Menu
01Home02Online Presence03Cyber Security04Pricing05Contact06About us
EN / DE
Start Project
IT security audit

Which controls work — and where the gaps are.

We review access, network, endpoints, and safeguards together and deliver status, evidence, owner, and a clear action sequence. For decisions, not the archive.

Request scope meeting CASP overview →
AccessIAMRoles and privileged paths become concrete.
ExposureNetworkWhich paths are actually open.
DeliveryOwnerEvery finding: status, evidence, next step.
Pricingby scopeIn a scope meeting by breadth and depth.
Outcomes

Not a checklist — an operations picture.

Every relevant area: current status, evidence, owner, and the action that reduces risk fastest.

Network

Exposed paths become traceable.

Firewall, VPN, admin, and service paths checked for unnecessary attack surface.

Clearer network and access boundaries
Endpoints

Clients and servers as operational risk.

Patch posture, hardening, protection software, and managed devices assessed.

Less blind endpoint surface
Safeguards

Present and missing clearly separated.

MFA, backup, logging, EDR, and response paths reviewed against actual need.

A realistic protection plan
Audit focus

Identities, network, endpoints, and safeguards — together.

Many gaps do not live in one tool. They appear between roles, network paths, devices, and missing measures. The audit shows where those layers no longer line up.

Control reviewEvidence

Operational, not formal. We connect technical review with which systems are reachable, which endpoints are managed, which safeguards are missing — and who acts under pressure. Often useful after CASP, when the outside-in picture is clear and focus moves to internal controls.

Access, roles, and admin paths Network, exposure, and segmentation Endpoints, hardening, and missing safeguards
AssetsSystems, applications, network segments, endpoints, admin surfaces, identity providers, and integrations.
ControlsIdentity, MFA, roles, firewall/VPN, patch, EDR/AV, backup, logging, hardening, and secrets.
EvidenceScreenshots, config excerpts, samples, device and network view per control area.
What we do not do
Access & rolesNetworkEndpointsSafeguard gaps

Not a certification audit

Technical and operational evidence — no formal certification.

Not legal advice

Compliance references interpreted technically, not legally.

No generic checklist

Findings prioritized and tied to your setup.

Not a CASP or pentest substitute

The audit reviews controls and operations. CASP clarifies outside-in; the pentest validates actively in approved scope.

Situation picture · action plan · owner
Review areas

What the audit actually makes visible.

Security decisions that must work repeatedly in operations: who may access what, what is exposed, which devices are protected, which measures are missing.

Access & roles

Accounts, roles, admin paths, MFA, approvals, and privileged actions in daily work.

Network & exposure

Segments, firewall/VPN paths, reachable services, and unnecessary attack surface.

Endpoints & hardening

Clients, servers, patch posture, baselines, device management, and protection software.

Safeguards

Present and missing measures: MFA, backup, logging, EDR, monitoring, response.

Deliverables

Four artifacts. Status, evidence, owner, plan.

Not a best-practice PDF. A package management and IT can use to prioritize, budget, and deliver.

01

Control map

Reviewed areas: access, network, endpoints, safeguards — with status, evidence, owner, and gap.

StatusEvidenceOwner
02

Risk register

Prioritized findings: cause, impact, affected systems, missing measure, target state.

CauseImpactTarget state
03

Executive decision brief

Management-ready: key risks, budget questions, and next decisions.

ManagementBudgetDecision
04

Remediation roadmap

Quick wins, hardening, missing safeguards, owners, and follow-up.

Quick winsOwnerFollow-up
Process

Four steps to an action plan.

Lean, not shallow: understand, review, prioritize, decide.

  1. 01

    Scope & inventory

    Capture systems, roles, network paths, endpoints, operating paths, and review goals.

  2. 02

    Review technology

    Assess access, network, endpoints, backup, logging, hardening, and protection software.

  3. 03

    Order gaps

    Prioritize by impact, exposure, missing control, and effort.

  4. 04

    Set measures

    Concrete next actions for roles, network, endpoints, and missing safeguards.

Next step

Ready for an IT security audit?

We start with scope and review goal. Price and depth follow breadth — often useful after CASP, when the outside-in picture is already clear.

Scope first, action after.
Request scope meeting CASP overview
Clarify controls & scopeNext step
Request scope meeting