pass. Mark every check 2, 1 or 0 on one card per branch, then rank the branches. Any branch with a zero on a gate check goes first, and the rest follow, lowest share of marks first. For a scored audit of the whole network, use the audit list instead, since this page stays with a single site.
Last reviewed 2026-11-08 by Manish Sharma.
The card suits IT heads and security leads in India and the GCC who already run branches, stores, clinics or small offices. The marks, the window and the gate checks below are our suggestions, and a firm can change any of them.
Branch Network Security Checklist: Marks for One Site’s Score Card
Give every branch its own card with ten rows, one per check. The site lead gathers the records, and someone from central IT reads them and writes the marks. Each card then works as a short branch site security assessment that two people can repeat and reach the same total.
Each row takes one of three marks:
- 2: a dated record from inside the firm’s window that matches what runs at the site today.
- 1: a record exists, but it is older than the window or covers only part of the site.
- 0: there is no record, or the record itself shows the gap.
A claim with no paper behind it earns 0. For example, a guest Wi-Fi that nobody can show the setting for stays at 0 until the record turns up.
Mark a row not applicable only when the thing it checks is absent from the site. Central IT writes the reason on the card and signs it. The row then drops out of the maximum, so a kiosk with no guest network loses nothing for lacking one.
Where a check rests on a list, look at three entries on site or over a video call.
The card has no pass line. Instead, its total ranks branches against each other and tracks one branch over time.
Take check 3, for example, as a worked row. First, the site lead copies the firewall model and version. Then central IT reads the end of support date from the maker’s notice. If that date lies ahead and the record falls inside the window, the row scores 2.
The Branch Network Security Checklist: Evidence to Find at Each Site
Copy the three tables below into one card per branch. Keep the check numbers the same at every site as well, so the cards line up. Each row names the record to look for, when it earns a 2 and who reads it.
The branch network security checklist asks about the site as it runs on the day of marking. Fixing a row that scores 0 is a separate job, and the build guide linked under the results covers it.
In the tables, “the window” means the age the firm allows for a record. The firm sets it, and we suggest six months.
What the Branch Runs, and How It Is Divided
Checks 1 to 3 cover devices, groups and the edge firewall.
| No. | Check | Record that shows a pass | Marks 2 when | Who looks |
|---|---|---|---|---|
| 1 | Device register | The site’s register lists every device with its owner, purpose and software version, access points and switches included. | Three devices picked on site match their entries, and the switch port list shows unused ports turned off or placed in the guest group. | Central IT reads the register while the site lead walks the floor. |
| 2 | Separation | A settings export or diagram, dated inside the window, places guest, staff and payment or sensitive devices in separate groups. | The export matches what runs at the site, and a phone on the guest network reaches the internet but nothing else. | Central IT reads the export and also runs the phone test. |
| 3 | Local firewall | One dated record holds the firewall model, software version, last update date and the maker’s end of support date. | The support date lies ahead, and the site also runs the latest update its maker has issued. | Central IT checks the dates against the maker’s notice. |
Check 2 looks at segmentation as it stands on the day of marking. A diagram drawn at installation, and not compared with the site since, earns a 1 at best.
NIST’s SP 800-41 Rev. 1 (2009) asks for firewall software to be patched as its maker releases updates. Under the card’s rule, a branch firewall still inside support, yet two updates behind, scores 1.
Read the end of support date for the exact model and hardware revision, since a maker can set different dates for the hardware and for each software release.
Who Can Change the Branch, and Against What Standard
Checks 4 to 6 in the branch network security checklist look at who holds the keys to the site and which written standard it follows.
| No. | Check | Record that shows a pass | Marks 2 when | Who looks |
|---|---|---|---|---|
| 4 | Same baseline | A dated comparison sets this site’s settings beside the firm’s written baseline, and a named person signs each difference. | The comparison falls inside the window, and every difference carries a reason as well as a signature. | Central IT reads the comparison. |
| 5 | Named admins | A list ties each admin account on the firewall, switches and Wi-Fi to one person. | No shared or factory login works, and each account on the list also asks for a second sign-in check. | Central IT compares the list with the accounts each device shows. |
| 6 | Internet traffic checked | A log extract from the checking point shows this site’s internet traffic passing through it. | The extract falls inside the window, and the device register shows no other exit from the site. | Central IT reads the extract. |
The NIST guide also advises a review of the firewall policy at regular intervals. At one branch, the dated comparison in check 4 is the record of that review.
Check 5 counts the second sign-in check per account, so a single account without it holds the row at 1. The card leaves aside where the checking for check 6 takes place, on site or in a central service; that choice belongs to a different review.
