The Network Security Audit Checklist Every Engineer Needs in 2026

🔒 Firewall Audit Checklist

• ☐ Review every rule with "any" in source, destination, or service — each one needs justification or removal
• ☐ Identify and remove shadow rules (rules that never match because a broader rule above catches traffic first)
• ☐ Verify deny-all default policy on every interface (implicit deny isn't enough — make it explicit and logged)
• ☐ Check for rules permitting inbound ICMP broadly — restrict to specific types (echo-reply, unreachable, TTL-exceeded)
• ☐ Audit management access rules — SSH/HTTPS to firewall should be restricted to jump host IPs only
• ☐ Verify logging is enabled on permit AND deny rules (most only log denies — you need permits too for forensics)
• ☐ Check for expired temporary rules — correlate rule comments/dates with current business need
• ☐ Validate IPS/IDS signatures are updated within the last 7 days
• ☐ Confirm SSL/TLS decryption policy covers non-standard ports (attackers rarely use port 443)
• ☐ Review NAT rules for overly broad translations that expose internal addressing

🏗️ Segmentation Checklist

• ☐ Verify separate VLANs/VRFs for: user traffic, server/data center, management, IoT/OT, guest, voice
• ☐ Confirm inter-VLAN routing is filtered by ACL or firewall — not just Layer 3 switched freely
• ☐ Validate PCI cardholder data environment (CDE) is fully segmented with documented data flows
• ☐ Check that management interfaces (iLO, CIMC, iDRAC, IPMI) are on an isolated management network
• ☐ Verify IoT/OT devices cannot reach the internet directly — proxy through inspection point
• ☐ Confirm jump hosts are the only path into server/management segments
• ☐ Audit east-west traffic policies — do server VLANs need to talk to each other? Prove it.
• ☐ Validate micro-segmentation policies if using VMware NSX, Cisco ACI, or cloud security groups

🔑 Access Control Checklist

• ☐ All network devices authenticate via TACACS+ or RADIUS — no local-only authentication
• ☐ Local fallback accounts exist but use Type 8 or Type 9 password hashing (not Type 5 or Type 7)
• ☐ Verify TACACS+/RADIUS servers use encrypted transport (IPsec, TLS, or dedicated management VLAN)
• ☐ Audit user accounts — remove departed employees, contractors, and dormant accounts (>90 days inactive)
• ☐ Confirm MFA is required for all network device access (at minimum for privileged/enable mode)
• ☐ Verify SSH v2 only — Telnet should be completely disabled, not just "not configured"
• ☐ Check console port security — auto-logout timer, authentication required, physical access logged
• ☐ Review privilege levels — not everyone needs level 15. Use role-based access control (RBAC)
• ☐ Audit API access — REST API tokens, NETCONF/RESTCONF credentials should follow same MFA/rotation policies

🔐 Encryption & Protocol Checklist

• ☐ SNMP v3 with AuthPriv — v1/v2c should be completely removed, not just unused
• ☐ Syslog over TLS (RFC 5425) or sent to collector on management VLAN — never across user networks in cleartext
• ☐ NTP authentication enabled — unauthenticated NTP is a time-spoofing attack vector
• ☐ DNS over encrypted transport where supported — at minimum, restrict DNS resolution to known internal servers
• ☐ HTTPS only for all web management interfaces — verify TLS 1.2 minimum, prefer TLS 1.3
• ☐ Routing protocol authentication: OSPF MD5/SHA (or IPsec for OSPFv3), BGP MD5 or TCP-AO on all peerings
• ☐ HSRP/VRRP authentication enabled — unauthenticated first-hop redundancy = trivial MITM
• ☐ VPN tunnels using IKEv2 with AES-256-GCM and DH Group 20+ — phase out IKEv1 and 3DES
• ☐ 802.1X/MAB/NAC deployed on all access ports — no open ports, period

📊 Logging & Monitoring Checklist

• ☐ All network devices send logs to centralized SIEM — no exceptions, including switches, APs, and load balancers
• ☐ Log retention meets compliance requirements (PCI: 1 year, HIPAA: 6 years, SOX: 7 years)
• ☐ Failed login attempts trigger alerts after 3-5 failures within a time window
• ☐ Configuration changes generate immediate alerts — who changed what, when, from which IP
• ☐ NetFlow/sFlow/IPFIX enabled on core and distribution switches for traffic analysis
• ☐ Verify NTP sync across all devices — log timestamps are useless if clocks are drifting
• ☐ DNS query logging enabled — DNS is the most common C2 exfiltration channel
• ☐ Verify SNMP trap destinations are reachable and actively monitored
• ☐ Test incident response runbook quarterly — can your team isolate a compromised VLAN in under 10 minutes?
• ☐ Validate backup configs are stored encrypted and tested for restore within the last 30 days

📡 Wireless Checklist

• ☐ WPA3-Enterprise (802.1X/EAP-TLS) on all corporate SSIDs — WPA2-Personal has no place in enterprise
• ☐ Guest SSID fully isolated — separate VLAN, captive portal, bandwidth throttled, no access to internal resources
• ☐ Rogue AP detection enabled and alerting to SOC — wired-side port security (802.1X) as backstop
• ☐ Management access to WLC/APs restricted to management VLAN — not accessible from user wireless
• ☐ WIDS/WIPS enabled — detecting deauth attacks, evil twin APs, and client impersonation
• ☐ Verify RF power levels aren't bleeding significantly beyond building perimeter