IT Security Audit Checklist for UK Businesses

A good IT security audit checklist does three things: it sets a clear scope, it walks through each control area (governance, access, network, endpoints, data, suppliers, incident response), and it names the evidence you need to collect for every item. Below is a working checklist built around UK guidance from the NCSC, the ICO and GOV.UK, with notes on ISO 27001 and how often to repeat the exercise.

TL;DR

• Define scope and objectives first, then audit by risk. Higher-risk systems and processes are checked more often.
• For every checklist line, record the evidence: a configuration, a log, a policy, a signed approval, an interview note.
• UK GDPR expects you to test the effectiveness of your security measures regularly. The type and frequency depend on your data and risk.
• An ISO 27001 internal audit is run by you; a certification audit is run by an accredited third party. Prepare for both from the same evidence.
• Treat the checklist as a start. The output that matters is a prioritized action plan with owners and dates.

Table of Contents

• What an IT security audit covers
• Before you start: preparation checklist
• The IT security audit checklist by control area
• Collecting evidence that stands up
• Tailoring the checklist to your sector
• UK legal and regulatory points to build in
• ISO 27001 audit checklist: internal versus certification
• Following up: from findings to a plan
• How often to repeat the audit
• Perspective
• Get an audit built around your business
• FAQ
• Sources

What an IT security audit covers

The three names you will see (IT security audit, information security audit, cybersecurity audit) overlap, but the emphasis differs. An IT security audit leans toward technical infrastructure: networks, servers, endpoints and software. An information security audit is wider and takes in policies, procedures, governance and how data is protected across the business. A cybersecurity audit concentrates on digital controls and on whether governance and response processes can defend against cyber threats.

In practice, most UK organizations need a blend. A law firm’s auditor will care as much about who can open a client matter folder as about firewall rules. A retailer will weigh payment systems and third-party plugins. So write your scope in plain terms: which sites, which systems, which data, which suppliers, and which standard or regulation you are measuring against. If you want the longer background on audit types, our guide to the IT security audit for global businesses and the companion piece on the cybersecurity audit go deeper.

Before you start: preparation checklist

ISACA stresses that defining the audit objective and taking a risk-based view are critical, especially because cybersecurity is so broad. Preparation is where audits are won or lost.

1. Write the objective. Is this for UK GDPR assurance, a customer questionnaire, ISO 27001 readiness, a board request or a post-incident review? The answer changes the depth.
2. Set the scope. List business units, locations, cloud tenants, critical applications and data stores. Multi-location firms should state explicitly which offices are in and which are out.
3. Build an asset inventory. You cannot audit what you have not listed: hardware, software, cloud services, accounts and data flows.
4. Choose the criteria. Pick the frameworks you will test against, such as the NCSC Cyber Assessment Framework, Cyber Essentials, ISO 27001 Annex A or sector rules.
5. Allocate time and skills. NQA’s ISO 27001 guidance says an audit should define scope and criteria, allocate appropriate time and skills, and be evidence-based.
6. Agree who signs off. Name the executive who receives findings and owns remediation.

The IT security audit checklist by control area

The ISMS auditing guideline describes fieldwork as interviewing staff, reviewing documents and records, observing processes, checking configurations and recording evidence. It also recommends tailoring checklists to the audit’s scope, scale and risks. The table below follows that logic: each area lists what to check and what proof to keep.

Governance and risk

Start here. The ICO recommends assigning responsibility for monitoring information security practices, reporting findings to management, assessing risks before new projects and keeping local and central risk registers. Ask to see the risk register and check that it changes: a register untouched for a year is a finding in itself.

Access and identity

Test a sample of leavers from the last quarter and confirm every account was closed. Review who holds administrator rights and why. Confirm multi-factor authentication covers email, remote access and all privileged accounts, not just the ones that are easy to enroll.

Network, remote access and endpoints

GOV.UK’s IT Health Check guidance says scope should cover internet-facing systems, firewalls, remote-access solutions such as VPNs and relevant third-party connections. Internal testing should cover configurations, patching, remote access, mobile devices, wireless networks and representative vulnerability scanning. The same guidance says that where you have many devices, the vulnerability-testing sample must be no less than 10% of the estate. That is a useful floor even if you are not working to a government scheme.

Data, backups and cloud

Do not accept “backups run nightly” as evidence. Ask for the last successful restore test, who ran it and how long it took. For cloud services, compare actual settings with a written baseline; our six-step cloud security posture checklist covers that in detail.

