Audit Checklist for It Infrastructure

Standard Operating Procedure: IT Infrastructure Audit Framework

Document ID: SOP-OPS-IT-8842
Classification: Restricted – Internal Operations & Compliance

1. Document Control & Revision History

2. Executive Summary & Scope

2.1 Clinical Statement of Purpose

This Standard Operating Procedure (SOP) defines the mandatory, repeatable methodology for conducting exhaustive operational, security, and structural audits of enterprise Information Technology (IT) infrastructure. The framework guarantees systematic identification of configuration drift, vulnerability vectors, architectural single points of failure (SPOFs), and non-compliance risks across on-premises, hybrid, and cloud-native environments.

2.2 Operational Boundaries and Regulatory Standards

The scope encompasses all physical datacenters, virtualized compute clusters, software-defined networking (SDN) layers, enterprise storage arrays, identity providers, and public cloud control planes. All auditing executions must strictly adhere to and maintain compliance with the following regulatory and governance baselines:

• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations.
• ISO/IEC 27001:2022: Information Security Management Systems requirements.
• SOC 2 Type II: Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy).
• PCI-DSS v4.0: Payment Card Industry Data Security Standard (where applicable to cardholder data environments).

3. Prerequisites & Tool Requirements

Execution of this SOP requires authorized administrative access, specialized auditing hardware/software, and adherence to physical safety protocols.

3.1 Software & Tooling Suite

• Configuration Management Databases (CMDB): Read-only access to ServiceNow or equivalent asset repository.
• Vulnerability Scanners: Tenable Nessus, Qualys VMDR, or Prisma Cloud Compute (configured with authenticated scanning profiles).
• Network Analysis & Discovery: Wireshark, Nmap, and SolarWinds Network Performance Monitor.
• Cloud Security Posture Management (CSPM): AWS Security Hub, Azure Defender, or GCP Security Command Center.
• Terminal/CLI Utilities: OpenSSH, PowerShell 7.x, Terraform CLI (for state drift analysis).

3.2 Credentials & Access Control

• Multi-Factor Authentication (MFA) hardware tokens or certificate-based SSH keys granting read-only administrative privileges (Auditor or Reader RBAC roles) across all target domains.
• Time-bound access windows pre-approved by the Change Advisory Board (CAB).

3.3 Safety Personal Protective Equipment (PPE) & Physical Access

• ESD (Electrostatic Discharge) wrist straps and heels straps for physical datacenter walkthroughs.
• Class III safety glasses and steel-toed footwear where required by physical plant safety guidelines.
• Biometric or keycard access credentials for server room entry.

4. Roles & Responsibilities (RACI Matrix Table)

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Discovery and Perimeter Verification

• 1.1 Convene kickoff meeting with NOC Lead and system owners to review scope, boundaries, and expected maintenance windows.
• 1.2 Export current logical topology maps and asset inventories from the CMDB.
• 1.3 Verify synchronization of NTP (Network Time Protocol) servers across all infrastructure logging domains to ensure audit trail integrity.
• 1.4 Validate that automated vulnerability scanners are authorized, whitelisted by the internal Intrusion Detection System (IDS), and pointed exclusively at in-scope IP blocks.

Phase 2: Physical and Environmental Controls Audit (Datacenter / Edge)

• 2.1 Inspect physical server rooms for strict adherence to dual-factor physical access logs (badge and biometric validation).
• 2.2 Verify HVAC ambient temperature (maintained between 64°F–80°F) and relative humidity (40%–60%) via Environmental Monitoring Systems (EMS).
• 2.3 Inspect rack-level Power Distribution Units (PDUs) to confirm redundant A/B power feed balancing and absence of daisy-chaining.
• 2.4 Perform physical inventory sample check: cross-reference 10% of physical asset tags in Rack A through Z against the master CMDB record.
• 2.5 Test HVAC and UPS failover capabilities via documented dry-run logs or scheduled maintenance reports.

Phase 3: Network Architecture and Boundary Defense Inspection

• 3.1 Audit Next-Gen Firewall (NGFW) and Web Application Firewall (WAF) rulebases for shadow rules, overly permissive inbound/outbound ACLs (ANY/ANY), and unassigned objects.
• 3.2 Verify network segmentation: confirm explicit micro-segmentation and VLAN/VXLAN isolation between Production, Development, and Corporate IT zones.
• 3.3 Inspect core and distribution switch configurations for STP (Spanning Tree Protocol) root guard implementation and BPDU guard enforcement.
• 3.4 Validate IPsec and SSL/TLS VPN gateway configurations: verify deprecation of legacy cryptographic protocols (TLS 1.0, TLS 1.1, SSLv3) and enforcement of strong ciphers.
• 3.5 Review core routing protocols (BGP/OSPF) for MD5 authentication or TCP MD5 signature usage on peering sessions.

Phase 4: Compute, Virtualization, and Storage Review

• 4.1 Audit Hypervisor (VMware ESXi, KVM, Hyper-V) management planes for restricted access, enforcing multi-factor authentication and auditing local account drift.
• 4.2 Verify VM guest OS snapshot lifecycles: identify and report unmanaged snapshots older than 7 calendar days causing performance degradation or storage exhaustion.
• 4.3 Inspect Storage Area Network (SAN) and Network-Attached Storage (NAS) fabric for firmware currency, multipath redundancy (mpio), and active zoning configurations.
• 4.4 Review Storage Encryption-at-Rest configurations and confirm hardware Key Management Interoperability Protocol (KMIP) servers are operational.

Phase 5: Identity, Access Management (IAM), and Directory Services

• 5.1 Audit Active Directory (AD) or cloud-native IDP (Entra ID, Okta) for dormant or orphaned administrative accounts inactive for >90 days.
• 5.2 Validate Principle of Least Privilege (PoLP): inspect role-based access control (RBAC) assignments for high-privilege groups (Domain Admins, Global Admins, Root AWS accounts).
• 5.3 Confirm multi-factor authentication (MFA) is globally enforced for all user tiers without exception paths.
• 5.4 Review enterprise password lifecycle policies: verify minimum length ($\ge 14$ characters), complexity requirements, and prohibition of predictable rotation sequences.

Phase 6: Cloud Infrastructure and Infrastructure-as-Code (IaC) Posture

• 6.1 Execute CSPM scans to identify publicly exposed S3 buckets, Azure Blobs, or unauthenticated Google Cloud Storage objects.
• 6.2 Audit Infrastructure-as-Code (Terraform, CloudFormation, Pulumi) repositories using static code analysis tools (e.g., Checkov, TFLint) for hardcoded secrets and unencrypted state files.
• 6.3 Review serverless execution roles and container orchestrator (Kubernetes/EKS/AKS) RBAC policies for excessive ClusterRoleBindings.
• 6.4 Validate cloud network topologies: inspect VPC peering connections, transit gateways, and security group ingress/egress rules.

Phase 7: Backup, Business Continuity, and Disaster Recovery (BCDR) Validation

• 7.1 Inspect backup job completion reports over the preceding 30-day window, ensuring a 99% or higher success threshold.
• 7.2 Verify immutability status of backup repositories to protect against cryptographic ransomware deletion or modification (WORM storage).
• 7.3 Review and cross-examine the organization's Recovery Point Objective (RPO) and Recovery Time Objective (RTO) metrics against Tier-1 mission-critical application SLAs.
• 7.4 Validate disaster recovery site synchronization logs and review the outcomes of the most recent semi-annual physical/cloud failover simulation test.

6. Quality Assurance & Verification Criteria

The audit execution is formally measured against strict institutional acceptance benchmarks. Findings are categorized by severity based on potential impact and exploitability.

6.1 Severity Classification Matrix

• Critical (P1): Active exploit vectors, unauthenticated remote code execution (RCE) risks, unencrypted PAN/PII stores, single points of failure on core routing without hot-standby.
• High (P2): Missing patches for critical CVEs ($\ge 9.0$ CVSS), dormant admin accounts, weak cipher suites on external endpoints, missing backups for tier-2 systems.
• Medium (P3): Configuration drift not directly exposing data, stale firewall objects, suboptimal NTP drift.
• Low (P4): Minor documentation discrepancies, cosmetic CMDB naming mismatches.

6.2 Acceptance Benchmarks

• Zero Critical Findings: Unresolved Critical (P1) vulnerabilities must block audit sign-off and trigger an immediate operational remediation ticket.
• Remediation SLA Compliance: High-severity findings must have a committed remediation plan signed off within 14 business days; Medium findings within 30 business days.
• Evidence Collection Completeness: All audit checkboxes must map directly to cryptographic logs, configuration exports, or photographs stored within the secure compliance repository.

7. Practical Troubleshooting Scenarios

Scenario A: Unresponsive Hypervisor Management Plane During Active Audit

• Symptom: During Phase 4 execution, connection attempts to vCenter or hypervisor CLI time out, raising concerns of a potential management plane deadlock or resource exhaustion.
• Immediate Corrective Action Protocol:
  1. Cease all non-essential API polling and automated vulnerability scans targeting the management network subnet to eliminate potential denial-of-service impacts.
  2. Access the physical out-of-band management interface (IPMI / iLO / iDRAC) via a direct console connection or secure jump host.
  3. Review hardware health logs via IPMI (ipmitool sensor list) to check for thermal throttling or power supply anomalies.
  4. If the hypervisor management service is hung, execute a controlled service restart (e.g., services.mshost restart or restart management agents via direct console user interface [DCUI]) without rebooting host hypervisors hosting production virtual machines.
  5. Document the incident timeline, notify the NOC Lead, and adjust future automated scanning concurrency limits.

Scenario B: Detection of Hardcoded Administrative Credentials in IaC Repositories

• Symptom: Phase 6 static code analysis reveals plain-text database passwords or AWS IAM secret keys stored within an active Terraform module in GitHub.
• Immediate Corrective Action Protocol:
  1. Immediately flag the repository commit and notify the CISO and Lead Cloud Systems Engineer via secure out-of-band communication.
  2. Revoke the exposed credentials/keys within the target Identity Provider (AWS IAM, Azure Active Directory) instantaneously to neutralize active exposure vectors.
  3. Purge the sensitive data from the Git history using specialized tools (e.g., git-filter-repo or BFG Repo-Cleaner) and force-push the sanitized repository state.
  4. Rotate all dependent application connection strings and perform log analysis to search for unauthorized access utilizing the compromised credentials during the exposure window.
  5. Implement pre-commit hooks (e.g., truffleHog or Gitleaks) into the developer workflow pipeline to prevent future plaintext secret commits.