Network security and segmentation audit program.
How to audit whether networks are designed securely, separated into zones, controlled by firewalls and managed in operation and change.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation designs and delimits its networks by protection requirement, controls traffic between zones, runs network services and remote access securely and keeps changes and anomalies in the network under control. It also assesses whether documentation reflects the actual structure.
Scope
- Internal networks, data centre networks, site and remote connections, wireless networks and the gateways to the internet
- Firewalls, routers, switches, VPN gateways and network services such as DNS and DHCP
- Network management, changes to rules and monitoring of traffic
- Out of scope: application security and endpoint hardening, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A network security policy exists, is approved and governs the design, operation and access to networks. | ISO/IEC 27001:2022 Annex A 8.20; BSI NET.1.1 | Read the policy, establish approval and currency and compare it with the network documentation. | Policy with approval record, network documentation |
| 2 | Network diagrams and the zone model are current and reflect the actual structure, including the connections to providers and cloud links. | BSI NET.1.1; ISO/IEC 27001:2022 Annex A 8.20 | Compare the network diagram with the configuration of routers and firewalls at three sites or zones. | Network diagrams, zone model, configuration extracts |
| 3 | Networks are separated into zones by protection requirement; essential systems and management networks sit in their own segments. | ISO/IEC 27001:2022 Annex A 8.22; BSI NET.1.1 | Compare the zone concept with the implementation and test from a user network whether management interfaces are reachable. | Segmentation concept, reachability test results, configuration extracts |
| 4 | Traffic between zones is controlled by firewalls, and the default rule denies whatever is not expressly allowed. | BSI NET.3.2; ISO/IEC 27001:2022 Annex A 8.20 | Review the rule sets of the firewalls between internet, user network and data centre and check the default rule. | Rule set extracts, configuration of the default rule |
| 5 | Rules are justified, have owners and are reviewed regularly for necessity; overly broad and unused rules are removed. | BSI NET.3.2 | Select ten rules, check justification and owners and compare with hit counts of recent months. | Rule set with comments, report of the last rule review, hit statistics |
| 6 | Changes to network components and rules go through an approved change procedure and are documented. | ISO/IEC 27001:2022 Annex A 8.32; BSI NET.1.2 | Compare changes to firewall rules of the last six months with the change requests. | Firewall change logs, change requests |
| 7 | Network services, including those provided by service providers, are defined with security features, service levels and management requirements and are monitored. | ISO/IEC 27001:2022 Annex A 8.21 | Read agreements on network services and trace compliance with the security features for two services. | Agreements on network services, performance reports |
| 8 | Remote access is limited to what is necessary, encrypted and secured by multi-factor authentication. | ISO/IEC 27001:2022 Annex A 8.20; § 30(2) no. 10 BSIG | Check the configuration of VPN gateways and remote maintenance access and go through the exceptions. | Configuration extracts, exception list with approval |
| 9 | Management access to network components is secured: separate management networks, individual accounts, no default passwords, unneeded services disabled. | BSI NET.1.2; ISO/IEC 27001:2022 Annex A 8.2 | Select ten network components and check accounts, enabled services and access paths. | Configuration extracts, account list of network components |
| 10 | Wireless networks are secured against unauthorised access and separated from internal networks; guest access has no access to internal systems. | ISO/IEC 27001:2022 Annex A 8.22 | Check the configuration of wireless networks and guest access and evidence the separation with a test. | Configuration extracts, test result |
| 11 | Traffic and network events are monitored, and unusual connections generate alerts that are followed up. | ISO/IEC 27001:2022 Annex A 8.16; BSI NET.1.1 | Check monitoring of the gateways to the internet and between zones and follow up three alerts. | Monitoring configuration, alert list, tickets |
| 12 | The effectiveness of separation is checked regularly through security tests of the networks, and findings are corrected. | NIS2 Directive Art. 21(2)(f) | Review reports of the latest network tests and check whether findings were corrected. | Test reports, action list |
Documents to request
- Network security policy
- Network diagrams and zone model
- Segmentation concept
- Firewall rule set extracts with justifications
- Report of the last rule review
- Firewall change logs and change requests
- Configuration extracts of VPN gateways and network components
- Network test reports
Typical findings
- The network diagram deviates from reality, and connections to providers are not documented.
- User networks can reach management interfaces of servers and network components.
- Firewall rules have not been reviewed for years; very broad rules exist without justification.
- Changes to firewall rules are made without a change request.
- Default accounts or default passwords are active on network components.
- Guest access is not effectively separated from internal networks.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing