What is a cyber security audit?

Last updated: 27 September 2026

A cyber security audit is a structured review of how well your organisation protects its systems and data. It checks your technology, policies and people against good practice, identifies gaps, and gives you a prioritised plan to reduce risk.

What does an audit look at?

• Accounts and access: MFA, admin rights, leavers and shared accounts
• Devices: updates, encryption, antivirus and device management
• Email and Microsoft 365: security settings, anti-phishing and Secure Score
• Network: firewalls, Wi-Fi and remote access
• Backups: whether data can actually be restored
• Policies and training: incident response, acceptable use, AI use and staff awareness

How is it different from a penetration test?

An audit reviews your controls and configuration. A penetration test actively tries to break in to find exploitable weaknesses. Many organisations start with an audit, fix the gaps, then book a pen test. Read how penetration testing fits into a wider security strategy.

How often should you have one?

At least once a year, and whenever something significant changes, such as a move to the cloud, a merger or a security incident. An audit is also a good way to prepare for Cyber Essentials certification.

ABCOM’s cyber security services include practical, plain-English risk assessments for SMEs and charities.