System Audit Methodology — Secure In Security 2026

Secure In Security — System Audit Methodology Contact / About / Policy

Organizational

System Audit
Methodology

Technical Practitioner’s Guide

By N. Craig

System Audit Methodology Framework

The System Audit Lifecycle

The system audit lifecycle is the structured, repeatable sequence of phases that every technical system audit follows from authorization through reporting. Adherence to a defined methodology ensures consistency, defensibility, and completeness across all audit engagements, regardless of the technology being assessed.

#	Name	Key Activities	Primary Output
1	Authorization & Scoping	Define audit mandate; identify in-scope systems; obtain written authorization; establish rules of engagement; define criteria	Signed engagement letter; scope document; audit criteria selection
2	Pre-Audit Reconnaissance	Review prior audit reports; gather system documentation; identify system owners; download applicable baselines; pre-configure tools	System inventory; baseline mapping; tool configuration; evidence request list
3	Technical Data Collection	Execute scanning tools; run configuration checks; extract system reports; conduct walkthroughs; collect evidence against baseline	Raw scan output; configuration reports; evidence files; system logs
4	Analysis & Testing	Compare findings to criteria; validate tool output manually; calculate compliance rates; identify root causes; test specific controls	Validated findings list; exception analysis; compliance percentage by domain
5	Finding Development	Document each finding with criterion, condition, cause, effect, and recommendation; assign risk ratings; prepare evidence references	Draft findings with supporting evidence; preliminary risk ratings
6	Auditee Review & Response	Issue draft report; conduct exit conference; collect management responses; process factual corrections	Management responses; agreed remediation plans; final finding disposition
7	Final Report & Follow-Up	Issue final report; distribute per engagement letter; schedule follow-up reviews; update risk register	Final audit report; remediation tracking; follow-up schedule

Audit Criteria Hierarchy

System audit criteria define the standard against which systems are measured. Criteria must be established before fieldwork begins — criteria selected after findings are discovered is confirmation bias, not auditing.

Criteria Level	Examples	Authority
Regulatory / Legal	HIPAA §164.312 Technical Safeguards; PCI DSS Requirement 8; CMMC NIST 800-171 controls; GDPR Article 32	External — non-negotiable; failure creates legal exposure; no exception without regulatory waiver
Industry Standard	CIS Controls v8; NIST CSF 2.0; ISO 27002:2022; DISA STIGs; NSA Cybersecurity Advisories	Semi-external — not legally binding but widely accepted as reasonable security practice; deviation requires documented justification
Organizational Policy	Information Security Policy; Access Management Policy; Patch Management Standard; Password Policy	Internal — organization’s own documented requirements; deviation is a policy violation; audit evaluates whether systems comply with stated commitments
Technical Baseline	CIS Benchmark for Windows Server 2022; STIG for RHEL 9; AWS Foundations Benchmark; organizational hardening standard	Internal/External — operationalizes higher-level policies into specific measurable settings; most directly testable criteria

Audit Methodology Models

Methodology	Approach	Best Applied To
Compliance-Based	Test each system or control against a fixed checklist of requirements; pass/fail result for each item; overall compliance percentage calculated	Regulatory audits (PCI DSS, HIPAA, SOX); certification assessments (ISO 27001, FedRAMP); formal attestation engagements
Risk-Based	Focus testing depth on highest-risk assets and controls; proportional effort based on threat exposure, sensitivity of data, and potential impact	Annual internal audit programs; large complex environments where 100% coverage is impossible; organizations with mature risk registers
Controls-Based	Evaluate the design and operating effectiveness of specific security controls regardless of specific regulatory framework; principle-driven rather than checklist-driven	Security program maturity assessment; NIST CSF alignment reviews; general security posture audits where no single compliance framework applies
Threat-Based	Align audit coverage to the most likely and impactful threats facing the organization; use MITRE ATT&CK and threat intelligence to guide which controls to test most rigorously	Security-focused audits; red team validation; post-incident audits evaluating whether controls would have detected the incident methodology

Technical Auditor Competencies

Competency Domain	Required Knowledge & Skills
Operating System Internals	User and group management; file system permissions; service and process management; logging configuration; security policy settings — required for Windows and Linux platform audits
Network Architecture	TCP/IP fundamentals; routing and switching concepts; firewall rule evaluation; VLANs and network segmentation; DNS and PKI — required for network device and infrastructure audits
Directory Services	Active Directory structure; GPO inheritance; Kerberos authentication; LDAP query syntax; trust relationships; privilege escalation paths — required for identity and AD audits
Database Systems	SQL query writing; user privilege management; stored procedures; audit logging configuration; encryption implementation — required for database audits
Cloud Platforms	IAM policy syntax (JSON/YAML); service configuration interfaces; logging architecture; shared responsibility model — required for cloud environment audits
Audit Tools	Vulnerability scanner operation; SIEM query languages (SPL, KQL, EQL); configuration assessment tools (CIS-CAT, OpenSCAP, Lynis); data analytics (ACL, IDEA, Excel)
Security Frameworks	CIS Controls v8; NIST SP 800-53; ISO 27002; DISA STIG reading and interpretation; mapping findings to framework controls

Pre-Audit Preparation

The quality of a system audit is disproportionately determined by the quality of preparation. Auditors who arrive at fieldwork with a complete understanding of the environment, pre-loaded tools, and a structured testing plan execute faster, find more significant issues, and produce more defensible findings than those who improvise during fieldwork.

System Documentation Review

Before conducting any technical testing, review all available system documentation to understand the environment, identify control claims, and develop targeted test procedures:

System Security Plan (SSP) or equivalent — documents the system’s security posture, control implementation statements, and system boundary; identifies what management claims is in place
Network architecture diagrams — understand system topology, trust relationships, segmentation boundaries, and data flows before testing
Data flow diagrams — identify where sensitive data (PII, PHI, financial data, IP) is processed, stored, and transmitted; focus audit testing on those paths
Previous audit reports and findings — identify persistent findings (repeat issues indicate systemic problems), closed findings to verify, and areas of prior examiner concern
Change management records — review significant changes in the audit period; areas with high change frequency or emergency changes warrant closer scrutiny
Incident history — review incidents that occurred during the audit period; each incident is a real-world control failure that must be examined in the audit
Vendor and third-party agreements — identify cloud providers, SaaS services, and managed services; determine what evidence is available (SOC 2 reports, certifications)

Audit Target Inventory

Inventory Source	What It Provides	Validation Method
CMDB / Asset Management System	Formal organizational record of all managed IT assets; system owners, classifications, and relationships	Cross-reference with network scan results — assets in CMDB but not on network (decommissioned?); assets on network but not in CMDB (shadow IT?)
Network Discovery Scan (Nmap / Nessus)	Active discovery of all live hosts in target IP ranges; open ports and services; OS fingerprinting	Authorized scan — ensure IP ranges match approved scope; compare to CMDB; every unexpected live host is a finding
Active Directory Computer Objects	All domain-joined systems; last logon timestamps; OS version; OU membership; GPO assignments	Identify stale computer accounts (no logon in 90+ days); identify non-domain-joined systems in the environment
Cloud Provider Inventory (AWS/Azure/GCP)	All cloud resources; VMs, containers, functions, databases, storage buckets; tags; regions	AWS: use AWS Config or Resource Explorer; Azure: Resource Graph; GCP: Asset Inventory — ensure all resources are tagged with owner and environment
Vulnerability Scanner Asset List	All systems scanned in most recent vulnerability scan; scan coverage percentage	Compare to CMDB: coverage < 100% means some systems are not being scanned — each unscanned system is a vulnerability management gap finding

