Form library · AV and IT
IT audit checklist
An on-site IT audit and health check form, written for IT support companies taking on a customer and for in-house teams reviewing their own setup. It works through the network, servers and cloud services, devices, backup and accounts, then lists each finding with a risk rating and a recommendation. Every question is listed below, and you can fill the live form in on this page.
Ready to use from the form library, and every question is yours to edit. Trial from £1, cancel any time.
Try it on your phone
Try it on this phone
Fill in the IT audit on your phone now
See how the IT audit looks on your phone
Scan the code with your phone camera. It opens the real form, no sign-up needed.
Open the live example and fill it in, just as your team would on site. No sign-up needed.
See it on this phoneEvery question is editable. Add this form to your account, then change the wording, add or remove questions and options, and make it fit your own jobs.
What should an IT audit checklist include?
An IT audit checklist should cover the internet connection and firewall, switches and Wi-Fi, servers and cloud services, PCs, laptops and mobiles, backup and recovery, and user accounts and security. For each area it should record what is in place, whether it is still supported and updated, and who looks after it. It should end with findings rated by risk, each with a recommendation and an owner.
Last updated . Facts checked by the SiteSurvey team on 5 October 2026 against NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 and NCSC on offline backups in an online world.
Try the IT audit form live
Answer a few questions and watch it adapt. Your answers are not saved, and any photos you add are deleted within the hour.
This is the real form as your team would use it: questions appear as you answer, scores work themselves out and you can add photos and signatures. No sign-up needed.
Want to see one filled in? See a completed IT audit report (PDF), made by SiteSurvey from a fictional site visit.
Fill it in on a phone or tablet
Your team completes the it audit and health check on site in the SiteSurvey app on iPhone, iPad and Android phones and tablets. The project name and address fill in for them, it works without signal, and it syncs when the device is back online with photos kept against the question they answer.
Customers and subcontractors do not need the app: send them a link and they can fill it in from any browser.
Every question in the IT audit template
On-site IT audit for a small or mid-sized organisation: network, servers and cloud, devices, backup, accounts and security, with rated findings. 8 sections and 76 questions. Follow-up questions and guidance appear only when an answer calls for them, so the person on site never sees the ones that do not apply.
Make it your own: every question is editable
This is a starting point, not a fixed form. Once it is in your SiteSurvey account you can reword any question, add or remove questions, sections and answer options, and add your own logo, so it fits the way your team works and the jobs you do.
Details you only enter once
Add this form to a project in SiteSurvey and it fills in what the project already knows, so nobody on site retypes it and every form on the job uses the same names. Anything filled in can still be changed.
- Project: the project name
- Customer: the project's customer
- Site: the site, when the form is opened for a space or a product
- Site address: the site address, from the space or the project
Details
Who the work is for and what it covers.
- ProjectShort answer
Filled in from the project in SiteSurvey.
Fills in from the project name - CustomerShort answerFills in from the project's customer
- Site*Short answerFills in from the site, when the form is opened for a space or a product
- Site addressShort answerFills in from the site address, from the space or the project
- Date of audit*Date
- AuditorShort answer
- What does the audit cover?Tick all that apply
- Network and internet
- Servers and storage
- PCs, laptops and mobiles
- Cloud services and email
- Backup and recovery
- Accounts and security
- Comms room and cabling
- Number of staff who use ITNumber
- Number of sitesNumber
- Who looks after IT now?Choose one
- In-house
- An outside IT company
- A mix
- Nobody in particular
- What does the customer say is not working?Notes
- How was this checked?Tick all that apply
- Seen on site
- Checked in admin consoles
- Told by staff
- Scan or tool report
Network and internet
How the site connects, and what protects it.
