Skip to content
Knowledge base Updated: February 5, 2026

Data storage infrastructure audit: Identify vulnerabilities, optimize performance and security

A regular audit of the data storage infrastructure identifies security gaps, ensuring security and compliance.

Grzegorz Gnych Grzegorz Gnych

In the business world, where data has become the most valuable resource, the infrastructure used to store it acts as a vault - it must be both reliable, efficient and secure. However, in a fast-paced IT environment where the volume of processed information is growing exponentially, maintaining the optimal state of this infrastructure is a growing challenge. This is where auditing - a comprehensive analysis process that identifies vulnerabilities, optimizes performance and strengthens security - enters the scene. Only by regularly and methodically checking the health of your systems can you ensure operational continuity while controlling costs.

This practical guide will take you on a journey through the most important aspects of a storage infrastructure audit - from its fundamental objectives, to its methodology, to its tangible business benefits. You’ll learn how to professionally prepare your organization for an audit, what key areas it should cover, and - most importantly - how to effectively implement post-audit recommendations to maximize the return on your investment in the process.

Shortcuts

What is a data storage infrastructure audit?

Imagine that you have a complex mechanism on which the entire company depends for its functioning, but you are not fully sure that all its components are working optimally and securely. This is precisely the situation that most organizations find themselves in in the context of their data infrastructure. A data storage infrastructure audit is a systematic process of evaluating and analyzing all components of a company’s data collection and management environment. It encompasses not only the physical media and devices, but also the management software, access mechanisms, security policies and operational processes involved in maintaining this infrastructure. The goal of such an audit is to obtain a complete picture of the technical, performance and security status of data storage systems.

Unlike standard technical reviews, a comprehensive audit goes beyond a simple hardware and software inventory. It includes an in-depth analysis of the architecture, assessment of resource efficiency, verification of security mechanisms, and examination of compliance with internal policies and external regulations. The audit provides an objective view of the state of the infrastructure, identifying both its strengths and areas in need of improvement or modernization.

The audit process is typically conducted by experienced professionals who use both automated diagnostic tools and manual configuration analysis. This approach uncovers problems that are impossible to identify using automated scanners alone, providing a comprehensive assessment of the state of the data storage infrastructure. The result of the audit is a detailed report containing not only a description of the problems found, but also specific recommendations for improvements and elimination of the detected threats.

It is worth emphasizing that an audit of data storage infrastructure is not a one-time activity, but should be part of a cyclical process of continuous improvement. Regular audits allow an ongoing assessment of the state of the infrastructure and a quick response to emerging problems before they lead to more serious consequences for the organization. This allows an enterprise to maintain optimal performance, security and reliability of its data storage systems.

📚 Read the complete guide: Backup: Zasada 3-2-1 i najlepsze praktyki backupu

What are the main objectives of conducting a data infrastructure audit?

Now that we know what a data storage infrastructure audit is, let’s consider why organizations choose to conduct one. The goals of such an endeavor are as complex as the infrastructure itself that is being evaluated - from purely technical aspects to strategic business benefits.

The main purpose of conducting a data infrastructure audit is to comprehensively assess the current state of an organization’s information storage environment. This makes it possible to identify potential threats and vulnerabilities before they lead to serious incidents, such as data loss or security breaches. The audit also allows verification that the security measures implemented meet current standards and are effective in the face of an ever-evolving threat landscape.

The second key objective is to optimize the performance and cost efficiency of the data storage infrastructure. By analyzing resource utilization, the audit helps identify inefficient practices, redundant disk space allocations or obsolete components that generate unnecessary costs. This knowledge provides the foundation for rationalizing IT spending and better planning investments in infrastructure expansion, enabling the organization to maximize the return on investment in data storage technologies.

Another important objective is to ensure compliance with legal and industry regulations. In the face of increasing data protection requirements (RODO) and other industry regulations, an infrastructure audit is an essential tool for verifying that an organization is in compliance with all legal requirements related to information storage and processing. This not only helps avoid potential financial penalties, but also builds trust with customers and business partners by demonstrating a responsible approach to data management.

Finally, the audit serves as a basis for strategic planning for the development of data storage infrastructure. By providing a detailed analysis of the current state and forecasts of future needs, the audit enables informed decisions to be made regarding the modernization, expansion or transformation of the IT environment. This is particularly important in the context of rapidly changing business requirements and the ongoing digitization of processes, which is generating ever-increasing volumes of data that require effective management.

Key objectives of the data storage infrastructure audit - summary

✓ Identification of threats and vulnerabilities - detecting potential problems before they lead to incidents

✓ Optimization of productivity and costs - elimination of inefficiencies in the use of resources and rationalization of expenses

✓ Ensuring regulatory compliance - verification of compliance with legal (RODO) and industry requirements

✓ Strategic development planning - providing data to make informed decisions on infrastructure upgrades

How does an audit help identify weaknesses in the data storage system?

Knowing the goals of an audit is just the beginning. The real value of the process is revealed when you look at the specific mechanisms that allow you to discover weaknesses in your data storage infrastructure. It’s a bit like detective work - it requires not only the right tools, but also a specific approach and experience to see what remains invisible to the untrained eye.

A storage infrastructure audit acts like a precision scanner that methodically reviews all components of a system, uncovering its hidden weaknesses. The process begins with a comprehensive inventory of all components - from physical storage media and servers to data networks and management software. Each of these components is analyzed in detail for configuration, performance and potential security vulnerabilities. This holistic approach makes it possible to spot vulnerabilities that would remain invisible with a piecemeal assessment of individual components.

A particularly valuable aspect of auditing is the ability to identify systemic weaknesses arising from interactions between different infrastructure components. Often the problems are not in individual devices or applications, but arise at the interface between different systems and processes. For example, an audit may reveal insufficient data encryption during transfers between storage systems, suboptimal replication configurations or insufficient access control mechanisms at certain levels of the architecture. Such systemic weaknesses are particularly dangerous because they can go unnoticed during standard monitoring procedures, while posing a serious threat to data security and integrity.

