IT security audits for businesses
I run IT security audits for businesses — identifying real gaps, assessing risk and setting priorities with a remediation plan. Scope covers infrastructure, applications, access and procedures. Audit results are presented as clear findings, risk assessment, priorities and recommended actions.
Project kickoff
- 1Kick-off and business context plus system map
- 2Technical review of configuration, logs and permissions
- 3Interviews with IT and process owners
- 4Risk assessment and prioritised recommendations
I handle design and delivery directly — with contact through analysis, delivery and further development.
Who it is for
- Companies whose infrastructure grew ad hoc without documentation
- Organisations before certification, due diligence or a client audit
- Teams after an incident — needing a remediation plan and priorities
- SMEs without a dedicated CISO that want to know where they stand
- KSC entities preparing for a mandatory or authority-ordered audit
Problems I solve
- Nobody in the company has a full picture of what is exposed to the internet
- Backups exist but restore has never been tested
- Employees have overly broad permissions, no offboarding procedures
- A client or regulator asks about GDPR/security — no documentation
Scope of work
Types of audit — what do you need?
- General IT audit — infrastructure, access, backups, policies and processes across the organisation.
- Web application / API audit — a separate technical scope: architecture, auth, business logic and common attack vectors (OWASP); it does not replace a pentest.
- IT/OT audit — when office systems connect to production, machinery or industrial environments.
- KSC-required audit — for key entities (3-year cycle) or when mandated by the authority; scope aligned with the act and ISMS plan.
How collaboration works
- Kick-off and business context plus system map
- Technical review of configuration, logs and permissions
- Interviews with IT and process owners
- Risk assessment and prioritised recommendations
- Report with remediation plan and timeline
What you get
- Audit report with security posture assessment
- Findings list with priorities and effort estimates
- Each finding in a consistent format: area/asset, description, risk/impact, priority, recommendation and suggested next step
- Quick wins and long-term recommendations
- Material for discussions with management, IT and external auditors
FAQ
How does an IT audit differ from a pentest?
An audit covers the whole picture: technology, processes and compliance. A pentest simulates an attack on selected systems. The audit maps risks; the pentest checks whether they can be exploited.
How long does an IT security audit take?
For SMEs typically 2–4 weeks, depending on the number of systems, locations and documentation availability.
Is an audit required by GDPR?
GDPR requires appropriate technical and organisational measures and the ability to demonstrate their effectiveness. It does not mandate a periodically named “IT security audit” — but independent assessment (audit, review, test) is often a practical way to verify and document due diligence.
Do I need ISO 27001 already in place?
No. An audit can be a first step before certification or a standalone assessment without formal ISO.
What if you find critical gaps?
Critical findings are discussed as a priority during the audit so you can reduce risk quickly, without waiting for the final report.
Do you help implement recommendations?
Yes — I can implement fixes, configure monitoring and backups, or run a pentest after remediation.
Practical materials
Related services and articles
Ready to discuss scope?
Write briefly about the goal, audience and materials you already have. I will reply with a proposed next step.