Security Audit Checklist

SECURITY AUDIT CHECKLIST

Recitals

WHEREAS, Client Name: , with principal address: (hereinafter "Client");

WHEREAS, Auditor Name: , with principal address: (hereinafter "Auditor");

WHEREAS, the parties desire that Auditor perform a security audit of Client systems and produce findings and recommended remedial actions in accordance with the Scope of Work and terms set forth below.

Scope of Work

Checklist — Controls and Findings

Instructions: For each item below, check the box if the control exists and is operational. Use Status to mark Compliant / Partial / Non-compliant. Use Findings & Corrective Actions to document evidence, risk, and recommended remediation. Assign Responsible and Due Date for follow-up.

Physical Security

Perimeter fencing and controlled facility access   Status:   Risk Level:

Network Security

Firewall configuration and segmentation reviewed   Status:   Risk Level:

Regular vulnerability scanning and remediation tracking   Status:   Risk Level:

Access Control

Account provisioning and least-privilege enforcement   Status:   Risk Level:

Multi-factor authentication on privileged accounts   Status:   Risk Level:

System Configuration & Patch Management

Baseline configuration and hardening applied to systems   Status:   Risk Level:

Patch management process and timeliness for critical vulnerabilities   Status:   Risk Level:

Data Protection

Encryption of data at rest and in transit   Status:   Risk Level:

Logging & Monitoring

Centralized logging, retention, and regular review   Status:   Risk Level:

Incident Response

Incident response plan, roles, and tabletop exercises   Status:   Risk Level:

Third-Party Risk & Compliance

Third-party vendor security assessments and contractual controls   Status:   Risk Level:

Payment Terms

Term and Termination

Commencement Date:   Expiration Date:

Either party may terminate for material breach not cured within the notice period above. Termination does not relieve the Client of payment obligations for services performed through the effective termination date. Upon termination, Auditor will deliver all work in progress and any agreed deliverables; Client will pay outstanding fees within the agreed payment terms.

Confidentiality

Auditor and Client each acknowledge that in performing services they may receive Confidential Information of the other. "Confidential Information" means non-public business, technical, or security information disclosed in any form and labeled or reasonably understood to be confidential. Each party shall: (a) limit disclosure to personnel with a need to know; (b) employ reasonable safeguards no less protective than those it uses for its own similar information; and (c) not use such information except to perform obligations under this agreement. Confidential obligations survive termination for a period of years, except for information required to be retained by law.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in that State for disputes arising under this Agreement.

Entire Agreement

This document, including the Scope of Work and any attachments executed by the parties, constitutes the entire agreement between Client and Auditor with respect to the subject matter hereof and supersedes all prior proposals, understandings, and communications, whether written or oral. Any amendment must be in writing and signed by authorized representatives of both parties.

Audit Summary & Remediation Plan

Sign Now