Christchurch · Dunedin · Nationwide
IT Security Audits for New Zealand Businesses
An IT security audit checks whether the controls protecting your business meet agreed requirements and are working in practice. Exodesk reviews the systems and processes in scope, explains the gaps and gives you a prioritised plan for addressing them.
Supporting New Zealand businesses since 1989
The short answer
What is an IT security audit?
An IT security audit is a structured review of your security controls against agreed criteria, using evidence to show what is operating effectively, what needs improvement and what could not be verified.
Before work starts, we agree what will be checked, the criteria used, the access required and what you will receive. If the report is for a customer, insurer or regulator, share their requirements first so we can confirm whether the proposed review is suitable.
When it fits
When do you need a security audit?
An audit suits situations where you need evidence measured against a defined standard or requirement, not just a list of improvements.
- A customer, contract or tender asks for it. They want to see your controls reviewed against their stated requirements.
- An insurer asks detailed questions. You want reviewed evidence behind your answers rather than a best guess.
- You are working towards a standard. Such as CIS Controls, ISO 27001 or SMB1001, and need to know where the gaps are.
- The board or owners want assurance. They need a clear view of how well security controls operate.
- After major change. A new system, site, acquisition or change of IT provider.
- After a security incident. Once it has been contained, to review the controls around it alongside your incident response plan.
Scope
What does a security audit cover?
The areas below can be combined in one audit. Your scope names what is included, what is excluded and the evidence needed for each area.
Identity
Access and identity
Who has access to what, how access is granted and removed, administrator accounts, and whether multi-factor authentication is enforced where it should be.
Systems
Patching and software
Whether operating systems, applications and firmware are updated to an agreed schedule, with evidence rather than verbal assurance, and whether unsupported software is still in use.
Recovery
Backup and recovery
Backup coverage, retention and protection, and the records of restore tests. Reviewing restore-test records is different from running a restore test, and your scope states which is included. Without a successful restore test, recovery remains unverified.
Network
Network and devices
Firewalls, remote access, wireless, segmentation and endpoint protection, including whether security tools are running, alerting and being monitored.
Cloud
Microsoft 365 and cloud
Security settings for Microsoft 365 and other cloud services, such as sign-in controls, sharing, administrator roles and connected apps.
People
Policies, data and staff
Whether documented policies are followed in practice, how sensitive data is handled and disposed of, and staff training records and practices.
An audit may include vulnerability scanning where agreed, but it is not the same as a separately commissioned penetration test or cyber risk assessment. Any intrusive checks are authorised in writing before they start.
Criteria
What can we audit against?
Every audit is measured against criteria agreed before work starts. The right choice depends on why you need the audit and who will rely on the report.
- CIS Controls. For a smaller business, CIS Controls Implementation Group 1 gives a practical baseline of essential safeguards.
- NIST Cybersecurity Framework. The NIST CSF for a broader view of how security risk is governed and managed.
- SMB1001. A readiness review against the tiered small business cyber security standard, before you apply for certification.
- ISO 27001 or NZISM. A gap review against ISO 27001 or the New Zealand Information Security Manual. For ISO 27001, the proposal states whether it covers technical controls only or the wider information security management system. A gap review is not certification.
- Your requirements. Your own security policies, or the stated requirements of a customer, insurer or contract.
Your proposal names the framework version, applicable requirements and depth of review. For SMB1001, it also names the target certification tier. The report states what was examined, what was sampled and what was outside scope.
Findings
How are the findings assessed?
Your report states the criteria used, the evidence reviewed and any limitations. For each control, it distinguishes what is operating effectively, what needs improvement and what could not be verified.
Findings are rated using the agreed criteria and their business implications. Remediation priorities consider the likelihood and impact of harm. Operational constraints inform the implementation plan, with interim protection and any accepted residual risk recorded where a fix cannot be completed immediately. If a maturity score is used, the report explains the scale and how each score was reached. No score means a business is completely secure.
How it works
How does a security audit run?
Six stages, from agreeing the scope to confirming that fixes worked.
Scope and criteria
We agree the systems, sites and processes in scope, the criteria, any exclusions, the evidence needed and who will rely on the report. You receive a fixed quote for that scope.
Prepare
Access, documents and staff time are arranged, and any intrusive checks such as scanning are authorised in writing.
Gather evidence
Our team reviews documents, configurations and records, and speaks with the people involved, remotely or on site as the scope needs. If we find an urgent exposure, we tell your agreed contact promptly rather than waiting for the report.
Analyse and report
Evidence is assessed against the criteria and written up with findings, limitations and recommended actions.
Walkthrough
We explain the business implications and help you agree priorities, owners and target dates for each finding.
Fix and verify
Remediation work and follow-up verification are scoped separately unless your proposal includes them. Where verification is included, critical fixes are checked promptly; a later periodic review serves a different purpose.
Deliverables
What do you receive from a security audit?
Your report sets out the agreed scope, criteria, findings, limitations and recommended actions.
- Scope and criteria. What was reviewed, against what, and what was excluded.
- Business summary. What the findings mean for the business, in plain language.
- Findings with evidence. Each control assessed as operating effectively, needing improvement or not verified.
- Limitations. Anything that could not be checked, and why.
- Recommended actions. What to change, prioritised by risk.
The walkthrough explains the business implications and helps agree priorities, owners and target dates. An audit identifies and assesses gaps; reducing risk depends on implementing and maintaining the changes.
Choosing the right review
Security audit, assessment or testing?
These reviews answer different questions and can work together.
Security audit
Reviews controls against agreed criteria and explains findings, limitations and next steps.
IT assessment
A free, improvement-focused look at your IT and security, ending in a plan of what to deal with first.