- Internet connectionChoose one
- Full fibre
- Fibre to the cabinet
- Leased line
- Mobile (4G or 5G)
- Satellite
- Other (describe)
- Download (Mbps)Number
- Upload (Mbps)Number
- Is there a second connection if the main one fails?Yes or No
- Firewall or router make and modelShort answer
- Does it still get security updates from the maker?Choose one
- Yes
- No
- Not known
- WarningUnsupported software. Cyber Essentials requires software to be licensed and supported, and removed from devices when it becomes unsupported. A firewall that no longer gets updates should be replaced.Shown when “Does it still get security updates from the maker?” is “No”
- SwitchesChoose one
- Managed
- Unmanaged
- Mixed
- Not known
- Is guest Wi-Fi kept separate from the main network?Choose one
- Yes
- No
- No guest Wi-Fi
- Is there an up to date network diagram?Yes or No
- How do staff connect from outside?Choose one
- VPN
- Cloud services only
- Remote desktop open to the internet
- No remote access
- WarningRemote desktop open to the internet is a common way in for attackers. Recommend a VPN or a gateway with multi-factor authentication.Shown when “How do staff connect from outside?” is “Remote desktop open to the internet”
- Photos of the cabinet and network equipmentPhotos
Servers and cloud
Where the data and email live.
- EmailChoose one
- Microsoft 365
- Google Workspace
- Exchange server on site
- From the web host
- Other (describe)
- Where are files kept?Choose one
- SharePoint or OneDrive
- Google Drive
- Server or NAS on site
- On individual PCs
- A mix
- Other (describe)
- Are there servers or storage devices on site?Yes or No
- Servers and storageRepeat for each server. Each one asks:Shown when “Are there servers or storage devices on site?” is Yes
- Name*Short answer
- What it doesShort answer
- Operating system and versionShort answer
- Does it still get security updates?Choose one
- Yes
- No
- Not known
- WarningUnsupported software. Cyber Essentials requires software to be licensed and supported, and removed from devices when it becomes unsupported.Shown when “Does it still get security updates?” is “No”
- Year boughtNumber
- Age (years)Worked out by the formShown when “Year bought” is answered
- Warranty or support contractChoose one
- In place
- Expired
- Not known
- Free disk space (%)Number
PCs, laptops and mobiles
The devices people work on.
- DesktopsNumber
- LaptopsNumber
- Company phones and tabletsNumber
- Devices in totalWorked out by the form
- How many run an operating system that no longer gets security updates?Number
- WarningUnsupported software. Cyber Essentials requires software to be licensed and supported, and removed from devices when it becomes unsupported.Shown only when the answers above make it relevant
- How are updates installed?Choose one
- Automatically, and checked
- Automatically, nobody checks
- By hand
- Not known
- GuidanceUpdates. Cyber Essentials requires updates that fix critical or high risk vulnerabilities (a CVSS v3 base score of 7 or above) to be installed within 14 days of release.
- Are laptops encrypted?Choose one
- Yes
- Partly
- No
- Not known
- Anti-malware on every device?Choose one
- Yes
- Partly
- No
- Not known
- Do staff use administrator accounts for day to day work?Yes or No
- CheckCyber Essentials requires separate accounts for administrative work, with no email or web browsing from them.Shown when “Do staff use administrator accounts for day to day work?” is Yes
- Is there an up to date list of devices?Yes or No
Backup and recovery
Whether the organisation could carry on after losing its data.
- Is anything backed up?Yes or No
- WarningNo backup. Put this first in the summary.Shown when “Is anything backed up?” is No
- What is backed up?Tick all that apply
- Servers
- Shared files
- Cloud services such as Microsoft 365
- Individual PCs
- Line of business systems
- Other (describe)
Shown when “Is anything backed up?” is Yes - How often?Choose one
- Daily or more
- Weekly
- Less often
- Not known
Shown when “Is anything backed up?” is Yes - Is a copy kept off site or in the cloud?Yes or NoShown when “Is anything backed up?” is Yes
- Is there a copy that ransomware on the network could not reach?Yes or NoShown when “Is anything backed up?” is Yes
- When was a restore last tested?DateShown when “Is anything backed up?” is Yes
- Days since the last restore testWorked out by the formShown when “When was a restore last tested?” is answered and “Date of audit” is answered
- Is there a written plan for what to do if systems are lost?Yes or No
- Are servers and network equipment on a UPS?Yes or No
Accounts and security
Who can get in, and how.
