When you begin a partnership with a new client, you need a holistic view of their IT environment. Naturally, to do this, you must first get a list of all the devices that are on the network. Enter: network audits.
While a network assessment helps you evaluate network performance, to understand a client’s IT policies, security posture, and compliance health, you need to conduct a network audit.
A network audit enables you to detect vulnerabilities, assess permissions, and identify compliance deficiencies. Given the importance of network audits, and the complexity of some IT environments, MSPs need a clear, repeatable process to prevent errors and omissions.
In this post, we’ll cover the five “Ws” of network audits: who, what, where, when, and why. We’ll also explain how to conduct a network audit, and how to set up a network audit checklist.
Who: IT managers, MSPs, MSSPs, MDRs
MSPs and MSSPs (managed services security providers) conduct network audits to identify potential compliance problems, understand a client’s network security and performance, and of course, to find out what devices are on their network. MDRs (managed detection and response providers) conduct network audits only to evaluate/investigate security — they aren’t “full-service” IT management providers.
Internal IT managers use network audits as part of proactive maintenance. Remote workers and cloud-based business platforms increase security vulnerabilities, so IT managers need to review networks regularly to ensure security and compliance and monitor access permissions.
What: Network audit vs. network assessment
Here’s a handy table that highlights the key differences between a network audit and network assessment:
| Aspect | Network Audit | Network Assessment |
| Purpose | To establish a baseline for network policies and compliance | To get a holistic picture of a client’s network and identify inefficiencies |
| Focus | Network policies, security, and compliance health | Network performance, efficiency, and overall health |
| Methodology | Official compliance checklists (for GDPR, NIST, etc.); partially automated but requires some manual review | Can be fully automated after installing remote monitoring agents |
| Frequency | Periodic after initial onboarding; triggered by regulatory changes and/or business structure changes | Periodic after initial onboarding; triggered by widespread performance problems and/or software/hardware changes |
| Tools | SIEM systems, RMM scanning, event logs | SNMP monitoring, automated remediations, remote access |
| Outcome | A report confirming compliance or highlighting compliance errors, security vulnerabilities, and/or misconfigurations | Varies; outcome may be an internal report that helps MSPs prioritize remediations by criticality |
Where: On-site vs. remote
A network audit can be fully remote, thanks to easy-to-install agents that gather essential information. But in some cases, MSPs may want to perform some parts of an audit on-site. For example, if you’re managing IT and compliance for a bank, you may need to evaluate the security of physical systems and servers. (A remote agent isn’t able to show you the locking mechanism on a server room door, or where the key to that room is located).
When: Onboarding and ongoing
A network audit is usually part of the onboarding process. It helps you identify any security and compliance issues that require immediate attention, and if your audit doesn’t find any problems (which is unlikely), the end result is a thorough documentation of the client’s baseline compliance and data security.
Beyond onboarding, network audits may be necessary when regulations change or when there’s a structural change, like a merger or an expansion into a new state. A network audit might also be necessary when clients switch technologies. For example, a healthcare practice client that wants to migrate to a new EMR platform would need a network audit to ensure pre-migration and post-migration compliance and security.
Why: Customers, reputation, legalities
Customers rely on MSPs to protect them from compliance missteps and security breaches, and a network audit is the foundation for those objectives. Skipping the audit in the onboarding phase can create risks for clients, and risks that materialize into business disruptions or data loss can damage your reputation.
Customers that aren’t part of a tightly regulated industry like banking or healthcare may not realize that they need to shore up compliance. For example, any business with a website that tracks visitors and collects their data is subject to GDPR regulations, even if just one person in the EU accesses their website. So, best practice? Make sure all clients are GDPR-compliant.
How: Tools and tech
The right network audit software can speed up the audit process and ensure accurate documentation. At a minimum, you’ll need this technology to remotely audit networks:
RMM tools
Remote monitoring and management tools help MSPs gather information and stay ahead of client needs. Specific features to look for include:
- Real-time service monitors that show running services and processes for every device
- Automated remediation for standardized workflows
- Automated patch management to keep clients secure
- PowerShell scripting, for granular-level task automation
- Global policy management templates
Remote access tools
While remote agents can handle most information-gathering, there are times when technicians need to access and evaluate client systems and devices. Look for remote access tools like:
- Remote registry editor for managing individual devices
- Remote event viewer for accessing and filtering events
- Remote file system browser for creating, deleting, or updating files and folders
- Remote task manager to see CPU and memory usage in real-time
Beyond the tools listed above, you’ll need a robust managed backup solution to ensure client data is secure.
Network audit checklist
A network audit can vary, depending on your client’s industry, company size, and workforce characteristics. So consider the following checklist a “working document” — you may need to modify it:
1. General
- Document network topology and architecture diagrams.
- Inventory all network devices
- Review documentation for accuracy and completeness.
- Validate network device roles and responsibilities.
2. Security
- Verify firewall configurations and rules.
- Scan for active and unused open ports.
- Audit VPN configurations and user access.
- Make sure Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are operational.
- Validate strong encryption protocols.
- Review network access control policies.
- Evaluate password and authentication policies.
- Scan for missing security patches and update devices if necessary.
3. Compliance and Policies
- Ensure the network complies with relevant standards (like ISO 27001, GDPR, PCI DSS).
- Validate implementation and management of bring-your-own-device (BYOD) policies.
- Check logs for adherence to data retention policies.
- Ensure proper segmentation of sensitive data zones (like HIPAA environments).
4. Configuration management
- Verify that device configurations align with standards.
- Confirm backup configurations are in place and operational.
- Review configuration change management procedures.
5. Network performance
- Monitor and review bandwidth usage.
- Audit Quality of Service (QoS) settings (queueing, traffic prioritization, etc.)
- Analyze latency and packet loss metrics.
- Validate redundancy and failover mechanisms.
6. Physical security
- Inspect physical access controls for network devices (locks, etc.).
- Log environmental controls (cooling, humidity) in data centers.
- Ensure devices are properly labeled and stored securely.
7. Wireless network
- Audit access point locations and configurations.
- Validate the use of WPA3 or other strong encryption protocols.
- Check for rogue access points.
- Review SSID broadcasting and hidden network policies.
8. Logging and monitoring
- Verify that log collection is enabled on all devices.
- Audit log retention policies and storage practices.
- Verify integration with a Security Information and Event Management (SIEM) solution.
9. User and role management
- Audit user accounts and privileges.
- Remove inactive or outdated accounts.
- Review role-based access controls (RBAC).
- Review cascading access controls.
- Validate multi-factor authentication (MFA) implementation.
10. Incident response and recovery
- Verify that the client has an incident response plan.
- Audit the availability and integrity of network backups.
- Confirm testing of restoration processes.
11. Documentation and reporting
- Document audit findings and provide actionable recommendations.
- Communicate audit results with relevant stakeholders.
- Prioritize remediations and communicate next steps to clients and technicians.
Once you’ve finalized your checklist, set up every step in your workflow automation to ensure all boxes are checked!
Discover a better way to manage client networks
See how Syncro’s powerful automation, scripting engine, and full suite of RMM tools help MSPs manage complex IT environments with ease. Take a look at our 12-minute, on-demand demo!
Share
Related Resources
