Independent IT infrastructure audit: what it examines in six domains and what it finds

What an IT infrastructure audit includes

An independent IT infrastructure audit, also called an infrastructure assessment, records what a company runs, compares it with how the systems are used and ranks the gaps it finds by risk. Our audit looks at six domains: compute and virtualisation, storage and backup, networks, security and access, licences and contracts, and compliance, which is optional and scoped separately. It ends with four documents: an inventory, a prioritised risk map, an ROI/TCO financial model and a roadmap. The work is done from the documentation and exports you provide and from interviews with your team, without access to your production systems and without changes to them.

The word independent has a concrete meaning here. The audit is priced and delivered independently of any purchase, as a product of its own. Its financial model compares scenarios of different vendors in money and puts the option of changing nothing beside them. The roadmap belongs to you: you can carry it out with us, on your own or with another contractor.

IT audit checklist by domain, with an example finding for each

the column "what is examined" follows the scope table of our Infrastructure Audit & Strategy page (site build of 12 November 2026); the findings are general examples, and no statistics stand behind them.

The scope is fixed in the contract, with all six domains or only some of them. The third column gives examples of the kind of finding an audit can show. They are illustrations in general terms, and we publish no figures on how frequent each one is.

Our audit covers these domains with scope and price fixed in writing before the start; tell us which domains you want reviewed and how many sites and hosts are involved, and our reply reaches you within one business day.

Compute, storage and backup, measured against what was bought

In compute and virtualisation the audit compares what was bought and allocated with what is used: servers, hypervisors, clusters and their actual resource usage, to see where there is excess and where a shortage. It can show hosts that were sized for a load which has since shrunk or moved, and virtual machines with far more processors and memory than they use. It can also show the reverse: a cluster so full that the remaining hosts could not take over the load of one failed host. The version list belongs here too, because every release has a support end date. Broadcom's KB 459135, read on 12 November 2026, gives 11 October 2027 as the end of general support for vSphere 8, for example.

For a vSphere estate the individual checks are laid out in our articles on what a VMware health check covers and on right-sizing oversized VMs. A health check stays inside one platform and compares it with the rules of its vendor. The audit crosses the domains and ends in a financial model and a roadmap.

In storage and backup the audit asks whether the copies can be restored and whether they are kept as long as the owners of the data expect. It typically checks which systems are in a backup job, when a restore of each critical system was last tested and how long that restore took. A finding it can show is a long row of job reports without errors next to no record that the largest database was ever restored. Two public documents put the expectation into words. CIS Control 11, "Data Recovery", speaks of what is "sufficient to restore in-scope enterprise assets to a pre-incident and trusted state." NIST's Cybersecurity Framework 2.0 has the subcategory PR.DS-11: "Backups of data are created, protected, maintained, and tested". Why a completed job says little about recovery time is the subject of backup is not disaster recovery, and what has changed for the backup of vSphere estates is in backup for VMware after Broadcom.

Single points of failure in networks, access and logging

For networks the audit reads topology, segmentation, throughput, bottlenecks and fault tolerance from diagrams, configuration exports and the interviews. A finding it can show is a single point of failure: one core switch, one firewall or one uplink that several systems depend on and that has no second path. Another is a network without segmentation, in which every server can reach every other. Our guide to network segmentation describes the zones a mid-size company starts with.

Security and access covers privileged access, MFA, perimeter protection and event logging. Here an audit can show administrator accounts that several people share, service accounts with more rights than their task needs, remote access that works with a password alone, or logs that exist only on the system that wrote them. The audit works without access to production systems, so this part is a review of configuration and practice from exports and interviews. A penetration test is a separate piece of work. The measures behind such findings are described in our guides to privileged access management and phishing-resistant MFA.

Licences, contracts and the optional compliance analysis

Licences and contracts are examined as editions and subscriptions, renewal dates and alignment with actual usage. An audit can show an edition that is paid for features no cluster uses, a licensed quantity that differs from the hardware in the racks, or a renewal date that only one person knows. The licence metric decides how the comparison is made. Broadcom's KB 313548, for example, sets a minimum of 16 licensed cores per CPU for VMware, so a processor with fewer cores still counts as 16. An inventory of this kind is a different thing from a vendor's licence verification, which follows from the contract; what Broadcom's agreement provides for is in our article on the Broadcom VMware licence audit.

The compliance analysis is not part of the default scope. If you order it, it is scoped separately and shows the gap between the current state and NIS2, industry standards or the requirements of insurers and customers, as a list of gaps with priorities for closing them. The result is technical information. The legal reading of a directive and of its national transposition stays with your legal advisers. The measures NIS2 lists are summarised in our NIS2 Article 21 checklist.