An important part of the audit is also an analysis of the operational processes involved in managing the data storage infrastructure. Experienced auditors review procedures for backup, disaster recovery, capacity management or retirement of obsolete systems. It is in these processes that critical weaknesses often hide, which can lead to serious incidents - from data loss to security breaches. An audit identifies gaps in procedures, inconsistencies in their application or the lack of adequate verification mechanisms, providing the organization with concrete guidance for improvement.

The modern approach to auditing data storage infrastructure also includes analyzing resilience to threats through simulated problem scenarios. Auditors can conduct controlled load tests, simulated failures or even secure security breaches to verify the infrastructure’s actual resilience to a variety of threats. Such hands-on testing uncovers vulnerabilities that might go unnoticed when analyzing only documentation and configuration. This provides the organization not only with a theoretical assessment of potential threats, but also with practical confirmation of the actual state of security and performance of its data storage infrastructure.

How often should you audit your data infrastructure?

Once we know the mechanisms for detecting vulnerabilities, it becomes natural to ask about the frequency of audits. Is once a year enough? Or more often? The answer, as is often the case in the IT world, is “it depends”. - and in this case it depends on a number of factors specific to each organization.

The frequency of data storage infrastructure audits should be tailored to the specifics of the organization, the nature of the information stored and the dynamics of change in the IT environment. For most medium and large enterprises, the optimal solution is to conduct a comprehensive audit at least once a year. Such a cycle allows systematic verification of the state of the infrastructure while balancing the costs and benefits of the audit process. The annual audit interval also gives the organization sufficient time to implement recommended improvements before the next round of verification.

However, it should be noted that certain circumstances may warrant an increase in audit frequency or additional audits in selected areas. Such circumstances include significant changes in infrastructure, such as the implementation of new data storage systems, migration to the cloud or a merger with another organization. Also, regulatory changes or the emergence of new types of cybersecurity threats may warrant an additional audit focused on verifying specific aspects of the infrastructure. Organizations operating in sensitive sectors, such as finance or healthcare, often opt for a more rigorous schedule, conducting partial audits every quarter and comprehensive audits every six months.

It’s also worth considering a continuous monitoring approach with periodic, in-depth audits. In this model, the organization deploys sophisticated monitoring tools that continuously collect data on the performance, security and availability of the data storage infrastructure. This information is analyzed regularly, and any anomalies or potential problems are addressed immediately. Periodic, comprehensive audits then serve as an in-depth verification beyond the capabilities of automated monitoring, and as an opportunity to strategically review the entire data storage architecture.

It is also critical to align audit frequency with the life cycle of infrastructure components. Older systems nearing the end of their support period may require more frequent audits due to the increasing risk of failures or security vulnerabilities. Similarly, newer deployments should be audited more frequently initially to ensure that they are operating as expected and not introducing unexpected risks into the environment. A flexible approach to audit scheduling, taking into account both cyclic audits of the entire infrastructure and additional verifications of selected components as needed, allows for optimal risk management with rational use of resources.

What areas does a comprehensive data storage infrastructure audit cover?

Now that we know how often an audit is worthwhile, let’s take a deeper dive into its contents. A comprehensive audit isn’t just a cursory look at servers or disk arrays - it’s an in-depth analysis of the many interrelated areas that together make up a company’s data storage ecosystem. Let’s take a look at the key elements that a professional audit should cover.

A comprehensive audit of data storage infrastructure must cover a number of interrelated areas to provide a complete picture of the state of an organization’s IT environment. A fundamental element is the inventory and evaluation of the physical components of the infrastructure - servers, disk arrays, tape libraries and network devices used for data transfer. Auditors verify not only the technical condition of these devices, but also their configuration, performance, utilization level and compliance with manufacturers’ recommendations. It is also important to analyze the environment for redundancy, which ensures business continuity in the event of failure of individual components.

The second key area is verification of the virtualization layer and storage management software. Auditors analyze the configuration of file systems, databases, storage area networks (storage managers) and virtualization platforms. Special attention is paid to mechanisms for optimizing the use of disk space, such as deduplication, compression and thin provisioning. The audit also includes an assessment of the effectiveness of data lifecycle management processes, including archiving policies, moving data between storage tiers of different performance, and removing redundant information.

Inherent in a comprehensive audit is verification of the security of the data storage infrastructure. This area includes analysis of access control mechanisms, data encryption (both at rest and during transmission), network segmentation and malware protection. Auditors also verify the effectiveness of procedures for detecting and responding to security incidents that could compromise the integrity or confidentiality of stored information. Assessing the physical security of the data centers where the storage systems are located is also an important aspect.

An equally important area is the analysis of operational processes related to infrastructure management. Auditors verify backup and testing procedures, disaster recovery plans, performance monitoring and capacity management processes. Technical documentation, operational instructions and the level of competence of personnel responsible for the administration of data storage systems are also evaluated. The comprehensive audit also considers compliance with the organization’s internal policies and external regulations on data storage and protection, especially in the context of sensitive information and personal data.

Key areas of a comprehensive audit - summary

✓ Physical components - servers, disk arrays, network devices and their configuration

✓ Virtualization layer and software - file systems, databases, virtualization platforms

✓ S ecurity - access control, encryption, network segmentation, incident detection

✓ O perational processes - backups, disaster recovery, capacity management

✓ Regulatory compliance - verification of compliance with regulatory and industry requirements

How does the step-by-step data infrastructure audit process work?

Having identified the areas to be audited, it is useful to understand the actual flow of such a process. A data storage infrastructure audit is not a chaotic check of random items, but a precisely planned sequence of activities. Let’s take a look at what this journey looks like from the first meeting to the final report with recommendations.

The process of auditing a data storage infrastructure begins with a precise definition of the scope and objectives. At this stage, the specific infrastructure elements to be verified, the key questions to be answered by the audit, and the methodology to be used are determined. It is also important to establish a schedule of activities, identify the necessary resources, and define roles and responsibilities both on the part of the audit team and the organization being audited. Proper preparation of this stage is fundamental to the success of the entire process, as it determines its accuracy, completeness and practical value.