Tool Preparation and Configuration

Tool Category	Pre-Audit Configuration	Authorization Required
Network Scanner (Nmap)	Load target IP ranges; set scan timing (T3 or T4 for standard audit; T2 for sensitive production environments); configure output format (XML for parsing); disable intrusive NSE scripts for initial discovery	Written authorization from network/system owner; confirm scan timing and intensity are acceptable; document source IP used for scanning
Vulnerability Scanner (Nessus/Qualys)	Configure authenticated scan credentials for each target platform; load applicable compliance policy templates (CIS Benchmarks, DISA STIGs, PCI DSS); set scan window within authorized hours	Service account credentials with minimum required permissions; written authorization; confirm scan schedule is within approved maintenance window
Configuration Assessment (CIS-CAT / OpenSCAP)	Download applicable CIS Benchmark or SCAP content for target OS version; configure tool with correct profile (Level 1 or Level 2); set output directory for reports	Deployed on target systems or run with appropriate OS-level access; confirm benchmark version matches organization’s adopted standard
AD Audit Tool (BloodHound / PingCastle)	Configure LDAP credentials with read access to AD; set collection method (All for comprehensive audit; DCOnly for lighter collection); configure output directory	Read-only domain user account with AD query permissions; confirm SharpHound/PingCastle collection is authorized; document account used
Log Analysis / SIEM	Configure saved queries for access events, change events, and security alerts; set time range to audit period; confirm log retention covers the entire audit period	SIEM access credentials; confirm log completeness before relying on absence of events as evidence of control effectiveness

Authorization First

Every technical tool run against production systems requires explicit written authorization, regardless of the auditor’s employment relationship with the organization. An internal auditor running Nmap against production servers without documented authorization is conducting unauthorized scanning. Obtain written authorization, document the source IP used, the time scanning occurred, and the specific tools employed. This protects both the auditor and the organization.

Auditing Windows Systems

Windows systems — servers, workstations, and domain controllers — represent the most common enterprise audit target. This section provides specific procedures, commands, and evidence collection techniques for auditing Windows operating system security controls.

Windows Audit Checklist — Key Control Areas

Control Area	Audit Objective
Account and Password Policy	Verify password complexity, minimum length (14+ chars), history (24+), lockout threshold (5–10 attempts), and lockout duration meet organizational and regulatory minimums
Local Administrator Accounts	Identify all local administrator accounts; verify default Administrator account is renamed or disabled; confirm no unauthorized accounts have local admin rights; test LAPS deployment
Audit Policy Configuration	Verify comprehensive audit logging is enabled: account logon, account management, object access, policy change, privilege use, process tracking, system events — per CIS Benchmark Level 1 recommendations
Windows Firewall	Confirm Windows Firewall is enabled on all profiles (Domain, Private, Public); verify inbound rules are appropriately restrictive; confirm outbound rules do not allow overly broad connections
Service Configuration	Identify all running services; flag services running as SYSTEM or Domain Admin that could be replaced; verify unnecessary services are disabled; test for unquoted service path vulnerabilities
PowerShell Security Controls	Verify PowerShell ExecutionPolicy is set to AllSigned or RemoteSigned; confirm PowerShell logging (Module Logging, Script Block Logging, Transcription) is enabled; test constrained language mode for standard users
Windows Update / Patch Status	Confirm Windows Update is configured and enabled; verify last successful update date; test whether current OS version and patch level meet organizational SLA (critical patches within 15 days)
Remote Access Security	Verify RDP is disabled where not needed; confirm RDP uses NLA (Network Level Authentication); verify RDP is not exposed directly to internet; test WinRM configuration and authentication

Windows Evidence Collection Commands

Account and Password Policy

Retrieve local password and account lockout policy:

net accounts

Export detailed security policy (requires local admin):

secedit /export /cfg C:\AuditEvidence\security_policy.cfg /log C:\AuditEvidence\secedit.log

List all local user accounts with status:

Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordRequired, PasswordExpires |
  Export-Csv C:\AuditEvidence\local_users.csv -NoTypeInformation

Audit Policy Configuration

Display current advanced audit policy settings:

auditpol /get /category:* > C:\AuditEvidence\audit_policy.txt

Check audit policy via registry (more granular):

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' |
  Select-Object AuditBaseObjects, CrashOnAuditFail, FullPrivilegeAuditing

Services and Running Processes

Export all services with start type and logon account:

Get-Service | Select-Object Name, DisplayName, Status, StartType |
  Export-Csv C:\AuditEvidence\services.csv -NoTypeInformation

Find services running as SYSTEM or privileged accounts:

Get-WmiObject -Class Win32_Service |
  Where-Object {$_.StartName -like '*Administrator*' -or $_.StartName -eq 'LocalSystem'} |
  Select-Object Name, StartName, State |
  Export-Csv C:\AuditEvidence\privileged_services.csv

Check for unquoted service paths (privilege escalation risk):

wmic service get name,displayname,pathname,startmode |
  findstr /i /v "C:\Windows\\" | findstr /i /v '"'

Patch and Update Status

Get installed Windows updates (last 30):

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 30 |
  Export-Csv C:\AuditEvidence\hotfixes.csv -NoTypeInformation

Check Windows Update configuration:

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' |
  Select-Object AUOptions, NoAutoRebootWithLoggedOnUsers, ScheduledInstallDay, ScheduledInstallTime

Windows Firewall Status

Get Windows Firewall profile status:

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | Format-Table

Export all enabled inbound firewall rules:

Get-NetFirewallRule -Direction Inbound -Enabled True |
  Select-Object DisplayName, Profile, Action, Protocol |
  Export-Csv C:\AuditEvidence\fw_inbound_rules.csv -NoTypeInformation

PowerShell Security Settings

Check PowerShell execution policy (all scopes):

Get-ExecutionPolicy -List

Check Script Block Logging and Transcription registry settings:

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -ErrorAction SilentlyContinue

Windows CIS Benchmark Assessment

§	CIS Control	Recommended Setting	Audit Test
1.1.1	Enforce password history	24 or more passwords remembered	`secedit /export` then review PasswordHistorySize value
1.1.2	Maximum password age	365 days or fewer	secedit export; verify MaximumPasswordAge <= 365
1.1.4	Minimum password length	14 characters or more	secedit export; verify MinimumPasswordLength >= 14
1.2.1	Account lockout duration	15 minutes or more	`net accounts`; verify LockoutDuration >= 15
1.2.2	Account lockout threshold	5 or fewer invalid attempts	`net accounts`; verify LockoutThreshold <= 5 and > 0
2.2.6	Allow log on locally	Administrators only (servers)	secedit export; review SeInteractiveLogonRight
2.3.1.2	Accounts: Rename admin	Administrator renamed	`Get-LocalUser -Name 'Administrator'` — should not exist
9.1.1	Windows Firewall: Domain On	Yes — enabled	`Get-NetFirewallProfile -Name Domain`; Enabled = True
17.1.1	Audit Credential Validation	Success and Failure	`auditpol /get /subcategory:'Credential Validation'`
18.9.4	PowerShell Script Block Logging	Enabled	Registry: HKLM\…\ScriptBlockLogging; EnableScriptBlockLogging = 1

CIS-CAT Pro

CIS-CAT Pro Assessor automates assessment of Windows systems against CIS Benchmarks. It produces an HTML report scoring each system’s compliance percentage and listing each failed control with remediation guidance. For audit engagements, run CIS-CAT with Level 1 profile as the baseline and document deviations. The report constitutes audit evidence when the auditor directly executes or observes execution of the tool.

Auditing Linux and Unix Systems

Linux and Unix systems serve as web servers, application servers, database hosts, build systems, and cloud workloads. Key differences from Windows auditing: broader reliance on file system permissions, PAM (Pluggable Authentication Modules) for authentication controls, and syslog/journald for centralized logging.