Monitoring and incident response

Check that logs from identity, endpoints, firewalls and cloud services reach one place, that someone looks at them around the clock or has a defined cover model, and that a real alert can be traced from detection to closure. The NCSC board guidance also suggests rehearsing incident response with Exercise in a Box. If monitoring is thin, a managed SOC service or managed SIEM is the usual way to close the gap without hiring a night shift.

Suppliers and managed providers

Supply chains are where many audits find the surprises. The NCSC recommends a four-tiered approach to vendor assessment: assess security declarations, check implemented processes, test equipment where relevant, and keep assessing throughout the relationship. If you use a managed service provider, the NCSC notes that regular infrastructure health reports covering uptime, patch compliance and backup success give you an auditable trail. Ask for them and keep them.

For suppliers that process personal data on your behalf, a data processing agreement checklist helps you confirm what the contract should cover, such as processing instructions, security measures, sub-processors and breach notification.

People

Check that training is recent and role-based, and that phishing simulation results lead to follow-up rather than a dashboard nobody reads. Look at starter and leaver checks for staff with privileged access.

Collecting evidence that stands up

A checklist tick without proof is an opinion. For each line, record four things: what was tested, how, what was seen, and who confirmed it. Screenshots should show dates; exports should show the system and the time. Keep everything in one working-papers folder with a consistent naming scheme so a second reviewer, or an external assessor, can retrace your steps.

The NCSC’s Cyber Assessment Framework is outcome-focused and designed to discourage tick-box assessments. Take the hint. For each control ask not only “does it exist?” but “does it achieve its purpose?” A patching policy exists; the question is whether critical patches reached 95% of devices within your stated window, and what happened to the rest.

Tailoring the checklist to your sector

No generic list fits every firm. NQA’s guidance says organizations should assess internal and external context, including systems, infrastructure and sector regulators, and audit higher-risk processes more frequently. Some practical adjustments:

• Financial services: add third-party concentration risk, transaction monitoring systems, privileged access to trading and payment platforms, and operational resilience mapping.
• Healthcare: add clinical system access, medical devices on the network, and information governance meetings. A 2026 ICO audit report for an NHS trust highlighted regular Information Governance Committee meetings, physical access controls and structured change advisory board reviews as assurance practices.
• Law firms: add client matter access segregation, secure file exchange, and email security.
• Retail: add payment environments, point-of-sale estates and e-commerce plugins. Our note on PCI penetration testing requirements explains why annual tests alone fall short.
• Energy and digital services: the ICO’s NIS guidance says relevant digital service providers must maintain policies for assessment, inspection and verification, and Ofgem’s 2025 assurance guidance for downstream gas and electricity says audits should review risk management, adherence to policies and the effectiveness of mitigation.

UK legal and regulatory points to build in

The UK GDPR security principle and Article 32 require technical and organizational measures appropriate to the risk. The ICO’s data security guide states that you must regularly test, assess and evaluate the effectiveness of those measures, while the kind and frequency of testing depend on your organization and the data you hold. Put a line in your checklist for that: what testing happened, when, and what changed as a result.

The ICO’s own audit toolkit recommends independent internal reviews of controls, including audits and IT health checks, plus externally commissioned vulnerability assessments, penetration tests and audits. It also suggests action plans for issues found, recording them in risk registers, and lists certifications such as ISO 27001 and Cyber Essentials Plus as options. If your audit finds technical weaknesses, a scoped penetration test is the natural way to prove whether they can be exploited.

ISO 27001 audit checklist: internal versus certification

An ISO 27001 checklist should follow the standard’s requirements: ISMS scope and policy, risk assessment and treatment, the Statement of Applicability, Annex A controls, internal audit and management review. NQA explains that internal audits are run by the organization to confirm ongoing compliance, while certification audits are carried out by third-party UKAS-accredited bodies. ISO/IEC 27007:2020 gives guidance on managing an ISMS audit programme, conducting audits and evaluating auditor competence.

Certification follows a pattern. TÜV NORD UK describes a two-stage initial audit: Stage 1 reviews ISMS documentation and Stage 2 evaluates implementation and effectiveness. Surveillance audits follow annually in years two and three, and recertification comes every three years.