The next step is data collection, which is done on multiple levels. Auditors interview key IT staff, analyze available technical documentation, policies and procedures. In parallel, specialized diagnostic tools are used to collect technical data about the configuration, performance and security of storage systems. At this stage, it is crucial to minimize the impact of audit activities on the day-to-day operation of the organization, so many activities are carried out passively or during specific time windows with reduced load on production systems. The collection of comprehensive data lays the foundation for further analysis and conclusions.

After gathering the necessary information, there is an analysis and assessment phase, during which experienced professionals interpret the collected data in the context of industry best practices, vendor recommendations and the specific needs of the organization. The analysis includes the identification of security gaps, inefficiencies in resource utilization, potential threats to business continuity and regulatory non-compliance. Auditors also assess the maturity of infrastructure management processes, the effectiveness of existing controls, and the overall storage system architecture for its adequacy to meet current and future business needs.

The final stage of the process is the development of a report and recommendations. A professional audit report includes not only a detailed description of the problems found, but also practical recommendations for solving them, organized by priority and estimated impact on the organization. An important element is also the presentation of the results to management, during which the key findings are discussed in a way that non-technical people can understand, with the business implications clearly highlighted. The audit is often followed by a follow-up phase, during which the implementation of recommended corrective actions is verified and the organization is supported in interpreting the results and planning improvements. This final step closes the loop of the audit process and provides a bridge to continuous improvement of the data storage infrastructure.

What tools and methodologies are used during an audit?

Every professional knows that the quality of work depends not only on skills, but also on the tools they use. Auditing data storage infrastructure is no exception - it requires sophisticated technical and methodological instrumentation. Let’s take a look at the arsenal at the disposal of experienced auditors to uncover even the most deeply hidden problems in the infrastructure.

A professional storage infrastructure audit relies on a comprehensive set of tools that allow a thorough analysis of various aspects of the IT environment. Of fundamental importance are inventory scanners that automatically detect and catalog all infrastructure components - from physical servers and network devices to virtual machines and containers. These tools provide detailed information about hardware configurations, installed software, network connections and dependencies between systems. Complementing these solutions are specialized performance monitoring tools that collect data on resource utilization, response times, throughput and other key performance indicators for data storage systems.

In the security area, auditors use advanced vulnerability scanners that automatically identify potential software and configuration vulnerabilities. These tools compare the current state of systems with regularly updated databases of known threats, generating alerts on detected problems with their detailed description and potential impact on the organization. Artificial intelligence-based solutions that analyze data access patterns are also playing an increasingly important role, identifying anomalies that may indicate unauthorized activity or attempted security breaches. Complementing these automated tools are specialized scripts and diagnostic programs created by experienced auditors to verify specific aspects of the infrastructure under investigation.

Just as important as the tools are the methodologies used during the audit, which provide a systematic and comprehensive approach to infrastructure assessment. Many professional auditors base their work on internationally recognized standards such as COBIT (Control Objectives for Information and Related Technologies), ITIL (Information Technology Infrastructure Library) or ISO/IEC 27001 for information security. These standards provide a conceptual framework for evaluating various aspects of IT infrastructure management, from planning and implementation to operations and monitoring and decommissioning. Also of particular value are specialized methodologies dedicated to specific areas, such as NIST Special Publication 800-88 for secure data disposal or SNIA (Storage Networking Industry Association) for evaluating the performance and security of storage networks.

Modern approaches to auditing data storage infrastructure are also increasingly using simulation techniques and scenario testing. Auditors conduct controlled tests of resilience to a variety of threats, from hardware failures to denial-of-service attacks to unauthorized access attempts. These tests can be performed in test environments that are faithful copies of production systems or, in certain cases, directly on production infrastructure with appropriate precautions. A complementary approach is threat modeling, which allows the systematic identification of potential attack vectors and the evaluation of the effectiveness of existing security features in the context of specific threat scenarios. The combination of advanced diagnostic tools with structured methodologies and practical testing provides the most complete picture of the state of the data storage infrastructure.

How does an audit help optimize the performance of data storage systems?

Already having a solid foundation of knowledge about the audit process and the tools used, it’s time to look at one of the key benefits it can bring - performance optimization. In a world where speed of access to data can determine competitive advantage, the ability to identify and remove bottlenecks in the infrastructure becomes invaluable. Let’s see how a professional audit can help unlock the full potential of data storage systems.

A storage infrastructure audit provides a comprehensive view of the performance of the entire environment, identifying bottlenecks and inefficiencies that may go unnoticed during day-to-day systems administration. Using specialized diagnostic tools, auditors gather detailed data on response times, throughput, I/O latency and resource utilization at various levels of the infrastructure - from individual disks, controllers and network interfaces to file systems and databases. This in-depth analysis makes it possible to precisely locate components that are limiting the overall performance of the entire environment and are a potential source of problems in the future when the load on the systems increases.

An important aspect of performance optimization is the analysis of data usage patterns, made possible by a professional audit. Auditors examine which data is used frequently and which is used infrequently, identifying opportunities for hierarchical storage management (HSM). This concept involves automatically moving data between layers of storage of varying performance and cost - from fast but expensive SSDs, to traditional HDDs, to cheaper media for long-term archiving. By implementing audit recommendations in this area, an organization can significantly increase overall performance while optimizing costs by providing fast access to the most critical and frequently used data, while storing less frequently used information on less expensive media.

The audit also provides valuable guidance on optimizing the configuration of data storage management software. Experienced auditors verify the settings of file systems, virtual memory managers, caching mechanisms and database parameters to match specific workload and hardware characteristics. Often minor configuration changes, such as adjusting disk block sizes, optimizing caching algorithms or changing database indexing strategies, can yield significant performance improvements without investing in additional hardware. Auditors also provide recommendations for implementing advanced optimization technologies, such as deduplication, compression or automatic load balancing between different storage systems.

The comprehensive audit also includes verification of operational processes that have a direct impact on the performance of the data storage infrastructure. Auditors analyze the scheduling of disk resource-intensive tasks (e.g., backups, analytical processing, defragmentation), identifying opportunities to optimize and better schedule them. They also evaluate the effectiveness of existing performance monitoring and proactive capacity management procedures, suggesting improvements that will allow early detection of potential problems and planning for necessary expansions before critical constraints occur. By implementing these recommendations, an organization can not only improve the current performance of its systems, but also ensure their scalability and flexibility in the face of increasing business demands.