Linux Audit Checklist — Key Control Areas

Control Area	Audit Objective & Key Tests
User Account Management	Verify no accounts with UID 0 other than root; identify accounts without passwords; confirm inactive accounts are locked; test that system accounts have non-login shells (`/sbin/nologin` or `/bin/false`)
PAM / Password Policy	Verify pam_pwquality or pam_cracklib enforces minimum length (14+), complexity, and history (24+); confirm pam_faillock enforces account lockout after failed attempts; test password expiry via /etc/shadow
SSH Configuration	Verify PasswordAuthentication is set to ‘no’ where key-based auth is enforced; confirm PermitRootLogin is ‘no’ or ‘prohibit-password’; verify Protocol 2 only; test MaxAuthTries <=4; confirm AllowUsers/AllowGroups restricts SSH access
File System Permissions	Test for world-writable files and directories outside of /tmp; identify SUID/SGID files (privilege escalation risk); verify /etc/passwd and /etc/shadow permissions; check home directory permissions
Cron and Scheduled Tasks	Review all cron jobs (crontab -l for each user; /etc/cron.*; /var/spool/cron); verify jobs do not run scripts writable by non-root users; test cron directory permissions
Firewall (iptables/nftables/firewalld)	Verify firewall is active; confirm default INPUT and FORWARD policies are DROP; review allowed inbound rules; test that only required ports are open; verify loopback interface rules are present
Auditd Configuration	Verify auditd is installed and running; confirm audit rules cover required events (file access, privilege escalation, user login/logout, system calls); verify audit log retention meets policy
Patch and Package Management	Verify automatic security updates are configured or manual patch process is evidenced; test that no packages with known Critical/High CVEs are installed; verify no unauthorized packages are installed

Linux Evidence Collection Commands

User and Authentication

List all users with UID, home directory, and shell:

awk -F: '{print $1","$3","$6","$7}' /etc/passwd > /tmp/audit/passwd_users.csv

Find accounts with UID 0 (should be only root):

awk -F: '($3 == 0) {print}' /etc/passwd

Check password aging and expiry policy (/etc/shadow):

awk -F: '{print $1","$3","$4","$5","$6","$7","$8}' /etc/shadow | head -20

Verify password policy in /etc/security/pwquality.conf:

grep -v '^#' /etc/security/pwquality.conf | grep -v '^$'

Check PAM faillock configuration:

grep -r 'pam_faillock\|pam_tally' /etc/pam.d/ 2>/dev/null

SSH Configuration

Extract all active SSH configuration settings:

grep -v '^#' /etc/ssh/sshd_config | grep -v '^$' | tee /tmp/audit/sshd_config_active.txt

Check specific high-risk SSH settings:

sshd -T 2>/dev/null | grep -iE 'permitrootlogin|passwordauthentication|maxauthtries|protocol|allowusers|x11forwarding'

File System Permissions

Find all SUID files (potential privilege escalation paths):

find / -perm /4000 -type f 2>/dev/null | tee /tmp/audit/suid_files.txt

Find world-writable files and directories (excluding /tmp and /proc):

find / -xdev -type f -perm /002 ! -path '/tmp/*' ! -path '/proc/*' 2>/dev/null | tee /tmp/audit/world_writable_files.txt

Check critical file permissions:

stat /etc/passwd /etc/shadow /etc/sudoers /etc/crontab /etc/ssh/sshd_config

Find unowned files (orphaned after user deletion):

find / -xdev -nouser -nogroup 2>/dev/null | tee /tmp/audit/unowned_files.txt

Services and Network

List all listening services with owning process:

ss -tlnup > /tmp/audit/listening_services.txt

List all running services (systemd):

systemctl list-units --type=service --state=running --no-pager | tee /tmp/audit/running_services.txt

Check firewall status (firewalld):

firewall-cmd --state && firewall-cmd --list-all-zones && firewall-cmd --list-services

Check iptables rules (raw):

iptables -L -n -v && iptables -t nat -L -n -v

Auditd and Logging

Verify auditd is running and check configuration:

systemctl status auditd && auditctl -l | tee /tmp/audit/audit_rules_active.txt

Confirm audit log location and retention settings:

grep -v '^#' /etc/audit/auditd.conf | grep -E 'log_file|max_log_file|max_log_file_action|num_logs'

Lynis — Automated Linux Security Audit

Lynis is a free, open-source security auditing tool for Linux and macOS. It performs hundreds of checks and produces a scored report. Auditors can run Lynis on in-scope systems to generate comprehensive baseline evidence:

Run Lynis system audit (no installation required — run directly):

./lynis audit system --no-colors --quiet --log-file /tmp/audit/lynis.log \
  --report-file /tmp/audit/lynis-report.dat 2>&1 | tee /tmp/audit/lynis-output.txt

Run with CIS benchmark profile (if available):

./lynis audit system --profile /etc/lynis/default.prf \
  --tests-category 'authentication,filesystems,networking,services'

Key Lynis output sections to review for audit evidence:

Hardening Index (0–100) — overall security score; document as a baseline metric
Warnings section — items that failed critical tests requiring immediate attention
Suggestions section — recommended improvements not yet failing
Authentication and authorization findings — user accounts, PAM, SSH
File permissions findings — SUID, world-writable, critical file permissions
Logging and auditing findings — auditd, syslog, log rotation configuration

Auditing Database Systems

Databases are the primary repository of an organization’s most sensitive data — customer records, financial data, health information, and intellectual property. Database audit methodology assesses access controls, privilege management, encryption, audit logging, and patch currency.

Database Audit — Universal Checklist

Control Domain	Key Audit Questions
Authentication	Is database authentication using strong mechanisms (not default credentials)? Are service accounts using unique, complex passwords managed via PAM/vault? Is OS authentication disabled where applicable?
User Privileges (Least Privilege)	Do any non-DBA users have DBA-equivalent privileges (SYSDBA, db_owner, sysadmin)? Are PUBLIC role permissions minimized? Are application service accounts limited to required operations only?
Network Exposure	Is the database port (1433/MSSQL, 3306/MySQL, 1521/Oracle, 5432/PostgreSQL) accessible directly from the internet? Is access restricted to application servers only? Is TLS/SSL enforced for connections?
Audit Logging	Is database audit logging enabled? Does logging capture: authentication events (success and failure), privilege use, DDL changes (schema modifications), DML on sensitive tables? Are logs sent to a centralized location?
Sensitive Data Encryption	Is sensitive data (PII, PHI, PAN) encrypted at the column level? Is Transparent Data Encryption (TDE) enabled for database files? Are database backups encrypted?
Patch Management	Is the DBMS version current? Are security patches applied within policy SLA? Are known Critical CVEs present in the currently deployed version?
Linked Servers / Remote Connections	Are all linked server connections documented and authorized? Do linked server accounts use minimum necessary permissions? Are connections encrypted?
Backup Security	Are database backups encrypted? Are backup files stored in access-controlled locations? Are backup restoration procedures tested? Are backup logs reviewed?

Microsoft SQL Server Audit Queries

Check SQL Server version and patch level:

SELECT @@VERSION AS SQLVersion;

List all logins with sysadmin role (privileged access):

SELECT l.name, l.type_desc, l.is_disabled, l.create_date, l.modify_date
FROM sys.server_principals l
JOIN sys.server_role_members m ON l.principal_id = m.member_principal_id
JOIN sys.server_principals r ON m.role_principal_id = r.principal_id
WHERE r.name = 'sysadmin'
ORDER BY l.name;

Identify all database users with db_owner role:

SELECT dp.name AS UserName, dp.type_desc, rp.name AS RoleName
FROM sys.database_role_members m
JOIN sys.database_principals dp ON m.member_principal_id = dp.principal_id
JOIN sys.database_principals rp ON m.role_principal_id = rp.principal_id
WHERE rp.name = 'db_owner';

Check SQL Server Audit specification status:

SELECT name, is_state_enabled, audit_guid FROM sys.server_audits;

SELECT name, is_state_enabled, audit_action_name
FROM sys.server_audit_specifications sas
JOIN sys.server_audit_specification_details sasd
  ON sas.server_specification_id = sasd.server_specification_id;

Check for logins using SQL authentication (should use Windows Auth in domain):

SELECT name, type_desc, is_disabled, create_date
FROM sys.server_principals
WHERE type = 'S'
ORDER BY name;

Check Transparent Data Encryption status per database:

SELECT d.name, dek.encryption_state,
  CASE dek.encryption_state WHEN 3 THEN 'Encrypted' ELSE 'NOT Encrypted' END AS status,
  dek.key_algorithm, dek.key_length
FROM sys.databases d
LEFT JOIN sys.dm_database_encryption_keys dek ON d.database_id = dek.database_id
ORDER BY d.name;

List linked servers (potential lateral movement / data exfiltration paths):

SELECT name, data_source, provider, catalog, is_remote_login_enabled
FROM sys.servers
WHERE server_id != 0;

MySQL / MariaDB Audit Queries

Check MySQL server version:

SELECT VERSION(); SHOW VARIABLES LIKE 'version%';