Cyber risk assessment
Identifies risk scenarios, their consequences and likelihood, and the treatment decisions.
Penetration testing
Tests exploitable weaknesses within an authorised scope.
Vulnerability management
Continuously identifies, prioritises and addresses technical weaknesses.
For help commissioning any of these, see our guide to a cyber security assessment.
Independence
Who should carry out the audit?
Choose a reviewer with experience relevant to the systems and requirements in scope.
Being outside your organisation is not the same as being independent of the work reviewed. Your existing IT provider can carry out a useful security review, but may be reviewing its own work. If Exodesk manages the systems in scope, we say so in the proposal and the report.
If a customer, insurer or regulator requires independent assurance, confirm their criteria before commissioning the review and use a suitably independent reviewer where required.
Compliance and insurance
Will an audit satisfy an insurer or customer?
A customer, insurer or regulator may ask for a security review with a defined scope or an independent assessor. Confirm those requirements before commissioning the work.
An audit can support due diligence, but does not itself guarantee insurance cover, certification or legal compliance. For cyber insurance, requirements depend on the actual policy and the insurer’s questions.
Under the Privacy Act, Principle 5 requires security safeguards that are reasonable in the circumstances. An audit can help review those safeguards, but does not by itself establish compliance with the whole Act. Our guide to Privacy Act compliance covers the wider duties.
Cost and timing
What affects audit cost and timing?
We agree the scope first, then give you a fixed quote for it. The main factors are:
- Scope. The number of systems, sites and processes, and whether cloud services are included.
- Criteria. A focused baseline such as CIS IG1 is a different piece of work from a gap review against ISO 27001.
- Evidence. How much documentation exists, and how much needs to be gathered through interviews and configuration reviews.
- On-site work. Whether evidence can be gathered remotely or needs time on site.
- Reporting needs. Whether the report must follow a format set by a customer, insurer or regulator.
Agree the review cycle around your risks, major changes and any customer, insurer or regulatory requirements. Your proposal sets out preparation, evidence gathering, reporting and follow-up separately, including the access and staff time needed.
Why Exodesk
Why work with Exodesk?
Our own team, remote or on site
The audit is carried out by the Exodesk team, working remotely or on site as your scope needs.
Scope and price agreed first
You agree the scope and criteria and receive a fixed quote before any work starts. Remediation is scoped separately, so you choose who fixes what.
Supporting businesses since 1989
Our teams in Christchurch and Dunedin work with businesses across New Zealand, alongside our wider cyber security services.
Questions
Security audit questions
What is an IT security audit?
An IT security audit is a structured review of your security controls against agreed criteria. It uses evidence to show what is operating effectively, what needs improvement and what could not be verified. The report ends with prioritised recommended actions.
How is a security audit different from a free IT assessment?
An IT assessment helps identify improvement priorities. A security audit checks controls against agreed criteria and records the supporting evidence and limitations. Choose the review around the decision you need to make and any requirements set by the organisation receiving the report.
How is a security audit different from a penetration test?
An audit reviews whether controls meet agreed criteria and operate in practice. A penetration test tries to exploit weaknesses within an authorised scope. The two answer different questions and can be used together.
What does a security audit include?
The scope can cover access and identity, patching, backup and recovery, network and devices, Microsoft 365 and cloud settings, and policies, data and staff practices. It may include vulnerability scanning where agreed. Your scope names exactly what is included and excluded.
Which standards can Exodesk audit against?
We can audit against CIS Controls, the NIST Cybersecurity Framework, your own policies or the stated requirements of a customer, insurer or contract. We also carry out SMB1001 readiness reviews and gap reviews against ISO 27001 or the NZISM. A gap review is not certification.
Who carries out the security audit?
The Exodesk team carries out the audit, remotely or on site as the scope needs. If Exodesk manages the systems in scope, we say so in the proposal and the report. Where a customer, insurer or regulator requires independent assurance, confirm their criteria first and use a suitably independent reviewer where required.
Will a security audit satisfy our insurer or customer?
That depends on their stated requirements, which may include a defined scope or an independent assessor. Share those requirements before the work is commissioned so we can confirm whether the proposed review is suitable. An audit supports due diligence but does not guarantee cover, certification or acceptance.
Is a security audit required under the Privacy Act?
The Privacy Act does not impose a general requirement for every business to commission an IT security audit. Principle 5 requires security safeguards that are reasonable in the circumstances. An audit can help review those safeguards, but does not by itself establish compliance with the whole Privacy Act. Separate sector or contractual requirements may apply.
How much does a security audit cost?
Cost depends on the scope, the criteria, the evidence to be gathered and whether on-site work is needed. We agree the scope first, then give you a fixed quote for it. Remediation and follow-up verification are scoped separately unless your proposal includes them.
How long does a security audit take?
Timing depends on the scope, the criteria and how much evidence already exists. Your proposal sets out preparation, evidence gathering, reporting and follow-up separately, including the access and staff time needed. Confirm the schedule before committing to a customer or insurer deadline.
What happens if the audit finds an urgent issue?
We tell your agreed contact promptly rather than waiting for the final report. Interim protection and remediation deadlines are then agreed based on how exploitable the issue is, its business impact and your operational constraints.
Can a security audit guarantee we will not be breached?
No. An audit identifies and assesses gaps at a point in time, and reducing risk depends on implementing and maintaining the changes. No audit result means a business is completely secure.
Next step
Discuss your security audit
Tell us which systems need reviewing and whether the report must meet a customer, insurer or regulatory requirement.
Get in touch
Talk to us about your audit
Tell us a little about the systems you want reviewed and any requirements the report must meet, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941