What is an IT security audit?
An IT security audit checks, with evidence, whether your cloud, repositories, servers and application are configured to withstand an attack and to recover if one lands. It isn't a test to pass. It's an inventory of what's open, ranked by risk, with a fix for every finding and proof that it was closed.
Plenty of companies think an audit means filling in a questionnaire or confirming the antivirus is current. Today the risk lives elsewhere: a forgotten cloud access key, a GitHub token with more scope than it needs, a server with SSH open to the whole internet, a login form with no attempt limit. A useful audit reviews all of that and tells you what to fix first.
What does an IT security audit cover?
Five areas, in the order an attack usually moves: the cloud account, which is the key to everything; the code and who can change it; the servers facing the internet; the application; and finally your ability to recover.
| Area | What gets reviewed | Typical finding |
|---|---|---|
| Cloud (AWS) | Root account, identities and MFA, logging and detection, cost alerts, storage, databases, network, secrets, backups and organization policies | Access keys nobody has rotated in years |
| Repositories (GitHub) | Identity and access, tokens and deploy keys, visibility, leaked secrets, code integrity, webhooks and activity audit | A production password in the commit history |
| Application code | SQL injection, brute force and authentication, secrets in code, XSS and CSRF, dependencies, error handling, validation and file uploads | A login with no attempt limit |
| Servers | Exposed files, TLS/HTTPS, SSH access, firewall and network, updates, services and environments, logs, backups and security headers | A «.env» file anyone can download |
| Continuity | Immutable backups, a copy in another Region, defined recovery times and restore drills | Backups nobody has ever tried to restore |
Each area has its own guide. Cloud is covered in what an AWS security audit checks, servers in the server hardening guide. Keep in mind the split AWS draws in its Shared Responsibility Model: the provider secures the infrastructure, but your users, data, network and server operating systems are yours.
The frameworks: NIST CSF 2.0 and CIS Controls v8.1
A serious audit doesn't invent its own checklist. The NIST Cybersecurity Framework 2.0, published February 26, 2024, is built for organizations of any size and organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It shows which function you've neglected, not just which server.
The CIS Controls v8.1 turn that into practice with 18 controls, from asset inventory to incident response. Their first implementation group, IG1, holds 56 safeguards CIS calls essential cyber hygiene: the floor for any company. If you've never been audited, start there.
How is it different from a pentest or a certification?
They get mixed up constantly, but they answer different questions:
| Security audit | Pentest | Certification (ISO 27001) | |
|---|---|---|---|
| Question | What's misconfigured and what do I fix first? | Can someone get in, and how far? | Does my management system meet the standard? |
| How | Control-by-control review with read-only access | A simulated, authorized attack | An accredited body audits policies, processes and controls |
| Output | Prioritized findings, fixes and before-and-after evidence | Exploited weaknesses and their impact | A certificate with an expiry date |
They aren't mutually exclusive. The CIS Controls themselves list penetration testing as the last of the 18, after the basics are in place. That's why it pays to audit and fix first, then pentest a system that's already clean. We go deeper in pentest vs. security audit. And if you're heading toward ISO 27001, read how to prepare for an ISO 27001 audit: the technical side of the controls is exactly what a security audit documents.
What deliverables should you demand, and how often?
- A scope inventory: which accounts, repositories, servers and applications were reviewed, and what was left out.
- Findings ranked by real risk, not 300 unsorted alerts. Each one says what it is, why it matters and where it lives.
- A prepared fix for every finding: what changes, why, and how to roll it back if something breaks.
- Before-and-after evidence, control by control, from the same review engine. That's what proves something was closed.
- A baseline to measure the next review against.
On frequency: a full audit at least once a year, plus another after every major change, such as a cloud migration, a new system, an admin leaving the company or an incident. In between, continuous monitoring, because configuration changes every week. A PDF describes how things looked on the day it was written; a week later someone opens a port and nobody notices.
How does Security OS run an IT security audit?
Security OS is the security audit and remediation platform by WITS. Its specialized agents cover four modules (cloud, repositories, code and servers) plus continuity. It works in three phases, which are also its plans:
- Assessment: with read-only access, the cloud auditor, repository watcher, code reviewer and server scanner produce your baseline, prioritized findings and a remediation plan.
- Remediation: the remediator prepares each change with its rollback. You approve it, it's applied and logged, with the before-and-after comparison.
- Monitoring: the engine reruns the same audit, the alert analyst translates what the cloud reports, and you get a monthly report against your baseline.
Security OS is not a 24/7 SOC with analysts watching screens, it doesn't grant certifications and it doesn't do penetration testing. It reads configuration and metadata, not the contents of your databases or files. For a quick first step, the free PHP check reviews in seconds what your site advertises, and this week's alerts tell you which vulnerabilities matter today. For everything else, see Security OS.
Tell us which cloud, repositories and servers you use. We'll reply with the assessment scope and its price before anything starts.
Request an assessmentFrequently asked questions
What is an IT security audit?
It's an evidence-based review of your cloud, repositories, servers, application and continuity. It delivers findings ranked by risk, a fix for each one and proof that it was closed.
Is it the same as a pentest?
No. An audit reviews configuration control by control; a pentest simulates an attack to see how far it gets. It pays to audit and fix first, then pentest a system that's already clean.
Will a security audit get me ISO 27001 certified?
No. Certification comes from an accredited certification body. A technical audit helps you prepare the controls and the evidence that audit asks for.
How often should I run an IT security audit?
At least once a year and after every major change or incident. In between, continuous monitoring, because configuration changes every week.
Which framework is used?
The most common are the NIST Cybersecurity Framework 2.0, with its six functions, and the 18 CIS Controls v8.1. For companies just starting, CIS Implementation Group 1 bundles 56 essential safeguards.
Do you need admin access to my systems?
No. Security OS audits with read-only permissions. Fixes are applied one at a time, with your approval and a prepared rollback.
What if I already had an incident?
The Security OS forensics agent rebuilds the timeline and preserves the evidence before it expires. Then we fix what allowed it.
Sources
- NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024)
- NIST Cybersecurity Framework
- CIS Critical Security Controls v8.1
- CIS Controls: the 18 controls
- CIS Controls: Implementation Group 1
- AWS: Shared Responsibility Model
Written by Samuel Hinojosa and the wITS security team · Updated Oct 25, 2026 · Markdown
