Cyber security audit: what it covers and how to prepare

An enterprise customer's security team has asked for evidence of an independent cyber security audit, and the contract is on hold until it arrives. Or your insurer's renewal form wants to know when you last had one. Either way, nobody has said what the audit should test against, and that is the question that decides whether the report gets accepted.

A cyber security audit independently checks your security controls against a defined baseline and reports the gaps with evidence. Choose the baseline from who asked: Cyber Essentials for UK central government and NHS supply chains, ISO 27001 Annex A for enterprise buyers, and the NCSC Cyber Assessment Framework for essential services.

This guide is for founders, CTOs and heads of IT at UK B2B tech firms with 25 to 250 staff. It covers how an audit differs from an assessment, a penetration test and a certification, and which baseline to pick. It then walks through scope, who should do the auditing, how to prepare, and what to do with the findings.

What is a cyber security audit?

A cyber security audit is a structured, evidence-based check of whether your security controls exist, are designed well and operate as described, measured against a stated baseline. The auditor samples records, interviews control owners and inspects configurations, then reports findings. Without a named baseline, the result is an opinion, not an audit.

The baseline is what makes an audit useful to someone else. "We had an audit" tells a buyer very little. "We were audited against ISO 27001 Annex A in March, with three findings closed" tells them what was tested and when.

Audits are still uncommon. The UK government's Cyber Security Breaches Survey 2025 surveyed 2,180 businesses. It found that 15% had carried out a cyber security vulnerability audit in the previous 12 months. A firm that can show a recent audit report is already ahead of most UK businesses on this measure.

How is a cyber security audit different from an assessment, a penetration test or a certification?

A cyber security audit tests controls against a baseline and reports findings with evidence. An assessment is broader and more advisory. A penetration test attacks specific systems to find technical weaknesses. A certification is a formal pass issued by an accredited or licensed body. Buyers use the four words loosely, so confirm which one they mean.

The table sets the four side by side. The right column is the one that matters in a deal: what the person asking can actually rely on.

A penetration test can sit inside a cyber security audit as one source of evidence, but it cannot replace one. Testing method belongs to the tester. NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115) covers how to plan and run those tests. Our NIST SP 800-115 summary explains where it fits.

A penetration test tells you whether one door opens. An audit tells you whether anyone checks the doors.

Which baseline should your cyber security audit use?

Pick the baseline the person asking will accept. UK central government and NHS buyers look for Cyber Essentials, enterprise customers usually expect ISO 27001 Annex A, and operators of essential services are assessed against the NCSC Cyber Assessment Framework. For an insurer, ask which standard its proposal form follows before you commission anything.

Ask the requester one question before you scope: "Which standard would you like the audit to follow?" The answer saves weeks.

Cyber Essentials is, in the NCSC's words, "the minimum standard of cyber security recommended by the Government for organisations of all sizes". The NCSC Cyber Essentials overview lists five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent testing of your systems "to verify that those controls are working in practice". The government requirement now sits in Procurement Policy Note 014, published in February 2025 for procurements under the Procurement Act 2023. It replaced PPN 09/14 and PPN 09/23, and it asks buyers to apply the requirement where it is proportionate, not to every contract. Our Cyber Essentials page covers the scheme itself.

ISO 27001 Annex A is the reference set of controls behind ISO/IEC 27001:2022. Enterprise buyers ask for it because it covers governance and suppliers, not just technical hygiene.

The NCSC Cyber Assessment Framework (CAF) sets out four high-level objectives and 14 principles. The four objectives are managing security risk, protecting against cyber attacks, detecting cyber security events, and minimising the impact of cyber security incidents. The NCSC's introduction to the CAF explains that each contributing outcome is judged achieved or not achieved, with a partially achieved level for some outcomes. The current release is CAF version 4.0.

What does a cyber security audit cover?

A cyber security audit should cover seven areas: governance and policy, asset and access management, vulnerability and patching, backup and recovery, logging and monitoring, suppliers, and incident response. The chosen baseline decides how deep each area goes. Cyber Essentials stays technical, while ISO 27001 Annex A and the CAF reach into governance and suppliers.

The areas line up with the NCSC's 10 Steps to Cyber Security. Its components include risk management, asset management, identity and access management, vulnerability management, logging and monitoring, supply chain security and incident management. The table shows what an auditor typically asks for in each area.

Most findings come from the gap between a policy and its record. A leaver process that exists on paper but has no matching account removals is the classic example.

A policy without a record is a promise, not a control.

Should an internal or independent auditor carry out your cyber security audit?

