The Complete Security Audit Checklist for Houston Businesses in 2026
Introduction
When was the last time someone systematically reviewed every layer of your IT security? Not a quick glance at the antivirus dashboard — a genuine, methodical audit of your network perimeter, identity controls, endpoint protection, email security, backup integrity, and compliance posture?
For most Houston businesses, the honest answer is "never" or "we're not sure." Security tools get deployed and then left on autopilot. Configurations drift. New systems get added without the same controls as existing ones. Employees leave and their accounts linger. The result is an environment that looks protected on the surface but has gaps an attacker can find in minutes.
This checklist covers every category a thorough security audit should examine. Use it as a self-assessment framework or share it with your MSP to ensure nothing is missed.
1. Network Perimeter Security
- Firewall firmware is current (patched within 30 days of critical CVE disclosure)
- No unnecessary ports open to the internet (verify with external scan from Shodan or Censys)
- RDP (port 3389) is NOT directly exposed to the internet
- VPN appliance is patched and running current firmware
- Default admin credentials on all network devices have been changed
- Guest WiFi is isolated from corporate network (separate VLAN, no route to internal resources)
- Network segmentation exists between departments, servers, and IoT/OT devices
- DNS filtering is enabled to block known malicious domains
- Intrusion detection/prevention (IDS/IPS) is active and monitored
2. Identity & Access Management
- MFA is enforced on ALL accounts — no exceptions, no exemptions
- Phishing-resistant MFA (FIDO2/passkeys) on admin and finance accounts
- Legacy authentication protocols (SMTP AUTH, POP3, IMAP basic auth) are blocked
- Admin accounts are separate from daily-use accounts
- No shared accounts or shared passwords in use
- Former employee accounts disabled within 24 hours of departure
- Service accounts inventoried with password rotation schedule
- Conditional Access policies block sign-ins from high-risk countries
- Password policy enforces minimum 14 characters (length over complexity)
- Privileged Identity Management (PIM) enabled for admin roles
3. Endpoint Protection
- EDR (not just antivirus) deployed on every endpoint — workstations, laptops, servers
- EDR alerts are monitored 24/7 (by internal team or MDR service)
- OS patching within 14 days for standard updates, 72 hours for critical CVEs
- Third-party application patching (browsers, Java, Adobe, etc.) is automated
- Application allowlisting deployed (ThreatLocker, WDAC, or equivalent)
- USB/removable media access is controlled and logged
- Full-disk encryption (BitLocker) enabled on all laptops
- Local admin rights removed from standard users
4. Email Security
- SPF record configured correctly for your domain
- DKIM signing enabled for outbound email
- DMARC policy at
p=reject(notp=none) - Advanced anti-phishing with impersonation protection enabled
- Safe Links and Safe Attachments enabled (Defender for Office 365)
- Inbox rules audited for unauthorized forwarding to external addresses
- External email banner warning enabled ("This message is from outside your organization")
- Email retention and archiving meets regulatory requirements
5. Backup & Disaster Recovery
- 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite
- At least one backup is offline or immutable (cannot be encrypted by ransomware)
- Backup credentials are separate from production credentials
- Full restore test completed in the last 90 days (not just backup verification — actual restore)
- RTO and RPO are documented for every critical system
- Backup monitoring alerts on failures within 1 hour
- Disaster recovery plan documented and tested annually
6. Data Protection
- Sensitive data locations identified and classified (PII, PHI, financial, CUI)
- Data Loss Prevention (DLP) policies active for email, Teams, SharePoint
- SharePoint/OneDrive external sharing restricted (not "Anyone with the link")
- Encryption at rest enabled for databases and file storage
- Encryption in transit enforced (TLS 1.2+ for all services)
- No sensitive data stored in email, chat, or unsecured spreadsheets
7. Security Monitoring & Incident Response
- Security logs centralized in SIEM or log management platform
- Audit logging enabled in Microsoft 365 (with extended retention)
- Alerting configured for: admin account logins, new inbox rules, MFA bypass, impossible travel
- Incident response plan documented and reviewed in last 12 months
- Ransomware-specific playbook exists with decision criteria and contacts
- Dark web monitoring active for domain credential exposure
- Tabletop exercise conducted in last 12 months
8. Compliance
- Applicable compliance frameworks identified (HIPAA, PCI-DSS, SOC 2, CMMC, ITAR)
- Last compliance assessment or audit date documented
- Employee security awareness training conducted in last 12 months
- Phishing simulation conducted in last 6 months with results documented
- Vendor/third-party security assessment process exists for critical suppliers
- Cyber insurance policy reviewed and current
- Cyber insurance application answers match actual controls (no misrepresentations)
How to Use This Checklist
Score each item as: Implemented, Partially Implemented, or Not Implemented. Any item marked Critical that is Not Implemented is an immediate action item. The checklist should be reviewed quarterly by your IT lead or MSP, with findings tracked in a remediation plan.
Request a professional security audit. LayerLogix conducts comprehensive security audits for Houston businesses — we'll go through every item on this checklist, plus the items specific to your industry and compliance requirements. Call 713-571-2390.
Related: Security Assessment Services | Vulnerability Assessment | Compliance Hub | M365 Hardening Checklist
Need Help With Cybersecurity?
LayerLogix provides expert cybersecurity solutions for businesses across Houston and nationwide.
Related Articles
Need Expert IT Support?
Let our team help your Houston business with enterprise-grade IT services and cybersecurity solutions.