List all users and their host restrictions:

SELECT user, host, authentication_string, plugin
FROM mysql.user ORDER BY user;

Find users with SUPER privilege (DBA-equivalent):

SELECT user, host FROM mysql.user
WHERE Super_priv = 'Y' OR Grant_priv = 'Y' OR File_priv = 'Y';

Check if anonymous users exist (critical finding if present):

SELECT user, host FROM mysql.user WHERE user = '';

Verify SSL/TLS is enabled for connections:

SHOW VARIABLES LIKE '%ssl%'; SHOW STATUS LIKE 'Ssl_cipher';

Check general and audit log configuration:

SHOW VARIABLES LIKE 'general_log%';
SHOW VARIABLES LIKE 'audit_log%';

Oracle Database Audit Queries

Check Oracle version:

SELECT BANNER FROM V$VERSION;

Find users with DBA role:

SELECT GRANTEE, GRANTED_ROLE, ADMIN_OPTION, DEFAULT_ROLE
FROM DBA_ROLE_PRIVS
WHERE GRANTED_ROLE = 'DBA'
ORDER BY GRANTEE;

Check default accounts that should be locked:

SELECT USERNAME, ACCOUNT_STATUS, EXPIRY_DATE, LOCK_DATE, PROFILE
FROM DBA_USERS
WHERE ACCOUNT_STATUS != 'OPEN'
  OR USERNAME IN ('SCOTT','HR','OE','SH','ANONYMOUS','OUTLN','WKSYS')
ORDER BY ACCOUNT_STATUS, USERNAME;

Check Oracle Unified Auditing status:

SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';

List enabled unified audit policies:

SELECT POLICY_NAME, ENABLED_OPT, BY_USER, ENTITY_NAME
FROM AUDIT_UNIFIED_ENABLED_POLICIES;

Check Transparent Data Encryption (TDE) wallet status:

SELECT STATUS, WALLET_TYPE FROM V$ENCRYPTION_WALLET;

Auditing Network Devices

Network devices — firewalls, routers, switches, and VPN concentrators — enforce the security boundaries that protect organizational systems. Network device audit is a specialized discipline requiring understanding of both network security principles and device-specific configuration syntax.

Network Device Audit — Universal Checklist

Control Area	Audit Questions & Test Approach
Management Plane Access	Is management access (SSH, HTTPS) restricted to management network or jump hosts only? Is telnet disabled? Is console access physically secured? Are management session timeouts configured (10–15 min)?
Authentication to Devices	Is authentication using TACACS+/RADIUS with individual named accounts (not shared credentials)? Are local fallback accounts using strong passwords? Is MFA enforced for privileged access to network devices?
Software Version / Patching	Is the OS/firmware version current? Are known Critical CVEs present in the running version? Is there a defined process for network device patching? When was the last firmware update applied?
Firewall Rule Base Quality	Does the rule base follow default-deny principle? Are there any rules with ‘any/any’ that should be more specific? Are rules documented with business justification? When was the last rule base review conducted?
Unused Ports and Services	Are unused interfaces administratively shut down? Are unnecessary management services disabled (HTTP, SNMP v1/v2 without proper ACLs, Telnet, TFTP)?
Logging Configuration	Is syslog configured to send logs to a centralized SIEM? Is NTP synchronized with authoritative source (essential for log correlation)? Are session logging and authentication failure logging enabled?
SNMP Security	Is SNMP v1 or v2c disabled, or are community strings unique and access-controlled? If SNMPv3 is used, are auth and priv (encryption) modes configured? Are SNMP ACLs limiting which hosts can query the device?

Cisco IOS / IOS-XE Audit Commands

Verify running IOS version:

show version | include Software|Version|ROM

Check VTY (remote access) access controls and timeout:

show running-config | section line vty

Confirm telnet is disabled; SSH is version 2 only:

show ip ssh
show running-config | include transport input

Review privilege levels and user accounts:

show running-config | include username
show privilege

Check SNMP configuration (community strings, ACLs):

show running-config | section snmp-server

Verify NTP configuration (critical for log correlation):

show ntp associations
show ntp status

Check logging configuration and syslog server:

show running-config | include logging
show logging

Review access control lists applied to interfaces:

show ip access-lists
show running-config | section interface

Firewall Rule Base Audit Methodology

Firewall rule base analysis is one of the most impactful network security audit activities. Rule bases accumulate over years, becoming cluttered with overly permissive, undocumented, or obsolete rules.

Rule Quality Issue	Audit Identification Method
‘Any/Any’ Allow Rules	Search rule base for rules with source = Any AND destination = Any AND service = Any with Action = Allow. Each is a Critical finding — no rule should allow unrestricted traffic in both directions
Overly Broad Service Definitions	Identify rules allowing ‘Any’ service to specific hosts or networks. Map to specific ports required — ‘Any’ service on a web server should be ‘TCP 80, 443’; ‘Any’ is a finding
Missing Business Justification	Test whether each rule has documented: business owner, date created, purpose, and review date. Rules without documentation cannot be validated as authorized
Disabled Rules Not Removed	Identify disabled rules in the rule base. Disabled rules that have not been removed indicate poor change management hygiene; they may be re-enabled without visibility
Duplicate or Shadowed Rules	Identify rules that are never reached because earlier rules already match the same traffic. Use firewall vendor tools (Panorama Policy Optimizer, Fortinet Policy Analysis) or manual analysis
Outdated Stale Rules	Identify rules with no logged hits in the past 90 days. Rules that never match traffic are candidates for removal — each adds risk by maintaining a permitted path that may no longer be valid
Direct Internet Access to Internal Servers	Identify any rules permitting direct inbound connections from the internet (source = Any/Internet) to internal server IP addresses. All inbound internet traffic should traverse DMZ

Rule Base Review Best Practice

Conduct firewall rule base reviews annually at minimum and following any major network change. Use firewall policy optimization tools (Palo Alto Panorama Policy Optimizer, Fortinet Policy Analysis, Tufin, AlgoSec, FireMon) to automate identification of unused rules, shadow rules, and overly permissive rules at scale. Manual review of rule bases with thousands of rules is impractical without automation.

Auditing Active Directory

Active Directory (AD) is the identity backbone of most enterprise environments — controlling authentication, authorization, and Group Policy enforcement for all domain-joined systems. An AD audit examines privilege group membership, trust relationships, GPO configuration, password policy, and Kerberos settings.

AD Audit — Critical Risk Areas

Risk Area	Why It Matters	Audit Test
Domain Admins Membership	Every account in Domain Admins has complete control over all domain systems — over-populated DA group is the #1 AD misconfiguration finding	Query Domain Admins group membership; verify each member has documented business justification; any service accounts or application accounts in DA = Critical finding
Privileged Account Kerberoasting Exposure	Service accounts with SPNs and weak passwords can have their TGS tickets extracted and cracked offline — common ransomware entry path	Identify all accounts with SPNs: `Get-ADUser -Filter {ServicePrincipalName -ne '$null'}` — service account SPNs with weak passwords = High finding; verify AES encryption enforcement
AS-REP Roastable Accounts	Accounts with ‘Do Not Require Kerberos Preauthentication’ set can have hashes extracted without authentication — no prior access needed	`Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}` — any standard user with this flag set = Critical finding unless specifically justified
AdminSDHolder / Protected Users	AdminSDHolder propagates ACLs to protected admin groups every 60 minutes; modifications are often overlooked during audits	Review AdminSDHolder ACL: `Get-Acl 'AD:\CN=AdminSDHolder,CN=System,DC=...'` — unexpected permissions on this object can provide persistent admin access
DCSync Rights	Accounts with Replication-Get-Changes-All permission can perform a DCSync attack and extract all domain password hashes	Review ACLs on domain object for Replication-Get-Changes-All permission; should only be held by SYSTEM, domain controllers, and explicitly authorized accounts
LAPS Deployment	Local Administrator Password Solution prevents lateral movement via shared local admin passwords — if not deployed, one compromised endpoint exposes all	Query AD for LAPS attribute: `Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwdExpirationTime` — empty attribute means LAPS not deployed on that system

Active Directory Audit Commands

List all members of Domain Admins (recursive):

