This checklist audits cyber security arrangements, from policies and controls to malware protection, phishing awareness and incident response.

Effective Audit Checklists

Prepared using the F-Q2 Audit Checklist form template.

The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Checklist number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists developed over 25 years through practical use in the real world.

Further Reading

Further guidance on cyber security and internal auditing:

• Cybersecurity Essentials
• Phishing and Social Engineering
• Malware Protection and Patching
• Internal Auditing knowledge base

Logo Update Service

Download this audit checklist template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Cyber Security Audit Checklist Template

A management system audit checklist for cyber security, set against good practice rather than a single standard, with a note under each question on what to check. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top, and each question alongside the auditee and the evidence viewed, response and findings.

Questions Covered

• Whether cyber security guidance is available, and where updates on the latest threats come from
• What policies and procedures are in place for cyber security, such as incident reporting and monitoring unusual activity
• What controls support the arrangements, such as password protection, access control, admin privileges and data backup
• What physical controls protect IT assets, such as key card entry, surveillance and access control
• How IT assets are tracked, issued and protected
• How information security risks for cyber security are identified and reduced
• How software and equipment are protected from malware, including anti-virus, updates, restrictions on downloads and USB devices, and firewalls
• Whether user accounts are set up on a least privilege basis
• What cyber security and phishing training staff receive
• Whether there is an incident response plan
• Whether the organisation works to the principles of confidentiality, integrity and availability

Carrying Out the Audit

The note under each question says what to look for, so the checklist can be followed by someone who is not an IT specialist. Ask to see the settings and records, such as the IT equipment register, the anti-virus status on a sample of devices and the user account rights, rather than relying on a description.

Planning the Audit

Have the information security policy, the IT equipment register, the information security risks register and the incident response plan to hand, and arrange time with whoever manages the IT systems. If IT is supported by an outside provider, ask them for the records beforehand.

Who Should Carry Out the Audit?

Anyone trained in internal auditing who is independent of the area being audited. The questions are written in plain language, so the checklist also works well for training new internal auditors.

Related Documents

Documents that work alongside this checklist:

• P-114 Cyber Security Policy
• ER10 IT Equipment Logins Register
• ER15 Information Security Risks
• PP-8-02 Anti Malware Policy Procedure
• F-Q109 Information Security Incident

Adapting the Checklist

The questions can be edited, added to or removed to suit the way the organisation works, and the scope and criteria at the top changed to match the area being audited. Because every alphaZ audit checklist uses the same F-Q2A layout, audit records look the same whichever area was audited, which makes them easier to review and compare.

Using the Findings

Weaknesses are raised as actions, prioritised by risk, and anything that leaves systems exposed is put right straight away.