How does an audit support the security of stored data?

Performance is only one side of the coin. In an era of escalating cyber attacks and increasing information protection requirements, data security is becoming an absolute priority. Leakage of sensitive information can cost an organization not only millions in financial penalties, but also - and often more acutely - the loss of trust from customers and business partners. Let’s look at how a professional audit helps identify gaps in data protection before unauthorized parties can exploit them.

An audit of a data storage infrastructure is a fundamental tool in identifying potential security vulnerabilities that could lead to a breach of the confidentiality, integrity or availability of an organization’s critical information. Professional auditors conduct a comprehensive analysis of access control mechanisms, verifying the correct implementation of the principle of least privilege, privilege segmentation and the process of managing privileged accounts. Special attention is paid to identifying so-called hidden access paths - unauthorized paths that a potential attacker could use to bypass standard security measures. The systematic approach makes it possible to detect subtle problems that might go unnoticed during routine security checks.

An important element of the audit is verification of the effectiveness of data encryption mechanisms, both at rest and during transmission. Auditors evaluate not only the implementation of encryption itself, but also the adequacy of the chosen algorithms and key lengths to the nature of the stored information, the correctness of cryptographic key management and integration with the organization’s overall security strategy. It is particularly important to identify potential places where data may remain unencrypted (e.g., temporary files, exchange areas, backups), which could be a gap in the overall security system. The audit also helps assess the organization’s preparedness for future challenges, such as the threats posed by the development of quantum computing, which could undermine the security of current cryptographic methods.

The comprehensive audit also includes an assessment of the resilience of the data storage infrastructure to a variety of threats, from denial of service (DoS) attacks to malware to advanced persistent threats (APTs). Auditors verify the effectiveness of implemented protection solutions, such as intrusion detection and prevention systems, antivirus software, ransomware protection mechanisms and user activity monitoring systems. Assessing security incident response procedures for their completeness, effectiveness and timeliness is also a valuable component. A well-designed audit can also include controlled penetration testing, which securely verifies the actual resilience of systems against attempts to compromise their security.

No less important is the analysis of the physical security of the data storage infrastructure. Auditors evaluate safeguards against unauthorized access to server rooms, protection against environmental hazards (fire, flooding, electrical surges), as well as access control procedures for personnel and subcontractors. Special attention is also given to secure media decommissioning procedures to ensure that information is not inadvertently disclosed when equipment is disposed of or transferred. A comprehensive assessment of these aspects, coupled with recommendations on detected vulnerabilities, allows the organization to systematically strengthen the protection of stored data and minimize the risk of serious security incidents that could lead to data loss, business interruption or significant legal and reputational consequences.

Key security aspects verified during the audit - summary

✓ Access control - privilege management, segmentation, privileged accounts

✓ Data encryption - at rest and during transmission, key management

✓ Protection against threats - intrusion detection systems, protection against malware

✓ Incident response - procedures, responsibilities, testing

✓ Physical security - access control, environmental protection, safe disposal

What are the most common problems detected during a data infrastructure audit?

One of the most frequently detected problems during storage infrastructure audits is inefficient capacity management, which manifests itself through both over-allocation of resources and critically low levels of free space on key systems. Auditors regularly identify unused or inefficiently utilized storage space, often resulting from administrators’ conservative approach to allocating resources to applications and databases. At the same time, they find systems operating at the limit of their capacity, increasing the risk of downtime and data loss. The problem often stems from a lack of systematic monitoring of data growth trends and proactive capacity planning, leading to a reactive, often panicky approach to infrastructure expansion that generates additional costs and operational risks.

Another common problem is inadequate backup and recovery configurations that call into question the ability to actually restore operations in the event of a major disaster. Auditors often discover that the backup schedules adopted are not aligned with the business requirements for restore point (RPO) and restore time (RTO) for critical systems. The lack of regular testing of recovery procedures is also a problem, leaving the organization unsure whether it will actually be able to restore its environment in a crisis situation. Auditors also identify cases where backups are stored in the same location as production data or on the same systems, undermining their value as a safeguard against major failures or disasters.

A significant problem area regularly detected during audits is gaps in the security management of data storage infrastructure. Auditors identify out-of-date software with known vulnerabilities, improperly configured access controls (often too permissive or inconsistent between different systems), and a lack of segmentation that could limit the spread of threats in the infrastructure. Also problematic is unencrypted sensitive data, both at rest and during transmission, which poses a serious risk in the event of a security breach. Auditors also often discover inadequate security monitoring and event logging, which makes it difficult to detect potential breaches and limits post-incident investigative analysis.

A fourth common problem area is the lack of or outdated technical documentation and operating procedures related to data storage infrastructure. Auditors often identify discrepancies between the actual state of systems and their documentation, which hinders effective management and introduces the risk of errors during changes or troubleshooting. Particularly problematic is often the lack of up-to-date architecture diagrams, a list of dependencies between systems or documentation of security configurations. Outdated or incomplete operational procedures, such as disaster recovery manuals or security incident response protocols, further increase operational risk. The problem is often exacerbated by inadequate knowledge transfer within IT teams, leading to situations where critical knowledge of data storage systems is only available to a small group of people or, in extreme cases, has been lost with the departure of key employees.

How to effectively monitor and analyze the performance of data storage systems?

Effective performance monitoring of data storage systems requires a multi-layered approach that encompasses both the physical infrastructure and the virtualization and application layers. The foundation is a comprehensive monitoring system that collects data from a variety of sources - from hardware sensors in servers and disk arrays, to operating system and hypervisor statistics, to application and database metrics. Collecting both performance metrics (IOPS, throughput, latency) and resource utilization information (capacity, memory usage, CPU load) is key. Modern monitoring solutions allow aggregation of this data in a central system, enabling holistic performance analysis of the entire storage environment.