Get-ADGroupMember -Identity 'Domain Admins' -Recursive |
  Select-Object Name, SamAccountName, objectClass | Sort-Object Name |
  Export-Csv C:\ADaudit\domain_admins.csv -NoTypeInformation

Find accounts with SPN set (Kerberoasting candidates):

Get-ADUser -Filter {ServicePrincipalName -ne '$null'} `
  -Properties ServicePrincipalName, PasswordLastSet, PasswordNeverExpires |
  Select-Object Name, SamAccountName, ServicePrincipalName, PasswordLastSet, PasswordNeverExpires |
  Export-Csv C:\ADaudit\spn_accounts.csv -NoTypeInformation

Find accounts with ‘Do Not Require Preauthentication’ (AS-REP Roastable):

Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object Name, SamAccountName |
  Export-Csv C:\ADaudit\asrep_accounts.csv -NoTypeInformation

Find stale user accounts (no logon in 90 days, still enabled):

$90days = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -lt $90days -and Enabled -eq $true} -Properties LastLogonDate |
  Select-Object Name, SamAccountName, LastLogonDate | Sort-Object LastLogonDate |
  Export-Csv C:\ADaudit\stale_users.csv -NoTypeInformation

Check Fine-Grained Password Policies (PSOs):

Get-ADFineGrainedPasswordPolicy -Filter * |
  Select-Object Name, Precedence, MinPasswordLength, LockoutThreshold, MaxPasswordAge | Format-Table

Find accounts with PasswordNeverExpires:

Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true} -Properties PasswordNeverExpires |
  Select-Object Name, SamAccountName |
  Export-Csv C:\ADaudit\pwd_no_expiry.csv -NoTypeInformation

Review trust relationships:

Get-ADTrust -Filter * | Select-Object Name, TrustType, TrustDirection, TrustAttributes | Format-Table

Check domain and forest functional levels:

Get-ADDomain | Select-Object DomainMode, Forest
Get-ADForest | Select-Object ForestMode

Group Policy Security Audit

Security Baseline GPO: Verify a security baseline GPO exists and is linked to all OUs containing servers and workstations — GPO should enforce CIS Benchmark Level 1 minimum settings
Password Policy GPO: Verify Default Domain Policy enforces minimum password requirements; Fine-Grained Password Policies override for privileged accounts
AppLocker / WDAC: Verify application control policies are deployed via GPO to restrict execution of unauthorized executables, scripts, and DLLs on workstations
PowerShell Logging GPO: Verify Script Block Logging, Module Logging, and Transcription are enforced via GPO across all systems
BitLocker GPO: Verify BitLocker deployment is mandated via GPO for all workstations; TPM+PIN configuration requirement for sensitive environments
Windows Defender GPO: Verify Windows Defender / MDE policies enforce real-time protection, cloud protection, and sample submission via GPO

Generate HTML report of all GPOs in the domain:

Get-GPOReport -All -ReportType HTML -Path C:\ADaudit\AllGPOs.html

Check which GPOs apply to a specific OU:

Get-GPInheritance -Target 'OU=Servers,DC=domain,DC=com' | Format-List

Identify GPOs with no links (orphaned GPOs):

$linkedGPOs = (Get-GPO -All | Where-Object {$_.GpoStatus -ne 'AllSettingsDisabled'})
Get-GPO -All | Where-Object {$_.Id -notin $linkedGPOs.Id} | Select-Object DisplayName, CreationTime

Auditing Cloud Platforms

Cloud platform auditing requires a fundamentally different approach from on-premises system auditing. Configuration is API-driven, infrastructure is ephemeral, and the audit evidence landscape is radically different.

AWS Audit — Key Procedures

Identity and Access Management (IAM)

Generate IAM credential report (comprehensive account listing):

aws iam generate-credential-report && aws iam get-credential-report \
  --query 'Content' --output text | base64 -d > aws_credential_report.csv

List all users with console access and MFA status:

aws iam list-users --query 'Users[*].{User:UserName,Created:CreateDate}' --output table

Find users without MFA enabled:

aws iam list-users --query 'Users[*].UserName' --output text | tr '\t' '\n' | \
  xargs -I{} sh -c 'mfa=$(aws iam list-mfa-devices --user-name {} \
  --query length\(MFADevices\) --output text); [ $mfa -eq 0 ] && echo "NO MFA: {}"'

List all IAM roles with trust policies (identify cross-account access):

aws iam list-roles \
  --query 'Roles[*].{Role:RoleName,Principal:AssumeRolePolicyDocument}' \
  --output json > aws_iam_roles.json

S3 Storage Security

List all S3 buckets:

aws s3 ls > s3_buckets.txt

Check public access block settings for all buckets:

aws s3api list-buckets --query 'Buckets[*].Name' --output text | tr '\t' '\n' | \
  xargs -I{} sh -c 'echo "--- {} ---"; aws s3api get-public-access-block --bucket {}'

Check bucket encryption settings:

aws s3api get-bucket-encryption --bucket BUCKET_NAME 2>&1

Check bucket versioning and MFA delete:

aws s3api get-bucket-versioning --bucket BUCKET_NAME

CloudTrail and Logging

Verify CloudTrail trails are enabled in all regions:

aws cloudtrail describe-trails --include-shadow-trails \
  --query 'trailList[*].{Name:Name,Region:HomeRegion,MultiRegion:IsMultiRegionTrail,LogValidation:LogFileValidationEnabled}' \
  --output table

Check CloudTrail log file validation is enabled:

aws cloudtrail get-trail-status --name TRAIL_NAME \
  --query '{IsLogging:IsLogging,LatestDeliveryTime:LatestDeliveryTime}'

Azure Audit — Key Procedures

Azure AD / Entra ID

List all Global Administrator accounts:

az ad user list --query "[].{Name:displayName,UPN:userPrincipalName}" --output table

Check MFA registration status (requires Microsoft Graph):

az rest --method GET \
  --url 'https://graph.microsoft.com/v1.0/reports/credentialUserRegistrationDetails' | \
  ConvertFrom-Json | Select-Object userPrincipalName, isRegistered, isMfaRegistered

List all Azure role assignments at subscription level:

az role assignment list --all \
  --query "[*].{Principal:principalName,Role:roleDefinitionName,Scope:scope}" --output table

Azure Security Center / Defender for Cloud

Get Secure Score (overall security posture metric):

az security secure-score list \
  --query "[*].{Name:name,Score:currentScore,MaxScore:maxScore,Percentage:percentage}" --output table

List active security recommendations:

az security assessment list \
  --query "[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}" \
  --output table

Azure Network Security Groups (NSG)

List all NSGs with security rules:

az network nsg list \
  --query "[*].{NSG:name,RG:resourceGroup,Location:location}" --output table

Find NSG rules allowing any source (0.0.0.0/0) on sensitive ports:

az network nsg rule list --nsg-name NSG_NAME --resource-group RG_NAME \
  --query "[?sourceAddressPrefix=='*' && access=='Allow'].{Name:name,Priority:priority,DestPort:destinationPortRange,Protocol:protocol}" \
  --output table

Cloud Audit — Automated Assessment Tools

Tool	Platform	Capability
Prowler	AWS, Azure, GCP	Open-source cloud security tool with 300+ checks; CIS Benchmark assessments; PCI, HIPAA, GDPR, ISO 27001 compliance checks; generates HTML/CSV/JSON reports; excellent for point-in-time audit evidence collection
ScoutSuite	AWS, Azure, GCP, OCI, Alibaba	Open-source multi-cloud security auditing tool; generates interactive HTML report with risk-rated findings; excellent for cross-cloud audits; good for evidence documentation
CloudSploit	AWS, Azure, GCP, Oracle	Open-source cloud security scanner; API-based; 500+ checks; JSON/CSV output; integrates with CI/CD pipelines for continuous compliance verification
Checkov	AWS, Azure, GCP, K8s, Terraform	Infrastructure-as-Code security scanner; audits Terraform/CloudFormation/ARM templates before deployment; identifies misconfigurations before they reach production
AWS Security Hub / Azure Defender / GCP SCC	Native to respective platform	Native cloud security posture management; continuous findings with native integration; use as primary evidence source when available; validate specific findings with CLI commands

Run Prowler for AWS CIS Benchmark assessment:

prowler -g cislevel1 -f us-east-1 -M html,csv --output-directory ./prowler-output/

Run ScoutSuite for AWS audit:

python scout.py aws --report-dir ./scoutsuite-report/ --no-browser

Run ScoutSuite for Azure audit:

python scout.py azure --cli --report-dir ./scoutsuite-report-azure/

Security Configuration Assessment Methodology

Security configuration assessment evaluates whether systems are deployed and maintained according to defined security baselines. Two major baseline frameworks — CIS Benchmarks and DISA STIGs — provide comprehensive, platform-specific security requirements that are measurable, testable, and widely accepted as evidence of due diligence in system hardening.