Use an internal auditor to find and fix gaps cheaply, and an independent auditor when someone outside the business must rely on the result. Independence means the auditor did not design or run the controls being tested. Buyers, insurers and regulators give far more weight to an independent report than to a self-review.

Most UK businesses that audit already use outside help. The Cyber Security Breaches Survey 2025 looked at the 15% of businesses that carried out a vulnerability audit. Of those, 41% used an external audit only, 23% an internal audit only, and 32% both. Medium businesses were among the most likely to rely solely on external contractors (38%).

Independence matters even for internal audits. ISO 27001 Clause 9.2 expects internal audits to be run by competent, impartial auditors. Our Clause 9.2 internal audit guide shows how a firm of your size can achieve that without a permanent hire. Annex A 5.35 asks for information security to be reviewed independently on a planned cycle and after significant change. Our Annex A 5.35 page covers what that review involves.

We recommend a simple rule: if the report will leave the building, the auditor should come from outside the team that runs the controls. An engineer auditing their own firewall rules is a second pair of the same eyes.

How do you prepare for a cyber security audit?

Prepare for a cyber security audit in five steps. Agree the scope and baseline with whoever asked, name an owner for each area and collect evidence before the auditor requests it. Then fix the obvious gaps and book dates that leave time for remediation. Preparation turns the audit from a discovery exercise into a confirmation.

1. Agree scope and baseline in writing. Confirm with the buyer, insurer or board which standard, which systems, which locations and which period the audit should cover. Write it down and send it back to them.
2. Name an owner for each area. One person per area in the scope table above, with the authority to answer questions and the time to do it.
3. Collect evidence first. Build a shared folder by area and fill it with the records listed in the table. Evidence you can produce in minutes reads very differently from evidence that arrives a week late.
4. Close the obvious gaps. Missing MFA on admin accounts, an untested backup or an unsigned policy are cheaper to fix before the audit than to explain afterwards. If the gaps run deep, a structured gap analysis comes first.
5. Set a realistic timeline. As GRCMANA planning guidance, allow two to four weeks for evidence gathering and quick fixes before a focused audit. Allow longer if policies or asset records do not yet exist. The audit itself depends on scope and on how quickly owners respond.

Automate the evidence you will need every year. Schedule access reviews, patch reports and backup tests so that they save their own records. The second audit is then far lighter than the first.

What happens after a cyber security audit?

After a cyber security audit, rate each finding by its effect on the person relying on the report, assign an owner and a date, and fix the highest-rated findings first. The remediation plan is what turns the report into progress. For most B2B tech firms, that plan becomes the route to ISO 27001 certification or Cyber Essentials Plus.

The rating scale below is GRCMANA guidance, not a requirement of any standard. Use whatever scale your auditor uses, but keep the link to consequence.

Send the requester a short summary, not just the report: the scope, the baseline, the findings by rating and the dated plan. A buyer reads a dated plan as maturity; an unexplained finding reads as risk.

When the next step is certification, the audit report becomes the starting point. Our ISO 27001 certification process guide sets out the stages from there.

What should be on a cyber security audit checklist?

A cyber security audit checklist should confirm the scope and baseline are agreed, owners are named, evidence exists for each of the seven areas, known gaps are fixed or planned, and the auditor's independence is settled. Use the short list below in the weeks before the audit, then keep it for next year's audit.

• Scope and baseline agreed in writing with the requester
• One named owner for each area, with time set aside
• Current asset inventory, including cloud services and laptops
• Access review completed, with leavers matched to account removals
• MFA on admin and remote access accounts
• Patch and vulnerability scan records for the audit period
• A dated backup restore test with its result
• Log retention settings and an example of an alert being handled
• Supplier list with risk ratings and security clauses
• Incident response plan and notes from its last exercise
• Auditor independence confirmed for this scope
• A place to record findings, owners and due dates

What are the common mistakes in a cyber security audit?

The common mistakes are auditing against no named baseline, letting the people who run controls audit themselves, treating a penetration test as the whole audit, and leaving findings without owners or dates. Each one produces a report that the person who asked for it cannot rely on, which defeats the purpose.

• No baseline. A generic "health check" gives the buyer nothing to compare against. Name the standard before you book anyone.
• Self-review dressed as independence. The same team designing, running and auditing a control cannot give an outside reader confidence.
• A penetration test sent instead. It answers a narrower question. Send it as supporting evidence, not as the audit.
• Findings without a plan. A report with no owners and dates ages badly. By the next renewal it reads as a list of things that were never done.

An audit is only as good as the baseline it is measured against.

Frequently asked questions