Sans offers tips for IT audit survival

Third-party security audits need not be a nightmare

Enterprise IT managers need not dread third-party security audits, according to researchers at security firm Sans, which has published a list of tips to help IT departments get through audits with minimal headaches.

Companies are urged not to panic prior to an audit, to be prepared and to have possible questions answered in advance. Sans also recommended that administrators keep copies of security training materials and IT security policies handy.

Other tips include paying careful attention to logging, and keeping an untouched workstation on hand for the auditors to browse.

Most important, however, is maintaining the right attitude, according to Sans handler Mari Nichols. IT departments should approach audits not as a dreaded chore, but as a learning experience and a chance to beef up security protection.

"Playing these situations to your fullest abilities will not only increase the profitability of your business, it will result in a tightened down security posture for your company," she said.

"This may be the straw that increases security in your environment. You may even get your pet project going again after frustrating funding delays."