CIS Benchmarks Framework

The Center for Internet Security (CIS) publishes free security configuration benchmarks for 100+ platforms. CIS Benchmarks are the most widely used hardening standards outside the US government sector and are referenced by PCI DSS, ISO 27001, and HIPAA guidance documents.

CIS Profile Level	Target Use Case	Audit Application
Level 1 — Basic Security Hygiene	Recommended for all systems; no significant operational impact; broad compatibility with standard enterprise environments	Use as minimum baseline for all audit engagements. Systems failing Level 1 controls represent material audit findings — these are foundational security requirements, not aspirational hardening
Level 2 — Defense-in-Depth	Intended for security-sensitive environments; may impact some enterprise functionality; assumes security prioritized over convenience	Use for systems handling regulated data (PII, PHI, PCI), internet-facing systems, and administrator workstations. Level 2 failures in these contexts = High findings in most audit frameworks

CIS Benchmark Assessment Process

Download the applicable CIS Benchmark from cisecurity.org (free registration required); select the version matching the exact OS/application version deployed
Download CIS-CAT Pro Assessor (licensed) or use the free CIS-CAT Lite for evaluation; alternatively use OpenSCAP with CIS SCAP content
Run the assessment with the appropriate profile (Level 1 or Level 2) against each in-scope system; document tool version, benchmark version, profile selected, and date of assessment
Review automated results: Pass, Fail, and Not Applicable items; annotate findings where the automated result may be incorrect due to environment-specific configuration
Manually verify all automated ‘Fail’ items that will become audit findings; automated tools can produce false positives — findings must be validated before being reported
Calculate compliance percentage by category and overall; document in working papers with the raw tool output as supporting evidence

DISA STIG Framework

Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) are mandatory configuration standards for US Department of Defense information systems. Outside DoD, STIGs are used as high-assurance hardening guides, particularly in defense contractors and classified environments.

STIG Finding Category	Severity Level	Audit Disposition
Category I (CAT I)	Critical — directly enables access; data breach risk; immediate exploitation possible	Any CAT I finding in a production system is a Critical audit finding regardless of context. STIG CAT I findings are considered ‘open’ (not compliant) until remediated or formally accepted with documented mitigation
Category II (CAT II)	High — significant degradation of mission capability; indirect exploitation paths	CAT II findings are High audit findings. Organizations must document all open CAT II findings in a Plan of Action and Milestones (POA&M) with target remediation dates
Category III (CAT III)	Medium — degrades measures protecting mission capability; administrative/operational guidance gaps	CAT III findings are Medium audit findings. Address in standard vulnerability management cycle; POA&M required in DoD environments

STIG Assessment Tools

Run STIG assessment using SCAP Compliance Checker (SCC — free from DISA):

# Install SCC from public.cyber.mil
# Run STIG content against target system:
scc.exe /contentPath C:\STIG_Content\ /outputFolder C:\STIG_Results\ /targetFile C:\targets.txt

Run OpenSCAP with STIG XCCDF profile (Linux):

oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive \
  --report stig_report.html \
  --results stig_results.xml \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Mapping Findings to Frameworks

A single technical finding often satisfies — or violates — multiple control frameworks simultaneously. Efficient audit practice maps each finding to all applicable frameworks:

Technical Finding	NIST 800-53	CIS Control	ISO 27002	PCI DSS	HIPAA
Local admin accounts active on all servers (no LAPS)	AC-2, AC-6	CIS 4.7	A.8.2	Req 7, 8	§164.312(a)
Audit logging not enabled / insufficient	AU-2, AU-9, AU-12	CIS 8.1, 8.2	A.8.15	Req 10	§164.312(b)
Critical patches > 30 days unpatched	SI-2, RA-5	CIS 7.3, 7.4	A.8.8	Req 6.3	§164.308(a)(1)
MFA not enforced on privileged accounts	IA-2, IA-5	CIS 5.3, 5.4	A.8.5	Req 8.4	§164.312(d)
Sensitive data not encrypted at rest	SC-28	CIS 3.11	A.8.24	Req 3.4	§164.312(a)(2)(iv)
Weak SSH configuration (password auth enabled)	IA-5, SC-8	CIS 4.1	A.8.5, A.8.20	Req 2.2, 8.2	§164.312(d)
No network segmentation between systems	SC-7, AC-4	CIS 12.2	A.8.22	Req 1.3	§164.312(e)

Evidence Collection and Documentation

Technical audit evidence is only as valuable as its documentation. Raw command output with no context — no system name, no date, no auditor signature — is legally and professionally useless. Evidence must be collected, labeled, and stored in a manner that creates an unambiguous, defensible audit trail.

Evidence Package Structure

Recommended evidence directory structure:

[AuditID]_[SystemName]_[YYYY-MM]/
├── 00_Scope_and_Authorization/
│   ├── engagement_letter_signed.pdf
│   ├── scope_document.pdf
│   └── auditee_contacts.xlsx
├── 01_Asset_Inventory/
│   ├── nmap_scan_[date].xml
│   ├── cmdb_export_[date].xlsx
│   └── ad_computer_objects_[date].csv
├── 02_Access_Controls/
│   ├── local_users_[hostname]_[date].csv
│   ├── domain_admins_[date].csv
│   └── iam_credentials_aws_[date].csv
├── 03_Configuration_Compliance/
│   ├── cis_cat_report_[hostname]_[date].html
│   ├── lynis_output_[hostname]_[date].txt
│   └── stig_report_[hostname]_[date].html
├── 04_Patch_Management/
│   ├── nessus_scan_[date].nessus
│   └── hotfix_listing_[hostname]_[date].csv
├── 05_Logging_and_Monitoring/
│   ├── audit_policy_[hostname]_[date].txt
│   └── siem_log_retention_evidence_[date].pdf
└── 09_Findings/
    ├── DRAFT_findings_[date].xlsx
    └── FINAL_report_[date].pdf

Evidence Labeling Requirements

Label Element	Requirement
Date and Time Collected	Exact timestamp including timezone — essential for establishing that evidence covers the audit period and for correlating across multiple evidence sources
System / Target Identification	Hostname, IP address, or AWS ARN of the system from which evidence was collected — must be unambiguous and traceable to the scope document
Collection Method	How the evidence was obtained: ‘Auditor-run PowerShell command’, ‘Automated CIS-CAT scan’, ‘Report exported from SIEM by auditor’, ‘Provided by auditee’ — determines reliability weighting
Auditor Identity	Name of the auditor who collected the evidence; if provided by auditee, name of the person who provided it and their role
Tool and Version	Tool used to collect evidence and its version number — enables re-execution validation if evidence is challenged
Working Paper Reference	Cross-reference to the specific audit program step this evidence supports — enables efficient review and gaps identification
Hash Verification (forensic evidence)	For evidence that may be subject to legal challenge: SHA-256 hash of the file at time of collection, confirming it has not been modified since collection

Audit Evidence Scripts — Automation

Windows Evidence Collection Script (Run as local administrator):

# Windows Audit Evidence Collector
# Usage: .\collect_evidence.ps1 -AuditID AUD-2025-001 -Hostname $env:COMPUTERNAME
param([string]$AuditID, [string]$Hostname)
$Date   = Get-Date -Format 'yyyyMMdd_HHmm'
$OutDir = "C:\AuditEvidence\${AuditID}_${Hostname}_${Date}"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

