Question 1

What is a cyber security audit?

Accepted Answer

A cyber security audit is a comprehensive review of your organisation's security controls, policies, and technical configuration against an established security framework (such as Cyber Essentials, NCSC Cyber Assessment Framework, or ISO 27001). Unlike a vulnerability scan (which is automated), a cyber security audit includes manual review of policies, procedures, access controls, and configuration — as well as technical scanning. The output is a findings report with risk ratings and a prioritised remediation plan.

Question 2

What does a cyber security audit cover?

Accepted Answer

Coreitech's cyber security audit covers: (1) Access control & identity (MFA, admin privileges, Entra ID/AD); (2) Endpoint security (EDR, patching, encryption, device management); (3) Email security (DMARC, SPF, DKIM, anti-phishing); (4) Network & firewall (rules, segmentation, remote access, Wi-Fi); (5) Patch management (OS & application patch status); (6) Backup & disaster recovery (configuration & restore testing); (7) People & process (policies, training, incident response); (8) Cloud & Microsoft 365 (Conditional Access, Intune, SharePoint, Defender).

Question 3

How much does a cyber security audit cost?

Accepted Answer

Coreitech's cyber security audit starts from £2,500+VAT for small businesses (up to 50 users). Pricing scales with environment size and scope. The audit includes technical scanning, manual review, policy assessment, findings report with risk ratings, and a prioritised remediation roadmap. We also offer cyber security audit packages aligned to Cyber Essentials v3.3 (from £1,500 all-in including certification) for businesses seeking to combine audit with certification.

Question 4

How is a cyber security audit different from a vulnerability assessment?

Accepted Answer

A vulnerability assessment focuses on technical weaknesses — software vulnerabilities, misconfigurations, open ports. A cyber security audit is broader: it covers technical controls plus policies, procedures, people practices, access governance, and compliance gaps. A cyber security audit answers "how secure are we overall?"; a vulnerability assessment answers "what technical weaknesses can attackers exploit?". Most businesses benefit from both — an audit sets the strategic baseline, and vulnerability assessments provide ongoing technical monitoring.

Question 5

Do you provide a cyber security audit report?

Accepted Answer

Yes. Every Coreitech cyber security audit delivers a comprehensive findings report including: executive summary (written for board/senior management); findings list with risk ratings (Critical/High/Medium/Low) and CVSS scores; root cause analysis for each finding; prioritised remediation recommendations; and a security roadmap. The report is designed to be understood by both technical and non-technical stakeholders.

Question 6

Can a cyber security audit help with compliance?

Accepted Answer

Yes — Coreitech's cyber security audit is aligned to multiple frameworks: Cyber Essentials v3.3, NCSC Cyber Assessment Framework (CAF), ISO 27001, GDPR Article 32, and FCA cyber resilience requirements. The audit findings map directly to these framework requirements, identifying gaps and providing evidence of due diligence. For businesses pursuing Cyber Essentials certification, our audit serves as the gap analysis phase.

CYBER SECURITY
AUDIT

What our cyber security audit covers

Access Control & Identity

Endpoint Security

Email Security

Network & Firewall

Patch Management

Backup & Disaster Recovery

People & Process

Cloud & Microsoft 365