However, simply collecting data is not enough - proper analysis and interpretation is equally important. A professional approach is based on defining key performance indicators (KPIs) tailored to the specific needs of the organization and the characteristics of its systems. These indicators should reflect the real impact of infrastructure performance on business operations, such as by correlating I/O latency with transaction or order processing times. Long-term trend analysis is also valuable for identifying incremental changes in performance and forecasting future infrastructure expansion needs. Advanced analytics systems use machine learning techniques to detect anomalies and identify potential problems before they become noticeable to end users.

Effective performance monitoring cannot be an isolated activity - it should be integrated into the overall IT infrastructure management process. It is critical to define alarm thresholds for monitored parameters and clear escalation procedures if they are exceeded. It is equally important to link performance monitoring to the change management process so that performance fluctuations can be correlated with modifications made to the environment. It is also a valuable practice to regularly review historical data during change planning to better predict the potential impact of new deployments on the performance of the overall environment. This integrated approach enables proactive performance management rather than reactive responses to reported problems.

It is also worth highlighting the role of data visualization in effective performance monitoring. Well-designed dashboards, presenting key metrics in an accessible way, allow a quick assessment of the state of the infrastructure and identification of areas requiring attention. Interactive analytical tools that allow drill-down from general indicators to detailed metrics of individual components are particularly valuable. Equally important is the customization of visualizations for different audiences - from technical dashboards for administrators, focusing on detailed parameters, to business summaries for executives, showing the impact of infrastructure performance on key organizational processes. This differentiated approach to data presentation ensures that information about the performance of storage systems is accessible and understandable to all stakeholders, fostering informed decisions about infrastructure optimization and development.

What is the importance of auditing for compliance with regulatory and industry requirements?

Auditing data storage infrastructure is a key element in ensuring an organization’s compliance with a growing number of information protection regulations. Of particular importance in the European context is the General Data Protection Regulation (GDPR), which imposes a number of obligations on organizations related to the processing of personal data, including the requirement to provide adequate technical and organizational safeguards. A professional audit provides an objective assessment of whether the data storage infrastructure meets these requirements, identifying potential areas of non-compliance and providing recommendations for necessary improvements. Auditors verify both the technical aspects of data protection (encryption, access control, pseudonymization) and operational processes (consent management, procedures for handling data subject requests, breach reporting mechanisms).

For organizations operating in specific regulated sectors, such as finance, health care or energy, auditing the data storage infrastructure is particularly important to meet specific industry requirements. For example, financial institutions must ensure compliance with regulations such as the FSA-D, which sets out detailed requirements for information security, business continuity and risk management. Similarly, medical entities are subject to stringent patient data protection regulations that impose specific requirements on systems that store medical records. An audit allows for systematic verification of infrastructure compliance with these regulations, which is crucial not only to avoid potential penalties, but also to maintain necessary certifications and operating licenses.

The documentary value of an audit in terms of demonstrating due diligence in the management of data and IT infrastructure is also an important aspect. In the case of security incidents or regulatory proceedings, the ability to present the results of independent audits and evidence of the implementation of recommended corrective actions can make a significant difference in assessing an organization’s accountability. Systematic audits create a historical record of the evolution of data storage infrastructure and related controls, making it possible to demonstrate continuous improvement of processes and security mechanisms. This is particularly valuable in the context of regulations that require not only compliance with certain technical standards, but also the demonstration of a proactive approach to managing data processing risks.

It’s also worth noting that auditing a data storage infrastructure provides an organization with the knowledge necessary to consciously manage the risks associated with regulatory and industry requirements. Rather than a reactive approach of complying with regulations only after a supervisory review or incident, an audit enables potential non-compliance to be identified and proactively addressed before it becomes a source of problems. This allows for strategic planning of infrastructure investments, where upgrades and improvements are prioritized not only based on operational or performance benefits, but also taking into account regulatory compliance requirements. This integrated approach to infrastructure and compliance risk management ensures that the organization optimally allocates resources while minimizing exposure to potential legal consequences from regulatory non-compliance.

How does an audit help in infrastructure development planning?

A data storage infrastructure audit provides a valuable, objective assessment of the current state of systems, which lays the foundation for strategic development planning. Instead of relying on subjective opinions or incomplete operational data, the organization gets a comprehensive picture of resource utilization, performance, security and potential problems in the current infrastructure. This information makes it possible to identify specific constraints that may be impeding business growth, and areas that require urgent upgrades due to the impending end of technical support or increasing risk of failure. The audit also makes it possible to assess the adequacy of the current architecture to meet the organization’s future needs, taking into account projected data growth, changing usage patterns and new business requirements.

A particularly valuable element of an audit in the context of development planning is trend analysis and forecasting future needs. Experienced auditors not only assess the current state of the infrastructure, but also analyze historical data on the growth of information storage, changes in load characteristics and the evolution of operational requirements. On this basis, it is possible to develop realistic forecasts of future needs for the capacity, performance and functionality of data storage systems. These forecasts, combined with an analysis of current technical constraints, provide a solid basis for developing a multi-year infrastructure development plan, taking into account both the expansion of existing systems and potential migrations to new technologies or platforms.

The audit also provides valuable insights into the optimal architecture of future solutions. By analyzing data usage patterns, auditors identify potential application areas for new technologies, such as persistent memory, software-defined storage, or hybrid solutions combining on-premises infrastructure with cloud services. It is equally important to assess the potential benefits of implementing advanced functionality, such as automatic load balancing, real-time data deduplication and compression, or machine learning-based security. Audit recommendations often also take into account operational aspects, identifying opportunities to optimize infrastructure management processes through automation, implementation of capacity management tools or better integration with existing monitoring systems.

Providing a rationale for investment decisions is also an important aspect of the support that an audit offers in development planning. A detailed audit report, documenting current constraints, operational risks and projected needs, provides a strong argument in discussions with management about budget allocation for IT infrastructure development. An objective assessment of the technical and performance status of systems, combined with an analysis of the business implications of the identified problems, makes it possible to convincingly justify the need for specific investments. This is particularly valuable in organizations where IT departments are competing for limited financial resources with other business initiatives. The audit also helps prioritize various modernization projects, identifying which elements of the data storage infrastructure require the most urgent attention due to critical business continuity, data security or regulatory compliance.

How do you prepare your organization for a data infrastructure audit?