# System Info
Get-ComputerInfo | Export-Csv "$OutDir\system_info.csv" -NoTypeInformation
# User Accounts
Get-LocalUser | Select Name,Enabled,LastLogon,PasswordRequired | Export-Csv "$OutDir\local_users.csv" -NoTypeInformation
# Audit Policy
auditpol /get /category:* > "$OutDir\audit_policy.txt"
# Services
Get-Service | Export-Csv "$OutDir\services.csv" -NoTypeInformation
# Patches
Get-HotFix | Sort InstalledOn -Desc | Export-Csv "$OutDir\hotfixes.csv" -NoTypeInformation
# Firewall
Get-NetFirewallProfile | Select Name,Enabled,DefaultInbound | Export-Csv "$OutDir\firewall_profiles.csv" -NoTypeInformation
# Hash all evidence files
Get-ChildItem $OutDir | Get-FileHash -Algorithm SHA256 | Export-Csv "$OutDir\evidence_hashes.csv" -NoTypeInformation
Write-Host "Evidence collected to: $OutDir"

Linux Evidence Collection Script:

#!/bin/bash
# Linux Audit Evidence Collector
AUDIT_ID="${1:-AUD-$(date +%Y%m%d)}"
HOST=$(hostname)
DATE=$(date +%Y%m%d_%H%M)
OUT="/tmp/audit_evidence/${AUDIT_ID}_${HOST}_${DATE}"
mkdir -p "$OUT"

uname -a > "$OUT/system_info.txt"
id root >> "$OUT/system_info.txt"
awk -F: '{print $1","$3","$7}' /etc/passwd > "$OUT/users.csv"
grep -v '^#' /etc/ssh/sshd_config | grep -v '^$' > "$OUT/sshd_config_active.txt"
ss -tlnup > "$OUT/listening_services.txt"
systemctl list-units --type=service --state=running > "$OUT/running_services.txt"
auditctl -l > "$OUT/audit_rules.txt" 2>/dev/null
rpm -qa --qf '%{NAME},%{VERSION},%{RELEASE}\n' > "$OUT/installed_packages.csv" 2>/dev/null || \
  dpkg-query -W -f='${Package},${Version}\n' > "$OUT/installed_packages.csv" 2>/dev/null

# Hash all files
find "$OUT" -type f -exec sha256sum {} \; > "$OUT/evidence_hashes.sha256"
echo "Evidence collected to: $OUT"

Technical Findings and Audit Reporting

Translating Technical Findings into Business Risk

Technical Finding Statement	Business Risk Translation
17 of 42 Windows servers (40%) are running Windows Server 2012 R2, which reached end-of-life in October 2023 and no longer receives security patches	40% of servers cannot receive security patches. Known exploits (including ransomware delivery vectors) targeting Windows Server 2012 R2 will remain permanently unmitigated, creating an ever-growing attack surface that attackers actively target.
Domain Admins group contains 23 members; industry benchmark is 5 or fewer; 8 members are service accounts	23 accounts have complete, unconstrained control over every domain-joined system. If any of these accounts is compromised, an attacker gains immediate control of the entire organization’s IT infrastructure. Service accounts in Domain Admins are particularly dangerous — they do not change passwords automatically and are often targeted by Kerberoasting attacks.
S3 bucket ‘prod-customer-data’ has ServerSideEncryptionEnabled = false; bucket contains 2.3M customer records	2.3 million customer records are stored unencrypted. Under GDPR, storing unencrypted personal data represents a likely regulatory violation with potential fines up to €20M or 4% of global revenue.
22% of sampled firewall rules have no documented business justification in the change management system	22% of permitted network paths cannot be verified as authorized. Without documented justification, the organization cannot determine whether these rules were legitimately created or represent unauthorized changes. Each unjustified rule is a potential persistent access path that may remain open indefinitely.

Risk Rating Calibration for Technical Findings

Rating	Technical Criteria	Business Impact Threshold	Remediation SLA
CRITICAL	Active exploitation detected; CISA KEV vulnerability in production; Critical CVE actively exploited in the wild; unauthenticated internet-facing RCE; default credentials on production system	Immediate exploitation possible; data breach likely; operational disruption imminent; regulatory violation with mandatory immediate notification	Emergency response within 24–48 hours; interim control within 5 days; root cause within 30 days
HIGH	CVSS 7.0–9.9 with exploitable path; no MFA on privileged access; Critical patches >30 days unpatched; SoD conflicts in financial systems; admin default credentials on internal systems	Significant probability of successful attack within 30–90 days without remediation; potential regulatory non-compliance; >$100K estimated breach impact	Remediation plan within 5 days; root cause fix within 60 days
MEDIUM	CVSS 4.0–6.9; configuration deviations from baseline with compensating controls present; missing hardening with no known active exploits; documentation gaps for controls that are nonetheless present	Increased risk but reduced immediate likelihood; exploitable as part of attack chain; compliance gap that is unlikely to trigger enforcement action independently	Remediation plan within 15 days; root cause fix within 90 days
LOW	Minor configuration deviations from best practice; unused features not disabled; cosmetic security gaps with no plausible exploit path; best-practice recommendations	Minimal security value; defense-in-depth hardening that is not yet complete; low-probability contribution to attack chain	Address in next standard maintenance cycle; within 180 days

Sample Technical Finding — Fully Developed

ITGC-2025-003 Privileged Accounts Lack Multi-Factor Authentication Critical

Criteria

Per the Organization’s Access Management Policy §4.5 and CIS Control 6.3, multi-factor authentication is required for all accounts with administrative access to systems. PCI DSS Requirement 8.4.2 mandates MFA for all access to the Cardholder Data Environment.

Condition

Of 47 accounts with Domain Administrator or local administrator privileges across in-scope systems, 31 (66%) had no MFA enrolled as of the evidence collection date (2025-03-15). Twelve of the 31 accounts belong to IT staff who regularly administer production servers. Eight are service accounts with interactive logon rights. The remaining eleven are accounts of former employees that were not deprovisioned.

Cause

The MFA enforcement policy, published in 2023, was applied to the standard user population via Conditional Access Policy but the policy excluded privileged accounts that use a legacy VPN solution incompatible with modern MFA. No compensating control was implemented for these excluded accounts, and the exception was not documented in the risk register.

Effect

Stolen credentials for any of the 31 accounts are sufficient to achieve complete administrative control of all domain systems without any additional authentication factor. Credential theft (via phishing, password spray, or credential stuffing from prior breach databases) is the most common initial access technique. In the current configuration, a single successful phishing attack against any IT administrator provides immediate domain-level access.

Recommendation

(1) Immediately enroll all 31 affected accounts in phishing-resistant MFA (FIDO2/hardware key) — do not wait for VPN migration. (2) If legacy VPN prevents MFA enrollment, revoke administrative rights from those accounts until the VPN issue is resolved. (3) Deprovision the 11 former employee accounts within 24 hours. (4) Within 30 days: complete migration to MFA-compatible remote access solution; enforce Conditional Access policy for ALL privileged accounts without exceptions; document any remaining exceptions in the risk register with formal executive acceptance.

