---
title: "Cyber security audit: what it covers and how to prepare"
canonical: https://www.grcmana.io/vault/compliance/cyber-security-audit
published: 2026-10-21
updated: 2026-10-23
author: "Harry West"
framework: "Compliance"
control: "Guide Cyber security audit: what it covers and how to prepare"
journeyStage: intermediate
---

# Cyber security audit: what it covers and how to prepare

## Key takeaways

A cyber security audit independently checks your security controls against a defined baseline and reports the gaps with evidence. Choose the baseline from who asked: Cyber Essentials for UK central government and NHS supply chains, ISO 27001 Annex A for enterprise buyers, and the NCSC Cyber Assessment Framework for essential services. Prepare by agreeing scope, naming owners and collecting evidence first.

- **Cyber Essentials** — The NCSC calls Cyber Essentials the Government's recommended minimum standard for organisations of all sizes, built on five controls: firewalls, secure configuration, security update management, user access control and malware protection.
- **Government contracts** — Procurement Policy Note 014, published in February 2025, replaced PPN 09/14. It asks central government departments, their agencies and NHS bodies to require Cyber Essentials where a contract's risks justify it.
- **NCSC Cyber Assessment Framework** — The NCSC designed the CAF primarily for organisations operating essential services. It sets out 14 principles, and each contributing outcome is judged achieved or not achieved, with partially achieved for some.
- **How UK businesses audit** — The Cyber Security Breaches Survey 2025 found that 15% of UK businesses had carried out a cyber security vulnerability audit in the previous year, most of them using an external auditor.

An enterprise customer's security team has asked for evidence of an independent cyber security audit, and the contract is on hold until it arrives. Or your insurer's renewal form wants to know when you last had one. Either way, nobody has said what the audit should test against, and that is the question that decides whether the report gets accepted.

A cyber security audit independently checks your security controls against a defined baseline and reports the gaps with evidence. Choose the baseline from who asked: Cyber Essentials for UK central government and NHS supply chains, ISO 27001 Annex A for enterprise buyers, and the NCSC Cyber Assessment Framework for essential services.

This guide is for founders, CTOs and heads of IT at UK B2B tech firms with 25 to 250 staff. It covers how an audit differs from an assessment, a penetration test and a certification, and which baseline to pick. It then walks through scope, who should do the auditing, how to prepare, and what to do with the findings.

## What is a cyber security audit?

A cyber security audit is a structured, evidence-based check of whether your security controls exist, are designed well and operate as described, measured against a stated baseline. The auditor samples records, interviews control owners and inspects configurations, then reports findings. Without a named baseline, the result is an opinion, not an audit.

The baseline is what makes an audit useful to someone else. "We had an audit" tells a buyer very little. "We were audited against ISO 27001 Annex A in March, with three findings closed" tells them what was tested and when.

Audits are still uncommon. The UK government's [Cyber Security Breaches Survey 2025](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025) surveyed 2,180 businesses. It found that 15% had carried out a cyber security vulnerability audit in the previous 12 months. A firm that can show a recent audit report is already ahead of most UK businesses on this measure.

## How is a cyber security audit different from an assessment, a penetration test or a certification?

A cyber security audit tests controls against a baseline and reports findings with evidence. An assessment is broader and more advisory. A penetration test attacks specific systems to find technical weaknesses. A certification is a formal pass issued by an accredited or licensed body. Buyers use the four words loosely, so confirm which one they mean.

The table sets the four side by side. The right column is the one that matters in a deal: what the person asking can actually rely on.

|  | Cyber security audit | Security assessment | Penetration test | Certification |
| --- | --- | --- | --- | --- |
| Question it answers | Do our controls meet this baseline, with evidence? | Where are our biggest risks and gaps? | Can an attacker get in through these systems? | Has an approved body confirmed we meet the standard? |
| Measured against | A named baseline (Cyber Essentials, ISO 27001 Annex A, the NCSC CAF) | Often a framework, sometimes the assessor's judgement | The systems in scope and a test plan | The standard's requirements |
| Who performs it | An internal or independent auditor | Internal team or adviser | A specialist tester | A certification body (for ISO 27001, one accredited by a body such as UKAS) |
| Output | Findings report with evidence and ratings | Risk and gap report with recommendations | Technical findings with severity and fixes | A certificate with a scope and expiry |
| What a buyer can rely on | Controls tested against a known baseline at a point in time | Your own view of your gaps | Technical exposure of named systems | Third-party confirmation under a scheme |