A simple ISO 27001 audit plan has five parts:

1. Programme: which clauses and Annex A controls are covered in the year, with higher-risk areas visited more often.
2. Scope and criteria for each audit: sites, processes and the requirements being tested.
3. Auditor independence: whoever audits should not audit their own work.
4. Fieldwork schedule: interviews, document review and observation, with time allowed for sampling.
5. Reporting and follow-up: nonconformities, corrective actions and a management review.

For the detail on what assessors tend to catch before Stage 2, see our article on ISO 27001 audit requirements.

Following up: from findings to a plan

An audit report that lists forty findings without an order is a to-do list nobody finishes. Sort findings by risk to the business, not by the order of the checklist. For each one, set an owner, a target date, the fix, and how you will prove it is fixed. Record accepted risks in the risk register with an approver’s name. Then report progress to the board in a form it can use; our piece on cybersecurity risk reporting metrics for UK boards suggests what to show. If you want a wider view of how audit findings feed your risk picture, read our guide to cyber security risk.

How often to repeat the audit

The NCSC says boards should arrange regular reviews of defensive measures, and that a cyber security posture review within the past 12 months is a good sign measures remain effective. So treat annual as the baseline for a full audit. Then add triggers: a merger, a new office, a major cloud migration, a significant incident or a new regulatory duty. Between full audits, keep higher-risk areas such as internet-facing systems, privileged access and critical suppliers on a more frequent cycle. Continuous vulnerability management helps here because it turns part of the audit into a routine.

Perspective

We see the same pattern in multi-location organizations. The checklist is complete, every box is ticked, and yet nobody can say which five issues would hurt the business most if exploited next week.

That is why we build audits around operational reality rather than a generic template. We scope by your sites, your regulated data and your suppliers, then explain each finding in plain terms and hand back a roadmap that sets out what to fix first, who owns it and how to prove it is closed.

An audit is most valuable when it connects to what happens afterward: monitoring that detects problems, testing that proves the fixes, and a support model that scales as you open offices or add systems. Our approach to IT support and security is designed to keep those pieces joined up, rather than leaving you with a report and a gap.

Shirish

Get an audit built around your business

If you would rather not run this alone, our IT security audit is scoped to your sector, locations and systems. We explain findings in clear terms and provide an actionable roadmap, so improvements are structured rather than a generic checklist.

If you need ongoing coverage as well, our global IT support can sit alongside monitoring and testing, so audit actions are followed through.

FAQ

What should be on an IT security audit checklist?

Cover governance and risk, access control, network security, endpoints and patching, data protection and backups, cloud configuration, monitoring, incident response, suppliers, people and physical security. For each item, note the evidence you will collect. Tailor the list to your scope, size and sector.

How is an ISO 27001 internal audit different from a certification audit?

An internal audit is carried out by your own organization, or someone you appoint, to confirm the ISMS keeps working. A certification audit is carried out by an accredited third party in two stages, then surveilled annually and recertified every three years.

Is a security audit a legal requirement in the UK?

No single law demands an audit by that name. However, the UK GDPR requires appropriate technical and organizational measures and regular testing of how effective they are. Certain sectors face further rules, such as NIS obligations for relevant operators and digital service providers.

How often should we audit?

At least annually for a full review, in line with the NCSC’s view of a posture review within 12 months. Audit higher-risk systems more often, and repeat after major changes such as acquisitions, migrations or incidents.

Can we use a free checklist template?

A template is a reasonable starting structure, but it needs tailoring to your systems, suppliers and regulators. Without that, you risk ticking boxes that do not reflect your real exposure.

Sources

• ISACA: Auditing cybersecurity
• NQA: ISO 27001:2022 implementation guide
• ISMS Auditing Guideline
• ICO: Information and cyber security management
• GOV.UK: IT Health Check supporting guidance
• NCSC: Cyber Security Toolkit for Boards
• NCSC: Vendor security assessment
• NCSC: Choosing a managed service provider
• NCSC: Cyber Assessment Framework V3.2
• ICO: Birmingham Women’s and Children’s NHS Foundation Trust audit summary
• ICO: Security requirements under NIS
• Ofgem: NIS Security Assurance Guidance
• ICO: A guide to data security
• ICO: Compliance toolkit
• ISO/IEC 27007:2020
• TÜV NORD UK: ISO 27001

Recommended

• UK Cyber Security: A Practical Business Risk Guide
• Cyber Threat Detection for UK Businesses
• Cyber Security Services UK: A Practical Business Guide