IT security audit: how it works, what drives the cost and what to expect

An IT security audit answers the question of how a company manages information security. The auditor checks system configurations, procedures and whether people actually follow them. The result is an overall picture with a list of gaps and a risk assessment.

However, different services go by similar names. Before you ask for a proposal, decide which one you need. The table below shows the differences.

A full audit combines three areas. A technical review on its own will show configuration gaps, but will not tell you whether the company knows how to manage them. A document review on its own, in turn, will show rules that may exist only on paper.

Below is the typical scope of each area. In a given audit, some points can be left out if they do not apply to your company.

An audit needs a reference point; otherwise its conclusions are just the auditor’s opinion. It is worth choosing the standard together with the auditor at the start, because the structure of the report depends on it.

The most commonly used standard is ISO/IEC 27001:2022. Its Annex A contains 93 controls in 4 groups: organisational, people, physical and technological. Another popular reference point is the US NIST Cybersecurity Framework, which organises activities by function, such as identify, protect and detect.

For entities covered by the KSC Act, the main reference point is the obligations under the Act. In practice, auditors often combine them with ISO 27001, because the standard helps organise the same topics. If the company is planning certification, it is worth choosing the standard as the main reference point from the outset.

The amendment to the Polish National Cybersecurity System Act has been in force since 3 April 2026. It divides the companies it covers into essential and important entities. Risk management obligations are the same for both groups, but the periodic audit applies only to essential entities.

An essential entity must carry out its first audit by 3 April 2028, and further audits at least once every three years. An important entity has no obligation to carry out periodic audits. However, the supervisory authority may order an audit, e.g. after a serious incident or if it suspects a breach of the rules.

An important detail: the auditor may not be a person who currently looks after your security or did so in the past year. The ban applies to the individual, not the whole firm, but if an external company is helping you implement the Act’s requirements, it is safer to give the statutory audit to a different company. That makes it easier to show the auditor’s independence. A preparatory audit, which shows the gaps before the deadline, can be carried out by any provider you choose. We have listed the key deadlines under the Act below.

An audit of a mid-sized company usually takes a few weeks. Gathering information takes the longest, because it depends on the availability of people on the company side. That is why it is worth booking the interview dates in calendars straight after signing the contract.

Below are four stages that should appear in every proposal. If a proposal leaves one out, ask why.

The report has to serve two groups of readers. The management board needs a short picture of the risks and the decisions to be made, while the IT team needs the details that will let it fix specific settings.

The thickness of a report says nothing about its quality. What matters more is whether each gap has a description, a risk rating and a specific recommendation. These are the elements you should expect.

The price of an audit comes from the number of auditor days, and that depends on the scope. Two companies of the same size can receive very different quotes, because they differ in the number of systems and locations and the state of their documentation.

When comparing proposals, check that they cover the same scope and the same reference standard. A cheaper proposal often leaves out the technical review and relies solely on a questionnaire, which gives a much less reliable picture.

Good preparation shortens the audit and lowers its cost. A few days’ work by the person coordinating the audit on the company side is enough.

Take a hypothetical 150-person manufacturing company whose major retail customer is demanding audit results before renewing its contract. If it gathers the materials below before the first meeting, the auditor can go straight to analysis rather than hunting for documents.

An audit does not force you to implement all the recommendations at once. The management board decides which risks to fix immediately, which in the coming months, and which to accept deliberately. It is worth recording this decision, because during an inspection or after an incident it shows that the company acted intentionally.

The top places in the plan usually go to issues that are simple and cheap but important. These are two-factor authentication for all accounts, limiting administrator rights, tested backups and an incident reporting procedure.

Also decide who will oversee delivery of the plan. In smaller companies this role is often filled by an external part-time security specialist. Without such a person, the remediation plan usually loses momentum after a few weeks.