A penetration test can sit inside a cyber security audit as one source of evidence, but it cannot replace one. Testing method belongs to the tester. NIST's [Technical Guide to Information Security Testing and Assessment (SP 800-115)](https://csrc.nist.gov/pubs/sp/800/115/final) covers how to plan and run those tests. Our [NIST SP 800-115 summary](https://www.grcmana.io/vault/nist-800-115) explains where it fits.

A penetration test tells you whether one door opens. An audit tells you whether anyone checks the doors.

## Which baseline should your cyber security audit use?

Pick the baseline the person asking will accept. UK central government and NHS buyers look for Cyber Essentials, enterprise customers usually expect ISO 27001 Annex A, and operators of essential services are assessed against the NCSC Cyber Assessment Framework. For an insurer, ask which standard its proposal form follows before you commission anything.

Ask the requester one question before you scope: "Which standard would you like the audit to follow?" The answer saves weeks.

| Who is asking | Baseline that usually fits | Why |
| --- | --- | --- |
| UK central government department, agency or NHS body | Cyber Essentials, or Cyber Essentials Plus | Procurement Policy Note 014 asks these bodies to require the scheme where a contract's risks justify it, such as handling government staff's personal information or supplying ICT that processes OFFICIAL data |
| Enterprise customer or its procurement team | ISO 27001 Annex A | An internationally recognised standard that covers governance and suppliers as well as technical controls, and an audit against it is a first step towards certification, which also tests the management system around the controls |
| Regulator or competent authority for an essential service | NCSC Cyber Assessment Framework | The NCSC designed the CAF primarily for organisations operating essential services, and it supports NIS Regulations compliance |
| Board or investor | ISO 27001 Annex A, or Cyber Essentials as a floor | The board wants a recognised yardstick it can track year on year |
| Insurer | Whatever its proposal form follows | Insurers set their own questions; match the audit to them |

**Cyber Essentials** is, in the NCSC's words, "the minimum standard of cyber security recommended by the Government for organisations of all sizes". The [NCSC Cyber Essentials overview](https://www.ncsc.gov.uk/cyberessentials/overview) lists five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent testing of your systems "to verify that those controls are working in practice". The government requirement now sits in [Procurement Policy Note 014](https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme), published in February 2025 for procurements under the Procurement Act 2023. It replaced PPN 09/14 and PPN 09/23, and it asks buyers to apply the requirement where it is proportionate, not to every contract. Our [Cyber Essentials page](https://www.grcmana.io/vault/cyber-essentials) covers the scheme itself.

**ISO 27001 Annex A** is the reference set of controls behind ISO/IEC 27001:2022. Enterprise buyers ask for it because it covers governance and suppliers, not just technical hygiene.

**The NCSC Cyber Assessment Framework (CAF)** sets out four high-level objectives and 14 principles. The four objectives are managing security risk, protecting against cyber attacks, detecting cyber security events, and minimising the impact of cyber security incidents. The [NCSC's introduction to the CAF](https://www.ncsc.gov.uk/collection/cyber-assessment-framework/introduction-to-caf) explains that each contributing outcome is judged achieved or not achieved, with a partially achieved level for some outcomes. The current release is [CAF version 4.0](https://www.ncsc.gov.uk/collection/cyber-assessment-framework).

## What does a cyber security audit cover?

A cyber security audit should cover seven areas: governance and policy, asset and access management, vulnerability and patching, backup and recovery, logging and monitoring, suppliers, and incident response. The chosen baseline decides how deep each area goes. Cyber Essentials stays technical, while ISO 27001 Annex A and the CAF reach into governance and suppliers.