- Multi-factor authentication on email and cloud services*Choose one
- All users
- Administrators only
- Some users
- Nobody
- WarningMulti-factor authentication. Cyber Essentials requires multi-factor authentication for every account on a cloud service (such as Microsoft 365), and says it should always be used for administrative accounts and any account reachable from the internet.Shown only when the answers above make it relevant
- Are accounts closed when people leave?Choose one
- Yes, same day
- Yes, eventually
- No process
- Not known
- Are any logins shared between people?Yes or No
- How are passwords looked after?Choose one
- Password manager
- Each person remembers their own
- Written down or in a spreadsheet
- Not known
- Cyber EssentialsChoose one
- Certified
- Certified: Cyber Essentials Plus
- Lapsed
- Never certified
- Have staff had security awareness training in the last year?Yes or No
Findings and recommendations
One entry for each thing the customer should act on.
- FindingsRepeat for each finding. Each one asks:
- Area*Choose one
- Network and internet
- Servers and storage
- Devices
- Cloud and email
- Backup and recovery
- Accounts and security
- Comms room and cabling
- Licences and contracts
- Other (describe)
- Risk*Choose one
- High
- Medium
- Low
- What did you find?*Notes
- What do you recommend?Notes
- Who should act on it?Short answer
- By when?Date
- Photos or screenshotsPhotos
- FindingsWorked out by the form
- High risk findingsWorked out by the form
Summary and sign-off
The overall picture, in plain words for the customer.
- Overall*Choose one
- Good: minor improvements only
- Needs attention
- At risk: act now
- Summary for the customerNotes
- The three things to do firstNotes
- Anything not checked, and whyNotes
- Auditor nameShort answer
- Auditor signatureSignature
- Customer nameShort answer
- Customer signatureSignature
See it filled in
A completed IT audit report, made by SiteSurvey from a fictional site visit: every answer, the photos, the guidance that applied and the sign-off, ready to send as a PDF.
IT audit FAQs
Who is this IT audit checklist for?
It is written for IT support companies and managed service providers auditing a new or existing customer, and for in-house IT staff. It suits a small or mid-sized organisation with one or a few sites. It is a practical health check, not a financial IT controls audit.
How does it deal with unsupported software and hardware?
It asks whether the firewall and each server still get security updates, and how many devices run an operating system that no longer does. Cyber Essentials requires software to be licensed and supported, and removed from devices when it becomes unsupported, so each of these shows a note to raise with the customer.
What does it check on backups?
Whether anything is backed up, what the backup covers, how often it runs, whether a copy is kept off site or in the cloud, and whether there is a copy that ransomware on the network could not reach. The NCSC says an offline backup should be disconnected when not in use, and backups should be tested regularly. The form records when a restore was last tested, works out the days since, and asks whether there is a written recovery plan.
Does it cover multi-factor authentication?
Yes. It records whether multi-factor authentication is on email and cloud services for all users, administrators only, some users or nobody. Cyber Essentials says sign-in to cloud services must always use it, and that it should always be used for administrative accounts and accounts reachable from the internet, so the form flags any answer short of all users.
How are findings reported?
Each finding has an area, a High, Medium or Low risk, what was found, the recommendation, who should act and by when, with photos or screenshots. The form counts the findings and the high risk ones, and the summary page gives an overall result and the three things to do first, signed by the auditor and the customer.
Is this a Cyber Essentials assessment?
No. It uses some Cyber Essentials requirements as a yardstick, such as installing critical and high risk updates within 14 days of release, but it is a general IT audit. For a check built around the five Cyber Essentials controls, use the IT security audit checklist in the same library.
Related
Related templates
Templates that go with the IT audit form
Security audit built around the five Cyber Essentials controls, plus backups, physical security and incident readiness, with rated findings.
Walk round audit of IT equipment against the register: tag, make, model, serial, user, location, condition and support status for every device.
Routine IT maintenance visit: comms room, UPS, servers and storage, backups, updates, network and PC checks, with defects and sign-off.
Containment and cable routes, comms room and cabinet, power and cooling, existing and required outlets by area.
Use this IT audit form with your team
Add it from the form library in one click, change any question, and every completed form becomes a branded PDF report.
Start your trial →