Would Anyone Notice, and Who Would Answer
Checks 7 to 10 ask whether trouble at the site would reach a person who knows what to do.
| No. | Check | Record that shows a pass | Marks 2 when | Who looks |
|---|---|---|---|---|
| 7 | Unknown device | The last alert of a new device joining this site’s network shows what happened next. | The alert falls inside the window, and the record names who looked as well as what they did. | Central IT reads the alert history. |
| 8 | Logs reach a person | Firewall and admin sign-in logs from the site sit in a central store, and device clocks agree. | One alert from the site, inside the window, shows a named person picked it up. | Central IT opens the store. |
| 9 | Site contact | A named site contact and deputy with phone numbers, plus the person who reports incidents to the national authority. | Both names are current, and when called, each number reaches the right person. | The site lead makes the calls. |
| 10 | Dated drill | The last drill record at this site gives the date, what the team tried, the result and open items. | The drill falls inside the window, and each open item has an owner. | Central IT reads the record. |
Reporting Duties for Branches in India
For firms in India, the April 2022 reporting directions from CERT-In touch checks 8 and 9. They ask firms to keep logs for a rolling 180 days within India. Device clocks should also sync with the time servers of NIC or NPL, or servers traceable to them. In addition, the directions ask for reports to CERT-In within 6 hours of noticing an incident of the types they list, as well as a named Point of Contact, whom each branch should know. GCC readers, however, should check their own national authority’s rules.
Key Takeaway Each row names one record and one reader. Two people marking the same branch should then reach the same total.
Branch Network Security Checklist Results: Which Branch Goes First
When every branch has a card, put the cards side by side. The order rule has two parts plus a tie-break, and it decides where the team spends its first weeks.
Gate Checks That Move a Branch to the Front
We suggest three gate checks: check 2 (separation), check 3 (firewall support) and check 5 (named admins). A 0 on any of them puts that branch ahead of every branch without a gate zero, whatever its total.
Each gate is one weakness that can expose the whole site. For example, a flat network can let one infected device reach the rest. A firewall past support also stops getting fixes from its maker. A shared login, in turn, lets anyone who knows it change the site. A firm may also add check 8 or swap a gate. In that case, write the choice on every card so the cards stay comparable.
A branch that scores low on several rows at once needs more than a row-by-row fix list. It points to gaps in the build itself, and the full branch build in order gives a better starting point for that site.
A Worked Ranking of Three Branches
The three branches below are invented to show the rule at work. Share means marks scored out of the marks available after any not-applicable rows drop out.
| Branch | Gate zeros | Marks | Share | Order |
|---|---|---|---|---|
| A | One, on check 3 | 15 of 20 | 75% | First, because of the gate zero |
| B | None | 11 of 18 | 61% | Second, as the lower share |
| C | None | 17 of 20 | 85% | Third, with the highest share |
Branch A has a higher share than Branch B. Even so, its firewall is past the maker’s support date, and that gate zero moves it to the top. Branch B has no guest Wi-Fi and no payment devices. Central IT therefore marked check 2 not applicable, signed the reason, and its maximum fell to 18. Its 61% is lower than Branch C’s 85%, which puts it ahead of Branch C.
If two branches tie on gate zeros and share, the one with more payment or sensitive devices on its register goes first. Once Branch A replaces its firewall, a fresh mark on check 3 in the branch network security checklist moves it down the list.
Triggers for Marking a Branch Again
Mark a branch again when something at the site changes:
- after a fix, marking only the rows the fix touched;
- when the site gets a new firewall;
- after a move or a refit;
- when the site contact or the deputy changes;
- after an incident at the site.
Apart from these triggers, the full card comes round on the firm’s window. Also keep each old card. A total that falls across two readings is worth a call to the site lead before the next visit.
Key Takeaway A score is a dated reading of what the records showed, and it holds only until the site changes.
What a Branch Score Leaves Out, and When to Call In Help
A card from this branch network security checklist shows which records exist and what they say. However, it does not judge the design behind them. For instance, a separation export can score 2 while the groups it shows still allow more traffic than the work needs.
A branch office security audit by a specialist helps in four cases. First, a firewall is past support and the replacement needs a plan. Second, nobody can produce the admin list. Third, logs from a site reach no one. Finally, a regulator or an auditor asks for an outside view. For the reasons small branches face this risk at all, read why small sites draw attention.
Some subjects sit outside the card, such as remote access for staff who work away from an office, which has its own pages. Link uptime, capacity and provider contracts belong with branch connectivity, set out in the causes of link outages between sites. The approach a firm picks for checking branch traffic is a separate decision as well, set out in matching each group of branches to an approach.
Signisys provides this work through its cybersecurity team and its zero trust and endpoint security solution. The page on Signisys work on branch site security describes the wider offer. Read this page as advice from a firm that sells the work. Even so, the card needs only the records and two people to read them.
If your cards show zeros and you want a second reader before you plan fixes, Signisys can mark one or more of your sites with your team. No charge, with a fixed scope.
Branch Network Security Checklist FAQ
Can the site manager collect the evidence, or does IT need to visit?
How does the branch network security checklist treat a site that shares a building network with another firm?
Should a two-person site or a kiosk get every check?
How does the branch network security checklist apply when a provider runs the branch firewall?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.