“The best time to prepare for an audit is… before it starts” - this paraphrase of a well-known saying perfectly captures the essence of an effective approach to verifying data storage infrastructure. An audit is not surveillance or a witch hunt, but a partnership process, the success of which largely depends on proper preparation of the organization. So how do you plan and organize to maximize the potential of this process?

Effective organization preparation begins with a precise definition of the scope and objectives of the audit. It is crucial to determine which elements of the infrastructure will be reviewed - from physical hardware components, to virtualization systems and management software, to operational processes and documentation. It is equally important to establish specific audit objectives, such as assessing security, optimizing performance or ensuring regulatory compliance. This initial definition of the audit framework should be the result of a dialogue between the various stakeholders - the IT team, business management and, in the case of an external audit, the audit firm. Clearly communicating the goals and scope of the audit to all parties involved minimizes misunderstandings and ensures that the process will deliver the expected results.

Another key step is to gather and organize technical documentation and operating procedures related to the data storage infrastructure. Auditors will need access to architecture diagrams, hardware specifications, configuration documentation, security policies, backup and recovery procedures and many other documents. Reviewing and updating this documentation prior to the audit will not only streamline the process itself, but may also reveal gaps and inconsistencies that the organization can address proactively. It’s also a good idea to prepare a summary of known issues and planned improvements, which will allow auditors to better understand the context and evolution of the infrastructure and demonstrate the organization’s awareness of existing limitations.

Ensuring adequate human and technical resources is also an important aspect of preparation. It is important to identify key personnel who will work with the auditors, making sure that they have not only the necessary technical expertise, but also the time to support the audit process. For external audits, it is a good idea to appoint a coordinator who will be the main point of contact for the audit team, responsible for organizing meetings, accessing systems and documentation, and coordinating activities between different departments. On the technical side, it may be necessary to prepare dedicated access accounts for the auditors, with appropriately limited permissions, and provide access to monitoring and reporting tools that will provide the necessary data on infrastructure performance and utilization.

The final piece of preparation is to conduct an internal review to identify and address obvious problems before the actual audit begins. This initial self-assessment may include a review of compliance with internal policies and procedures, verification that software and security patches are up-to-date, checking access levels and segmentation, or analyzing system logs for potential irregularities. While the purpose of such internal verification is not to replace a professional audit, it can significantly improve its effectiveness by eliminating underlying issues that would take up auditors’ time and attention. What’s more, a proactive approach to identifying and addressing known problems prior to an audit demonstrates an organization’s commitment to continuous improvement of its data storage infrastructure, which can positively impact its overall operational maturity rating.

How to effectively prepare for an audit - summary

✓ Define the scope and objectives - define precisely what will be audited and what results you expect.

✓ Prepare documentation - gather and update technical documentation, procedures and policies

✓ Provide resources - identify key employees and prepare the necessary tools

✓ Conduct a self-assessment - identify and address key issues before the actual audit

✓ Communicate objectives - ensure that everyone involved understands the value and process of the audit.

What are the business benefits of regular infrastructure auditing?

“How much does an infrastructure audit cost?” - is a question often asked by decision-makers in organizations. The real question, however, should be: “How much does it cost not to have regular audits?”. System failures, data loss, security breaches or suboptimal use of resources generate costs many times greater than the investment in systematic infrastructure verification. Let’s take a look at the tangible business benefits of regularly auditing your data storage environment.

Regular auditing of data storage infrastructure directly translates into increased reliability of IT systems, which is fundamental to the operational continuity of modern organizations. By systematically identifying potential weaknesses in architecture, configuration or management processes, auditing enables the elimination of risk factors before they lead to major failures or data loss. This proactive optimization of reliability translates into increased system availability, reduced unplanned downtime and minimized incidents affecting organizational productivity. In a business environment where every minute of unavailability of critical systems can generate significant financial and reputational losses, the value of this operational stability is difficult to overestimate.

The second key business benefit is the optimization of costs associated with data storage infrastructure. The audit identifies areas of inefficient resource utilization, such as over-allocated disk space, sub-optimal configurations or unused premium functionality. At the same time, it provides recommendations for architecture rationalization, better alignment of solutions with actual business needs, and potential savings through system consolidation or implementation of optimization technologies. It is worth noting that the financial benefits are not limited to direct reductions in hardware and software expenditures - equally important are the savings resulting from preventing costly failures, minimizing the risk of data loss and optimizing operational processes related to IT infrastructure management.

A regular audit also provides valuable information to support strategic business decisions on digital transformation and investment in new technologies. An objective assessment of the current state of the infrastructure, combined with trend analysis and forecasting of future needs, allows informed planning of the development of the IT environment in line with the direction of the organization’s evolution. The audit makes it possible to identify technological limitations that could inhibit the implementation of new business initiatives, and identifies areas where investments in infrastructure modernization will bring the greatest value to the organization. This is particularly important in the context of a rapidly changing technology landscape, where decisions to adopt new solutions - from cloud computing to edge computing to advanced analytics - require a deep understanding of the current capabilities and limitations of the data storage infrastructure.

Not the least of the business benefits is the minimization of information security and regulatory compliance risks. In an era of growing cyber security threats and increasingly stringent data protection regulations, auditing provides a mechanism for systematically verifying the adequacy of technical and procedural safeguards. Identifying and addressing potential security vulnerabilities before they are exploited by attackers can protect an organization from serious financial, legal and reputational consequences associated with security breaches. Similarly, proactively ensuring compliance with regulations such as RODO or industry requirements minimizes the risk of administrative fines, loss of certification or negative impact on relationships with customers and business partners. In this context, the cost of regular audits should be viewed as an investment in a mechanism that insures the organization against the potentially devastating consequences of security incidents or regulatory non-compliance.

How to implement post-audit recommendations in an organization?

Even the best audit will remain a mere theoretical exercise if the resulting recommendations are not effectively implemented. It is at this stage - the implementation of change - that the actual benefits of the entire process are decided. Too many organizations fall victim to the “report to the shelf syndrome,” where valuable tips and recommendations gather dust instead of translating into real infrastructure improvements. How to avoid this scenario and effectively implement the needed changes?

