A network security audit checks whether your network controls are in place and whether you can show that they work. This checklist gives an IT head or business owner in India or the GCC 20 checks for a firm with one IT lead. Each check has evidence to keep and a pass test. The endpoint security audit is the same method applied to laptops and servers, as checks 13 to 15. It is a self-check, but not an independent audit and not a certificate.
Last reviewed 2026-11-01 by Manish Sharma.
What a Network Security Audit Covers, and Where CERT-In Fits
Section 5 of CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, 25 July 2025) defines a cyber security audit as “a systematic and independent assessment of an organization’s security controls, policies, and procedures”. The same idea carries over to the network. However, the self-check below is not independent in CERT-In’s sense.
A vulnerability assessment finds flaws and a penetration test tries to use them, while an audit checks the controls and the proof. See network security for the field itself.
CERT-In wrote the guidelines for empanelled auditors and the organisations they audit (section 4). They describe themselves as binding on “auditee entities covered under the relevant provisions”. This article does not say whether your firm is one of them, so treat the guidelines here as a reference for good practice. Section 6 says auditee organisations are expected to ensure a comprehensive audit of their ICT systems at least once a year. Section 13.1.2 says an audit “should be performed after every major change” in infrastructure and application, depending on the criticality involved. Ask your own advisers whether any rule applies to you. This is general information, but it is not legal advice.
The scope is an office or branch network and its endpoints, as in protecting endpoints and business networks. For cloud networks, use our checklist for CISOs.
Key Takeaway A check passes only when you meet the test and keep dated evidence on file.
How to Score This Network Security Audit Checklist
Mark each check Pass, Partial or Fail. This scoring rule is Signisys’ own, and CERT-In does not define it.
- Pass: you meet the test and file the evidence with a date.
- Partial: you meet the test on some systems, or the evidence is missing.
- Fail: you do not meet the test.
No evidence means no pass, whatever the team believes. Where a test says “sample”, pick five items at random across sites. Write the picks down, so you can repeat the result later. The same sampling rule applies on laptops, and an endpoint security audit uses the same marks and the same evidence folder.
Keep one evidence folder with dated exports and screenshots, and a one-line note of who ran each check. Section 18 of CERT-In’s guidelines says audit observations should rest on objective evidence. It also says audit evidence “must be stored securely, with access restricted to authorized personnel only”. If you apply that to the folder, give access to the IT lead and one reviewer only (Signisys’ suggestion). To keep the same kind of record for response readiness, see the 18-check response readiness list.
Someone who did not build the network brings a view the builder may not have. For that reason, ask a colleague outside IT to read the evidence (Signisys’ suggestion).
Record the date and the exact result of each check.
Network Security Audit Checklist: 20 Checks, Six Groups
Each table below gives the check, the evidence to collect and the pass test. The checks cite control IDs from CERT-In’s 15 Elemental Cyber Defense Controls for MSMEs (version 1.0, 1 September 2025). CERT-In wrote those controls for MSMEs, while the groups and pass tests are Signisys’ own.
Network Security Audit Checks 1 to 3: Scope, Assets and Map
This group fixes what you check. A diagram dated within the last year is Signisys’ rule of thumb.
| Check | Evidence | Pass test |
|---|---|---|
| 1) Scope has a written note | A dated note listing sites, networks, cloud accounts and exclusions | If every site and network has a name and each exclusion has a reason, the check passes (CERT-In guidelines, section 5 ii) |
| 2) Asset list matches the network | Device list beside an export of addresses seen on switches | When five addresses picked at random sit on the list, each with an owner, the check passes (CERT-In EAM.1) |
| 3) A current network diagram exists | A diagram dated within the last year | If the diagram shows zones, internet links and remote access, and it matches five sampled devices, the check passes |
Checks 4 to 8: Perimeter and Network Devices
In a network security audit, checks 4 and 5 are the firewall checks. The post on an unpatched firewall covers firewall patching and firmware in more depth.
| Check | Evidence | Pass test |
|---|---|---|
| 4) Firewall rules get a review | Rule export with an owner and reason for each rule | Each allow rule has an owner and a reason, while none allows any source to any destination (CERT-In NES.1) |
| 5) Firewall and switch firmware is current | Version list per device beside the vendor’s support dates | If no device is past vendor support (Signisys’ test), and you apply security patches and firmware updates, the check passes (CERT-In PM.1) |
| 6) Admin access to network devices has limits | Configuration export and a login attempt from a staff laptop | Management pages answer only from the admin network, and no device keeps a factory default password (CERT-In SC.2). Each administrator signs in with a personal account, not a shared one (CERT-In ACIM.1) |
| 7) Only intended services face the internet | A dated scan from outside the office network | When only the services you meant to expose, as written down before the scan, answer, the check passes |
| 8) Wireless has a safe configuration | Access point configuration and a test from a guest device | If encryption is WPA2 or WPA3 and you changed the defaults, while a guest device is unable to reach an internal server, the check passes (CERT-In NES.2) |
Network Security Audit Checks 9 to 12: Access Inside the Network
These rows ask who can reach what once inside. These rows test network segmentation, multi-factor authentication and identity and access management.
