Back to Resources

Technology Audit Checklist

Comprehensive checklist for auditing your technology infrastructure, security, vendors, and operational procedures.

Your Customised Checklist

Total Items

69

Critical Items

43

Categories

6

Select Categories to Include

Infrastructure & Assets

10 items · 4 critical

Complete hardware inventory with purchase dates and warranty status

CRITICAL

Software license inventory with renewal dates and user counts

CRITICAL

Network diagram showing all devices, connections, and external links

CRITICAL

Cloud services inventory (SaaS, IaaS, PaaS) with subscription details

End-of-life timeline for all major systems and hardware

CRITICAL

Asset management system in place and current

Identification of redundant or unused systems consuming costs

Documentation of all internet connections and ISPs

Mobile device inventory and management system

Peripheral and printer inventory with support contracts

Security & Access Control

14 items · 11 critical

Multi-factor authentication enabled on all administrative accounts

CRITICAL

Password policy enforcing complexity and rotation requirements

CRITICAL

User access review completed within last 90 days

CRITICAL

Privileged access management and monitoring in place

CRITICAL

Firewall configurations reviewed and documented

CRITICAL

Antivirus/EDR deployed on all endpoints with current definitions

CRITICAL

Email security (SPF, DKIM, DMARC) properly configured

CRITICAL

VPN or secure remote access solution with audit logging

CRITICAL

Security patch management process with SLAs defined

CRITICAL

Penetration testing or vulnerability scanning within last 12 months

Security awareness training completed by all users annually

Data encryption at rest and in transit for sensitive information

CRITICAL

SIEM or security monitoring solution with 24/7 coverage

Incident response plan documented and tested

CRITICAL

Vendor Management

12 items · 6 critical

Complete list of all technology vendors with contact details

CRITICAL

All contracts centrally stored with expiration tracking

CRITICAL

Formal SLAs in place with response/resolution time commitments

CRITICAL

Monthly performance reports received from MSP/vendors

Quarterly business reviews scheduled with key vendors

Vendor insurance coverage verification (E&O, Cyber, General Liability)

CRITICAL

Vendor security certifications current (ISO 27001, SOC 2)

CRITICAL

Right to audit clauses in all vendor contracts

Fair exit terms without unreasonable transition barriers

CRITICAL

Pricing benchmarking against market rates within last 12 months

Vendor succession plan for critical service providers

Annual vendor risk assessments completed

Compliance & Governance

10 items · 6 critical

Data privacy policy compliant with Australian Privacy Act

CRITICAL

GDPR compliance if processing EU citizen data

CRITICAL

Notifiable Data Breaches (NDB) scheme response procedures

CRITICAL

Payment Card Industry (PCI DSS) compliance if processing card payments

CRITICAL

Industry-specific compliance requirements identified and addressed

CRITICAL

Data retention and destruction policies documented

Data processing agreements with all vendors handling company data

CRITICAL

Regular compliance audits or assessments

Board-level technology governance reporting

Technology risk register maintained and reviewed quarterly

Operations & Documentation

11 items · 5 critical

Standard operating procedures (SOPs) for critical systems

Change management process with approval workflow

CRITICAL

Incident management process with escalation procedures

CRITICAL

Problem management to address recurring issues

Asset management lifecycle procedures

Onboarding/offboarding checklists for employees

CRITICAL

System monitoring and alerting in place

CRITICAL

Capacity planning and forecasting process

Technology roadmap aligned with business strategy

IT budget planning and tracking process

Vendor escalation contacts documented

CRITICAL

Backup & Disaster Recovery

12 items · 11 critical

Backup solution covering all critical systems and data

CRITICAL

Backup testing performed monthly with documented results

CRITICAL

Offsite/cloud backup copy maintained

CRITICAL

Recovery Time Objective (RTO) defined for each system

CRITICAL

Recovery Point Objective (RPO) defined for each system

CRITICAL

Disaster recovery plan documented and current

CRITICAL

DR plan tested annually with results documented

CRITICAL

Alternative workspace identified for disaster scenarios

Communication plan for major incidents

CRITICAL

Restoration procedures documented and accessible

CRITICAL

Backup retention policy aligned with compliance requirements

CRITICAL

Immutable backups to prevent ransomware encryption

CRITICAL

How to Use This Checklist

1.

Download the checklist and distribute to relevant stakeholders (IT, Finance, Legal, Operations)

2.

Schedule audit sessions with 2-4 hour blocks to thoroughly review each category

3.

Prioritise CRITICAL items for immediate remediation - these represent significant risks

4.

Create action plans with owners, timelines, and budgets for each gap identified

5.

Schedule quarterly reviews to track remediation progress and maintain momentum

6.

Conduct annual full audits or when major changes occur (new systems, vendor changes, etc.)

Need help conducting your technology audit?

We provide independent technology audits and help you prioritise and remediate gaps identified.

Request an Audit