Successful implementation of post-audit recommendations begins with their in-depth analysis and prioritization. Rather than treating the audit report as a simple checklist of tasks to be completed, the organization should systematically evaluate each recommendation in terms of its potential impact on security, productivity, regulatory compliance and overall business objectives. This prioritization should take into account both the criticality of the identified weaknesses and the practicalities of implementing the recommended changes - from the resources required, to the potential operational risks, to the estimated implementation time. The result of this process should be a detailed corrective action plan, with clearly defined priorities, responsibilities, milestones and success indicators for each recommendation.

A key success factor in implementing post-audit recommendations is ensuring adequate sponsorship and support from the organization’s leadership. The team responsible for implementing the changes should be able to clearly communicate the business value of the proposed improvements, going beyond technical jargon and focusing on the benefits of risk reduction, cost optimization or increased operational flexibility. In many cases, a valuable approach is to segment recommendations into quick wins (quick wins), which can be implemented with minimal expense and disruption, and strategic projects requiring significant investment and organizational change. This stratification allows demonstration of concrete results in the short term, which builds momentum and support for more complex long-term initiatives.

Implementation of post-audit recommendations should be treated as a formal project or program, with appropriate management, progress reporting and quality control. For each corrective action, define specific results that will demonstrate successful implementation, and plan a process to verify these results. In the case of complex changes, a phased implementation is a valuable approach, with defined checkpoints to evaluate the results to date and potentially adjust the plan. Special attention should be paid to managing the risks associated with implementing changes in a production environment - from in-depth testing in non-production environments, to preparing plans to roll back changes in case of problems, to minimizing the impact on current business operations.

Communication and education are also an important element in the successful implementation of post-audit recommendations. Changes in data storage infrastructure often require adjustments to operational procedures and sometimes to modify end-user behavior. Therefore, it is crucial to ensure adequate communication at all levels of the organization - from detailed technical instructions for IT teams, to guidance for employees on new security policies, to high-level information for management on progress in eliminating risks identified during the audit. It is equally important to document implemented changes and update existing technical documentation to reflect the current state of the infrastructure after implementation of recommendations. Such systematic documentation not only supports ongoing management of the environment, but also establishes a solid foundation for future audits, enabling demonstration of progress and continuous improvement of the data storage infrastructure.

How does the audit support the backup and recovery process?

A data storage infrastructure audit provides a comprehensive assessment of the efficiency and reliability of backup processes, identifying potential gaps that could jeopardize the recoverability of critical information. Experienced auditors verify not only the technical aspects of backup implementation, such as software configuration, backup schedules or storage methods, but also the compliance of these solutions with business requirements for data protection. Particular attention is paid to verifying that defined recovery points (RPOs) and recovery times (RTOs) are actually achievable using the implemented tools and procedures. The audit also identifies data that may not be included in the backup process due to configuration errors, infrastructure changes or outdated backup policies, which is one of the biggest threats to the organization’s business continuity.

A key element that auditing brings to the backup management process is verification of data recovery testing and validation procedures. Auditors assess whether the organization regularly conducts recovery tests on different types of data and systems, simulating a variety of failure scenarios, from the loss of individual files, to an entire system failure, to a disaster affecting the entire data center. It is particularly important to verify that these tests are carried out in a systematic and documented manner, providing measurable indicators of the effectiveness of recovery processes. Audit often reveals that organizations, despite having advanced backup solutions, fail to conduct comprehensive recovery tests or limit them to the simplest scenarios, creating a false sense of security. Audit recommendations in this area focus on implementing a rigorous testing program that regularly verifies the actual recoverability of all critical data and applications.

The audit also provides valuable insights into optimizing backup architecture and strategy in the context of the evolution of an organization’s IT infrastructure. Auditors analyze whether current backup solutions are adequate for the changing technology environment - from increasing virtualization, to the adoption of cloud solutions, to new types of applications and databases. This analysis identifies areas where traditional backup approaches may be insufficient or ineffective, and recommends modern solutions better suited to current challenges. For example, the audit may point to the need to implement dedicated tools for backing up virtual environments, solutions that enable consistent backups of distributed databases, or integration of backup processes with cloud platforms. Equally important are recommendations for optimizing the use of available resources, such as the implementation of data deduplication and compression, which can significantly reduce the capacity and time requirements of the backup process.

Security and protection of the backups themselves from threats such as ransomware or unauthorized access is also an important aspect that the audit looks at. Auditors verify that backups are adequately secured, both physically and logically, and that the organization implements the principle of separation of access control between production systems and backup infrastructure. Of particular value are recommendations for implementing immutable backup solutions, which ensure that once created, a copy cannot be modified or deleted for a specified period of time, providing effective protection against advanced ransomware attacks. The audit also verifies procedures for managing backup media, from marking and tracking them, to secure transportation, to access control measures at storage locations. A comprehensive assessment of these aspects provides an organization with a complete picture of the security of its backup system and allows it to implement targeted improvements that enhance resilience against a variety of threats.

How do you measure the effectiveness of the changes made after an audit?

Measuring the effectiveness of changes implemented following a data storage infrastructure audit requires a systematic approach based on specific, measurable indicators. The starting point should be the establishment of a so-called baseline for key parameters before implementing recommendations, which will enable subsequent quantification of the improvements achieved. Depending on the nature of the changes made, measurement may include a variety of performance indicators, such as system response times, I/O throughput, data access latency or resource utilization (CPU, memory, disk space). Reliability metrics such as mean time between failures (MTBF), mean time to repair (MTTR) or system availability expressed as a percentage of uptime can be equally important. Systematic monitoring of these parameters before and after implementing changes provides quantifiable evidence of the effectiveness of corrective actions taken.

Assessing the effectiveness of changes resulting from an audit should not be limited to technical parameters alone - equally important is their impact on broader business and operational metrics. In this context, a valuable approach is to analyze such metrics as the execution time of key business processes that depend on data access, the number and severity of storage infrastructure incidents, the operational costs of maintaining systems, or the efficiency of using human resources dedicated to environment administration. Particularly important is the correlation between technical improvements and the actual impact on the organization’s operations - for example, whether optimizing the performance of database systems actually translates into faster transaction processing and a better end-user experience. Such a business perspective helps communicate the value of implemented changes to non-technical stakeholders and justify IT infrastructure investments.