| Check | Evidence | Pass test |
|---|---|---|
| 9) The network has zones | Rule or VLAN export and the result of one reach test | When a staff laptop is unable to reach the server management network, the check passes |
| 10) Sign-ins use a second check | Account list with a second-check status | If every administrator and remote-access account has one, and the exceptions list is empty, the check passes (CERT-In RPP.4) |
| 11) Accounts get a review and leavers go | The last access review and a list of recent leavers | If you disabled every leaver of the last quarter and dated the review, the check passes. CERT-In ACIM.3 asks for access reviews at least quarterly or on role change or exit |
| 12) Vendor and third-party access has a list | List of vendor accounts and remote tools with owners | If every vendor account has an owner and an end date, and you disable it when the contract ends, the check passes. CERT-In TPRM.1 and TPRM.2 cover due diligence on each vendor and holding vendors to the same security standard, while the owner and end-date test is Signisys’ own |
Checks 13 to 15: Endpoint Security Audit
An endpoint security audit applies the same method to laptops and servers. It also needs one list of every company device. The rows use endpoint security and endpoint detection and response in plain terms, with no tool comparison. If a device is missing from that list, the endpoint security audit does not cover it.
| Check | Evidence | Pass test |
|---|---|---|
| 13) Endpoint protection covers every listed device | Console export of enrolled devices beside the device list | When every device on the list reported in the last day, and the gap list has names, the check passes (CERT-In EMS.1) |
| 14) Endpoint configuration follows a baseline | The baseline document and a settings export from five sampled devices | If unused ports and services are off, you changed default passwords, and removable media has limits, the check passes (CERT-In SC.1, SC.2, EMS.4) |
| 15) Personal and unmanaged devices have a known place | List of non-company devices seen on staff Wi-Fi | If each one lands on a guest or limited network, or sits on the device list, the check passes |
Checks 16 to 18: Detection and Recovery
A network security audit also asks whether you would see a problem and recover from it.
| Check | Evidence | Pass test |
|---|---|---|
| 16) Logs reach one place and an alert fires | Log source list and a screenshot of a test alert | If a test event, for example a failed administrator sign-in, appears in the collected logs and raises the alert, and logs are kept for a minimum of 180 days with secure storage within Indian jurisdiction (CERT-In LM.1), the check passes. A firm outside India should check which storage rules apply to it |
| 17) A restore has a test | Restore log with date and time taken | When one restore from the emergency copy worked within the time you wrote down before the test, the check passes (CERT-In DPBP.2) |
| 18) The incident plan has a rehearsal | The plan, its last exercise note and the contact list | If the plan names who decides whether an incident is reportable to CERT-In, and who sends the report, the check passes (CERT-In MSME control IM.3 points to the Directions of 28 April 2022 and a report to CERT-In within 6 hours of detection or notification) |
CERT-In’s Directions of 28 April 2022 say any service provider, intermediary, data centre, body corporate and Government organisation shall report the cyber incidents listed in Annexure I to CERT-In within 6 hours of noticing them or being told of them. This article does not say whether your firm or a given event falls under them, so read the Directions and ask an adviser. This article makes no claim about authorities outside India. To turn check 18 into a written plan, see the six-step guide to writing the plan down.
Network Security Audit Checks 19 and 20: Test and Report
The last two rows turn the audit into action. They also build on the vulnerability assessment named in the first section.
| Check | Evidence | Pass test |
|---|---|---|
| 19) An independent vulnerability assessment has run | The report, scan dates and the scope it covered | If someone outside the team did it in the last year, and every item has a rating and an owner, the check passes (CERT-In VAA.1) |
| 20) A findings register exists and fixes get a re-check | The register: finding, rating, owner, due date, re-test date | When every Fail has an owner and a date, and each closed item has a dated re-test, the check passes |
Turn the Results into a Fix List
Fix the Fails from your network security audit before the Partials. Start with the ones that expose the network from outside, then the ones that let someone move between zones. For the rest, use a risk assessment to set the order. This ranking is Signisys’ suggestion. For risks beyond the network, see the IT risk checklist for growing firms.
Hand the findings register to the person who fixes things, not the whole folder. Re-test every closed item, as check 20 says. If a Fail sits in the endpoint security audit rows, fix it in the same order as any other Fail.
Repeat the checks after a major change to the network, a new site or a new remote access method, in line with section 13.1.2 of CERT-In’s guidelines. The guidelines also say the yearly audit frequency may count as a minimum for the organisations they cover. They do not state that as a rule for your firm.
Key Takeaway Fix the Fails that face the internet first, then re-test each one.
When to Bring In an Outside Auditor
Bring in an outside party when you need an independent view, or when a customer, regulator or insurer asks for an independent report. Read what each of them asks for, as this article makes no claim about their rules. A major change coming up is another reason, and so is testing that tools and checklists don’t give. CERT-In’s guidelines (section 8) say solely tools-based testing should be discouraged, as tool-based audits may overlook manual components.
In a network security audit, an outside party can add a further view on checks 19, 4, 6 and 9 (Signisys’ view). It can also run a penetration test, which this checklist does not. Bring the evidence folder to the outside party, so it can see what you have already checked. The same goes for the endpoint security audit rows, where an outsider can sample devices you did not pick.
Signisys provides security assessment services, but this article keeps that offer to the call to action boxes. Signisys’ VAPT and cybersecurity risk assessment page describes it. This article makes no claim that Signisys audits against any standard.
What This Checklist Does Not Cover
This page covers a self-check of an office or branch network and its endpoints. It leaves out cloud networks, the choice of tools, the fix order, how attacks start, and legal advice on reporting. This page treats the endpoint security audit as three checks and does not compare endpoint tools. Signisys’ articles on how to harden a business network, how a device gets compromised and how to choose endpoint protection cover the middle three. For cloud networks, see the cloud security checklist linked earlier. For the gaps behind check 16, see six detection gaps and a short drill to test them.
Signisys provides security assessment and network security services for growing firms. The cybersecurity services page lists what Signisys offers, while the decisions on each gap stay with your own team.
Network Security Audit FAQ
What is a network security audit?
How often should a business run a network security audit?
Can my IT team do its own audit, or do I need an outside auditor?
What is the difference between a network security assessment and a network security audit?
Does an endpoint security audit need a different checklist?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.