The areas line up with the NCSC's [10 Steps to Cyber Security](https://www.ncsc.gov.uk/collection/10-steps). Its components include risk management, asset management, identity and access management, vulnerability management, logging and monitoring, supply chain security and incident management. The table shows what an auditor typically asks for in each area.

| Area | What the auditor checks | Evidence that answers it |
| --- | --- | --- |
| Governance and policy | Named ownership, approved policies, a risk assessment that is reviewed | Signed policies, risk register with review dates, board or management minutes |
| Asset and access management | A current asset list; joiners, movers and leavers handled; admin rights limited; MFA in place | Asset inventory, access review records, leaver tickets matched to account removals |
| Vulnerability and patching | Updates applied within a set time; scans run and acted on | Patch reports, scan results with tickets showing the fixes |
| Backup and recovery | Backups taken, protected and restored in a test | Backup logs, a dated restore test with its outcome |
| Logging and monitoring | Security logs collected, kept and reviewed; alerts reach a person | Log retention settings, alert examples, review records |
| Suppliers | Critical suppliers known, assessed and bound by security terms | Supplier list with risk ratings, contract clauses, review records |
| Incident response | A plan exists, people know their roles, and it has been exercised | Incident plan, exercise notes, incident log |

Most findings come from the gap between a policy and its record. A leaver process that exists on paper but has no matching account removals is the classic example.

A policy without a record is a promise, not a control.

## Should an internal or independent auditor carry out your cyber security audit?

Use an internal auditor to find and fix gaps cheaply, and an independent auditor when someone outside the business must rely on the result. Independence means the auditor did not design or run the controls being tested. Buyers, insurers and regulators give far more weight to an independent report than to a self-review.

Most UK businesses that audit already use outside help. The [Cyber Security Breaches Survey 2025](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025) looked at the 15% of businesses that carried out a vulnerability audit. Of those, 41% used an external audit only, 23% an internal audit only, and 32% both. Medium businesses were among the most likely to rely solely on external contractors (38%).

Independence matters even for internal audits. ISO 27001 Clause 9.2 expects internal audits to be run by competent, impartial auditors. Our [Clause 9.2 internal audit guide](https://www.grcmana.io/vault/iso-27001/clause-9-2-internal-audit) shows how a firm of your size can achieve that without a permanent hire. Annex A 5.35 asks for information security to be reviewed independently on a planned cycle and after significant change. Our [Annex A 5.35 page](https://www.grcmana.io/vault/iso-27001/annex-a-5-35-independent-review-of-information-security) covers what that review involves.

We recommend a simple rule: if the report will leave the building, the auditor should come from outside the team that runs the controls. An engineer auditing their own firewall rules is a second pair of the same eyes.

## How do you prepare for a cyber security audit?

Prepare for a cyber security audit in five steps. Agree the scope and baseline with whoever asked, name an owner for each area and collect evidence before the auditor requests it. Then fix the obvious gaps and book dates that leave time for remediation. Preparation turns the audit from a discovery exercise into a confirmation.

1. **Agree scope and baseline in writing.** Confirm with the buyer, insurer or board which standard, which systems, which locations and which period the audit should cover. Write it down and send it back to them.
2. **Name an owner for each area.** One person per area in the scope table above, with the authority to answer questions and the time to do it.
3. **Collect evidence first.** Build a shared folder by area and fill it with the records listed in the table. Evidence you can produce in minutes reads very differently from evidence that arrives a week late.
4. **Close the obvious gaps.** Missing MFA on admin accounts, an untested backup or an unsigned policy are cheaper to fix before the audit than to explain afterwards. If the gaps run deep, a structured gap analysis comes first.
5. **Set a realistic timeline.** As GRCMANA planning guidance, allow two to four weeks for evidence gathering and quick fixes before a focused audit. Allow longer if policies or asset records do not yet exist. The audit itself depends on scope and on how quickly owners respond.

Automate the evidence you will need every year. Schedule access reviews, patch reports and backup tests so that they save their own records. The second audit is then far lighter than the first.