Audit Report Executive Summary — Structure

Audit Purpose & Period
One sentence: what was audited, when, and by whom
Overall Conclusion
The auditor’s overall assessment: ‘The organization’s security controls provide reasonable assurance’ / ‘Material control weaknesses were identified that represent significant risk to information assets’
Finding Summary
Table: Critical (N), High (N), Medium (N), Low (N), Informational (N)
Top 3–5 Priority Findings
Brief, non-technical description of the most significant findings; focus on business risk language
Positive Observations
Controls that are operating effectively and deserve recognition; executive summaries that only contain negatives are incomplete
Strategic Risk Statement
Overall risk posture assessment relative to organizational risk appetite and industry benchmarks
Key Recommendations
3–5 strategic actions the organization should prioritize; these may combine multiple individual findings into thematic recommendations

Audit Methodology Quick Reference

Term / Concept	Definition
Audit Lifecycle	7 phases: Authorization & Scoping → Pre-Audit Reconnaissance → Technical Data Collection → Analysis & Testing → Finding Development → Auditee Review → Final Report & Follow-Up
CIS Benchmark Level 1	Foundational security hygiene; recommended for all systems; no significant operational impact — failures are minimum baseline findings in most audit engagements
CIS Benchmark Level 2	Defense-in-depth hardening; security-sensitive environments; may impact some functionality — used for systems handling regulated data or internet-facing systems
DISA STIG CAT I	Critical — direct enablement of access or data breach; equivalent to Critical audit finding in civilian environments
DISA STIG CAT II / CAT III	High / Medium — respectively; CAT II/III findings feed the Plan of Action and Milestones (POA&M) in DoD environments
CIS-CAT Pro	CIS-licensed automated compliance scanner for CIS Benchmarks; generates scored HTML report with remediation guidance; standard tool for configuration compliance evidence
OpenSCAP	Open-source SCAP-compliant scanner; used with DISA STIG SCAP content; free alternative to CIS-CAT for STIG assessments
Lynis	Free open-source Linux/macOS security audit tool; 300+ checks; Hardening Index score; best open-source tool for Linux system audit automation
BloodHound / PingCastle	Active Directory audit tools; BloodHound for attack path visualization; PingCastle for risk-scored AD health report — both free for audit use
Prowler / ScoutSuite	Open-source cloud security audit tools; Prowler for AWS/Azure/GCP compliance checks; ScoutSuite for multi-cloud security audit with interactive HTML report
Evidence Labeling	Every evidence item requires: date/time, system identification, collection method, auditor identity, tool/version, and working paper reference
Framework Mapping	Single technical finding may satisfy multiple frameworks (NIST, CIS, ISO, PCI, HIPAA) simultaneously — map findings to all applicable frameworks for compliance efficiency
Business Risk Translation	Technical findings must be expressed in business terms: operational impact, financial exposure, regulatory liability — not technical description alone
Kerberoasting (audit finding)	Service accounts with SPNs and weak passwords; auditors should identify these as High findings — evidence: `Get-ADUser -Filter {ServicePrincipalName -ne '$null'}`
DCSync Rights (AD finding)	Accounts with Replication-Get-Changes-All permission can extract all password hashes; any non-DC account with this right = Critical finding
Firewall ‘Any/Any’ Rule	A firewall rule permitting any source to any destination on any port = Critical finding; violates default-deny principle; no legitimate security justification exists

Appendix A: Platform-Specific Audit Checklist Summary

Control	Windows	Linux	Network Device	Primary Evidence
Unique user IDs — no shared accounts	✓	✓	✓	User listing from system; verify no duplicate UIDs
MFA / Strong authentication enforced	✓	✓	✓	IAM report; SSH config; TACACS+ config; MFA device listing
Privileged access minimized / documented	✓	✓	✓	Admin group membership; sudo rules; privilege level config
Password policy meets minimum requirements	✓	✓	✓	secedit / PAM config / local policy; net accounts output
Audit logging enabled and collecting required events	✓	✓	✓	auditpol output; auditd rules; syslog config; logging config
Logs sent to centralized SIEM	✓	✓	✓	SIEM ingestion confirmation; syslog server config; log forwarding rules
Security patches current within SLA	✓	✓	✓	Get-HotFix; rpm -qa; show version; CVE cross-reference
Unnecessary services disabled	✓	✓	✓	Service listing; running service comparison to approved list
Firewall / host-based firewall active	✓	✓	N/A	Get-NetFirewallProfile; iptables -L; firewall-cmd –list-all
Remote management secured (SSH/RDP not password-only)	✓	✓	✓	SSH config; NLA enforcement; TACACS+ authentication evidence
Security configuration baseline compliance ≥ 80%	✓	✓	✓	CIS-CAT/STIG report; Lynis report; benchmark assessment results
Encryption of sensitive data at rest	✓	✓	N/A	BitLocker status; LUKS/dm-crypt check; disk encryption report

Key Evidence Collection Commands — Quick Reference

Platform	Audit Area	Command
Windows PowerShell	Local Users	Get-LocalUser \| Select Name,Enabled,LastLogon \| Export-Csv users.csv
Windows PowerShell	Audit Policy	auditpol /get /category:* > audit_policy.txt
Windows PowerShell	Services	Get-Service \| Export-Csv services.csv -NoTypeInformation
Windows PowerShell	Patches	Get-HotFix \| Sort InstalledOn -Desc \| Export-Csv hotfixes.csv
Windows PowerShell	Firewall	Get-NetFirewallProfile \| Select Name,Enabled \| Format-Table
Linux Bash	Users / UID 0	awk -F: ‘($3==0){print}’ /etc/passwd
Linux Bash	SUID Files	find / -perm /4000 -type f 2>/dev/null
Linux Bash	SSH Config	grep -v ‘^#’ /etc/ssh/sshd_config \| grep -v ‘^$’
Linux Bash	Listening Ports	ss -tlnup
Linux Bash	Audit Rules	auditctl -l 2>/dev/null
SQL Server	Sysadmin Accounts	SELECT name FROM sys.server_role_members WHERE role_principal_id = SUSER_ID(‘sysadmin’)
SQL Server	TDE Status	SELECT name, encryption_state FROM sys.databases d JOIN sys.dm_database_encryption_keys k ON d.database_id=k.database_id
MySQL	Privileged Users	SELECT user,host FROM mysql.user WHERE Super_priv=’Y’
Cisco IOS	Version	show version \| include Software\|Version
Cisco IOS	SSH Config	show ip ssh; show run \| include transport input
Active Directory	Domain Admins	Get-ADGroupMember ‘Domain Admins’ -Recursive \| Select Name,SamAccountName
Active Directory	Kerberoastable	Get-ADUser -Filter {ServicePrincipalName -ne ‘$null’} -Properties SPN
Active Directory	AS-REP Roastable	Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}
AWS CLI	IAM Credential Report	aws iam generate-credential-report && aws iam get-credential-report
AWS CLI	S3 Public Access	aws s3api get-public-access-block –bucket BUCKET_NAME
AWS CLI	CloudTrail Status	aws cloudtrail describe-trails –include-shadow-trails
Azure CLI	Role Assignments	az role assignment list –all –output table
Azure CLI	Secure Score	az security secure-score list –output table

Recommended Resources & Certifications

Technical References

CIS Benchmarks — cisecurity.org/cis-benchmarks (free download; 100+ platform benchmarks)
DISA STIGs — public.cyber.mil/stigs (US government hardening standards; free download)
NIST SP 800-53A Rev 5 — Assessment procedures for all NIST security controls
MITRE ATT&CK Framework — attack.mitre.org (adversary techniques; use to contextualize audit findings)
CIS-CAT Pro — cisecurity.org/cybersecurity-tools/cis-cat-pro (licensed automated benchmark scanner)
Lynis — cisofy.com/lynis (free Linux security audit tool)
BloodHound — github.com/BloodHoundAD/BloodHound (AD audit and attack path visualization)
PingCastle — pingcastle.com (free AD security assessment; risk-scored HTML report)
Prowler — github.com/prowler-cloud/prowler (open-source cloud security tool; AWS/Azure/GCP)
ScoutSuite — github.com/nccgroup/ScoutSuite (open-source multi-cloud security audit)

Professional Certifications for Technical Auditors

Certification	Body	Technical Audit Relevance
CISA (Certified Information Systems Auditor)	ISACA	Primary IT audit certification; covers audit process, IT governance, systems acquisition, and IS operations — foundational requirement for IT audit professionals
CCSP (Certified Cloud Security Professional)	ISC2	Cloud security expertise; critical for cloud platform audits (AWS, Azure, GCP); covers cloud architecture, security controls, and compliance
AWS Certified Security — Specialty	Amazon	Deepens technical capability for AWS environment audits; covers IAM, encryption, logging, incident response in AWS; recognized by AWS customers as assurance qualification
OSCP (Offensive Security Certified Professional)	Offensive Security	Adversarial perspective that dramatically improves technical audit quality; understanding how attacks work enables better identification of exploitable control gaps
CompTIA Security+ / CySA+	CompTIA	Security+ for foundational knowledge; CySA+ (Cybersecurity Analyst) for detection and response focus; good entry-level certifications for technical auditors
GIAC GSEC / GCIH	GIAC / SANS	GSEC for general security knowledge; GCIH for incident handler skills transferable to audit; SANS training produces technically strong practitioners