What the interviews add to the exports

Exports show what is configured, and the reasons are missing from them. Where systems were built by different people over the years, documentation may not exist and dependencies may be unknown. The interviews bring out what no file contains: a scheduled job on a server that is due to be switched off, an application that stops when a forgotten licence server is offline, a firewall rule whose author has left the company. Each such dependency becomes an entry in the inventory, together with the systems it connects. Interviews are scheduled around the calendar of your team.

Public frameworks that cover the same ground

Our service page names no framework, and none is needed to order an audit. Public frameworks help for another reason: a finding that can be read against a published control is easier to explain to management, an insurer or a customer. The table lists what the documents themselves say, as read on 12 November 2026.

CIS Controls list (v8.1); NIST CSWP 29, "The NIST Cybersecurity Framework (CSF) 2.0"; ISO's page on ISO/IEC 27001 and the catalogue abstract of the standard; ISACA's COBIT page; PeopleCert's ITIL certification page; BSI-Standard 200-2 "IT-Grundschutz-Methodik" (15 November 2017) and the BSI's online course on IT-Grundschutz; all read 12 November 2026.

Three of these documents start where an audit starts, with knowing what is there. The CIS Controls open with two inventory controls. NIST's category for asset management asks that inventories of hardware and of software, services and systems "are maintained". The lesson on structure analysis ("Strukturanalyse") in the BSI's course has sub-steps, among them the recording of applications, the network plan, IT systems and rooms. This is why the first document of an audit is the inventory.

ISO/IEC 27001 is a standard for a management system. ISO states that "certification to ISO/IEC 27001 is possible but not obligatory" and that "ISO does not perform certification." An infrastructure audit of the kind described here ends in the four documents below and issues no certificate.

How findings are ranked by risk and effort

The risk map separates what is critical from what can wait, and each component in the inventory carries an assessment of its state and risk. Two questions order the findings. The first concerns risk: what stops if the finding turns into an event, how long recovery would take and how plausible the trigger is. The second concerns effort: whether the fix is a setting, a purchase or a project with dependencies. The table shows the logic with hypothetical examples.

our illustration of the ranking logic; the examples are hypothetical and not taken from a customer.

Findings with a high risk and a small fix come first, because they remove the most risk for the least work. Large fixes go into the roadmap as steps with stages, dependencies and a budget estimate. Part of the assessment is the question of where the infrastructure already limits the business and what would break first.

The four documents at the end of an audit

• Inventory. A full picture of infrastructure, licences and access: servers, virtualisation, storage, networks, licences, backup and access, each component with a state and risk assessment.
• Risk map. The findings in order of priority: what is critical and what can wait.
• ROI/TCO financial model. The scenarios modernisation, cloud and hybrid, compared in money over a horizon of 3 to 5 years, with the option of changing nothing beside them. It is written for a decision at board level.
• Roadmap. A sequence of steps with stages, dependencies and a budget estimate.

A compliance analysis is added where it was ordered. We present the results and defend the conclusions to your management. How the model and the roadmap turn into a budget request is the subject of our companion article on the IT infrastructure review before a budget cycle. Where a scenario places servers in an external data centre, the building becomes part of the comparison: what a rating says is explained in our article on the Tier 3 data centre, and the questions for an operator in the colocation checklist for GPU servers.

We deliver these four documents for the domains you choose; send us a short description of your estate and the decision you have to prepare, and we suggest which domains belong in the scope.

How the audit runs without access to production systems

The audit has three steps. The first is a conversation, free of charge, in which the task, the scale and the expectations are clarified; scope and price are then fixed in writing before the start. The second is the audit itself. It works from the information you provide and from interviews. No access to your production systems is required, no changes are made to them and no copies of production data are taken. An NDA is signed before technical detail is exchanged, a data processing agreement is available on request, and subprocessors are named in the contract. The third step is the presentation of the report with the risk map, the financial model and the roadmap.

Typical material, as examples:

• an export of hosts, clusters and virtual machines with their versions, and the performance history where it is kept
• backup job reports and any record of restore tests
• network diagrams and exports of switch and firewall configuration
• a list of privileged accounts and of the places where MFA is enforced
• contracts, subscription terms and renewal dates
• existing documentation, however old

Which material is needed follows from the scope. The first step is a message through the form below or to request@eurokommerz.at.

When a narrower review is the better tool

An audit across six domains is more than some questions need. If the question concerns only the configuration of a vSphere estate, a health check of that platform answers it. If one recovery scenario is in doubt, the team can walk through it at one table with our script for a tabletop exercise for IT outages.

There are also two cases in which an audit from us is the wrong thing to order. A report that is needed only for form's sake, without a real assessment, is a document we do not produce. And where the decision has already been made and the audit is expected to confirm it, an independent assessment may come to a different result.

FAQ