## What happens after a cyber security audit?

After a cyber security audit, rate each finding by its effect on the person relying on the report, assign an owner and a date, and fix the highest-rated findings first. The remediation plan is what turns the report into progress. For most B2B tech firms, that plan becomes the route to ISO 27001 certification or Cyber Essentials Plus.

The rating scale below is GRCMANA guidance, not a requirement of any standard. Use whatever scale your auditor uses, but keep the link to consequence.

| Rating | What it means | Typical response |
| --- | --- | --- |
| Critical | A control is missing and the gap is exploitable now, or the baseline cannot be met | Fix immediately; tell the requester if it affects them |
| High | A control exists but fails in practice, such as leavers keeping access | Fix within weeks, with evidence of the fix |
| Medium | A control works but evidence is weak or inconsistent | Fix the record-keeping before the next audit |
| Low | An improvement that would strengthen a working control | Add to the roadmap |

Send the requester a short summary, not just the report: the scope, the baseline, the findings by rating and the dated plan. A buyer reads a dated plan as maturity; an unexplained finding reads as risk.

When the next step is certification, the audit report becomes the starting point. Our [ISO 27001 certification process guide](https://www.grcmana.io/vault/iso-27001/certification-process) sets out the stages from there.

## What should be on a cyber security audit checklist?

A cyber security audit checklist should confirm the scope and baseline are agreed, owners are named, evidence exists for each of the seven areas, known gaps are fixed or planned, and the auditor's independence is settled. Use the short list below in the weeks before the audit, then keep it for next year's audit.

- Scope and baseline agreed in writing with the requester
- One named owner for each area, with time set aside
- Current asset inventory, including cloud services and laptops
- Access review completed, with leavers matched to account removals
- MFA on admin and remote access accounts
- Patch and vulnerability scan records for the audit period
- A dated backup restore test with its result
- Log retention settings and an example of an alert being handled
- Supplier list with risk ratings and security clauses
- Incident response plan and notes from its last exercise
- Auditor independence confirmed for this scope
- A place to record findings, owners and due dates

## What are the common mistakes in a cyber security audit?

The common mistakes are auditing against no named baseline, letting the people who run controls audit themselves, treating a penetration test as the whole audit, and leaving findings without owners or dates. Each one produces a report that the person who asked for it cannot rely on, which defeats the purpose.

- **No baseline.** A generic "health check" gives the buyer nothing to compare against. Name the standard before you book anyone.
- **Self-review dressed as independence.** The same team designing, running and auditing a control cannot give an outside reader confidence.
- **A penetration test sent instead.** It answers a narrower question. Send it as supporting evidence, not as the audit.
- **Findings without a plan.** A report with no owners and dates ages badly. By the next renewal it reads as a list of things that were never done.

An audit is only as good as the baseline it is measured against.

## Frequently asked questions

### How often should we have a cyber security audit?

Our guidance at GRCMANA is at least once a year. Audit again after a significant change, such as a new platform, an acquisition or a major supplier switch. Annex A 5.35 of ISO 27001 expects independent review on a planned cycle and after significant change, but leaves the interval to you. An annual cycle also keeps your evidence current for the next buyer questionnaire.

### Is a cyber security audit the same as an IT audit?

Not quite. An IT audit can cover IT general controls, change management and service delivery for financial or operational purposes. A cyber security audit focuses on protecting systems and data against attack and recovering when something goes wrong. The two overlap on access, change and backup, and one set of evidence can serve both.

### Can we audit ourselves?

Yes, for internal improvement. A self-audit against Cyber Essentials or ISO 27001 Annex A is a cheap way to find gaps. When a buyer, insurer or regulator will rely on the result, use an independent auditor who did not design or run the controls being tested.

### Does a cyber security audit lead to a certificate?

An audit on its own produces a findings report, not a certificate. Certification comes from a separate scheme. For Cyber Essentials, that means a certification body licensed by IASME. For ISO 27001, it means a certification body accredited by a national accreditation body such as UKAS. An audit is the usual preparation for either.