Measuring the effectiveness of implemented changes should also include aspects related to risk management and regulatory compliance. In this area, indicators such as the number of identified security vulnerabilities (before and after implementation of recommendations), the level of compliance with internal policies and external regulations, the time it takes to detect and address new threats, or the effectiveness of data access control mechanisms may be key. It can be particularly valuable to evaluate the effectiveness of changes by conducting controlled penetration tests or disaster recovery simulations, which allow practical verification that the implemented safeguards actually do their job in real-life scenarios. Such verification provides not only measurable indicators of effectiveness, but also valuable lessons for potential further improvements.

A comprehensive approach to measuring the effectiveness of post-audit changes should also include long-term monitoring of trends and the evolution of key indicators over time. Rather than a one-time assessment immediately after implementing changes, an organization should implement continuous monitoring mechanisms to track the long-term effects of improvements and identify new areas of concern. It is also particularly valuable to compare the results with industry benchmarks or best practices, which provides a broader context for evaluating the effectiveness of the changes implemented. In an ideal scenario, measuring the effectiveness of post-audit changes should seamlessly transition into a continuous process of improving the data storage infrastructure, where regular monitoring of key metrics provides the foundation for identifying new opportunities for optimization and addressing evolving challenges in managing the organization’s data.

How to measure the effectiveness of post-audit changes - summary

✓ Technical indicators - performance, reliability, safety, resource utilization

✓ Business metrics - process improvements, incident reduction, cost optimization

✓ Compliance aspects - eliminating vulnerabilities, meeting regulatory requirements

✓ Long-term monitoring - track trends, compare with benchmarks

✓ Practical testing - security verification, disaster recovery simulations

What are the key performance indicators (KPIs) in a data infrastructure audit?

Key performance indicators (KPIs) in a data storage infrastructure audit can be divided into several main categories, which together provide a comprehensive picture of the state of the environment. The first group is comprised of system performance and efficiency KPIs, which measure how effectively the infrastructure handles data operations. These include metrics such as IOPS (number of input/output operations per second), throughput (throughput) measured in MB/s, latency (response time) for various data operations, or access time for certain types of information. Also important within this category are resource efficiency metrics, such as the ratio of allocated capacity to actual capacity used (storage utilization ratio), the level of disk space fragmentation or the effectiveness of data deduplication and compression mechanisms. These KPIs help identify potential inefficiencies and bottlenecks in the infrastructure that can affect the overall performance of systems dependent on data access.

The second key category is security and data integrity KPIs, which verify how effectively the infrastructure protects stored information from unauthorized access, loss or corruption. These include indicators such as the number of detected security vulnerabilities in infrastructure components, the effectiveness of access control mechanisms (measured, for example, through penetration testing), the completeness of encryption of sensitive data, or the time to detect and respond to potential security incidents. Data integrity metrics are also important, such as the frequency and completeness of validation of stored information, the effectiveness of disk error prevention mechanisms (e.g., RAID, erasure coding) or the percentage of successful data recovery operations from backups. These KPIs provide information about potential security vulnerabilities in the storage infrastructure that could lead to data breaches or loss.

The third major group is KPIs related to infrastructure availability and resilience, which measure how effectively data storage systems support the organization’s operational continuity. Key metrics in this category include systems availability (uptime), expressed as a percentage of time that systems operate without failure, mean time between failures (MTBF), which measures the reliability of infrastructure components, and mean time to repair (MTTR), which reflects the effectiveness of disaster recovery processes. Equally important are indicators of backup efficiency, such as the percentage of successful backup operations, the time required for full or incremental backups of specific systems, or the backup data compression ratio. Disaster recovery plan (DRP) KPIs, such as actual recovery time (RTA) versus assumed recovery time (RTO) or actual restore point (RPA) versus assumed restore point (RPO), are also key in the context of business continuity.

The last, but equally important, category is cost- and resource-related KPIs, which allow assessing the economic efficiency of data storage infrastructure. These include metrics such as total cost of ownership (TCO) per TB of data, operating cost associated with infrastructure management, or capital efficiency (CAPEX vs. OPEX) in infrastructure purchases. Also important are metrics related to capacity management efficiency, such as the expected time to exhaust available space with current growth trends, the percentage of unused or inefficiently allocated disk space, or the cost of storing different categories of data (critical vs. archival). These KPIs help identify areas of potential savings and optimize investments in data storage infrastructure, ensuring that the organization receives maximum business value from the resources invested. A comprehensive analysis of all these categories of KPIs provides a complete picture of the state of the data storage infrastructure and provides a solid basis for decisions on its optimization and development.

How does an audit help optimize data storage costs?

At the end of our journey through the world of data infrastructure auditing, let’s look at the aspect that often appeals most to decision makers - cost optimization. At a time when IT budgets are under constant pressure, and at the same time data storage requirements are constantly increasing, the ability to do “more with less” is becoming a key success factor. How can a professional audit help achieve this goal?

A data storage infrastructure audit provides a comprehensive picture of current expenses and identifies areas of potential savings that may remain invisible in the day-to-day management of an IT environment. Experienced auditors analyze the cost structure associated with the infrastructure, taking into account both direct expenses for hardware and software, as well as indirect costs such as energy consumption, cooling, data center space and administrative team effort. This holistic perspective makes it possible to identify hidden costs and assess the true economic efficiency of individual components and systems. Particularly valuable is the analysis of total cost of ownership (TCO) per unit of stored data, which allows an objective comparison of different solutions and identification of the least economically efficient ones.

One of the key areas of cost optimization that auditing helps identify is inefficient use of disk resources. Auditors systematically analyze space allocation in storage systems, identifying areas such as over-allocated resources that are never used, duplicate data, unnecessarily stored temporary files, or historical data that could be archived on less expensive media. This analysis often reveals that organizations can reclaim a significant amount of disk space (sometimes 20-30%) without any impact on the functionality of systems, resulting in direct savings in the purchase of additional capacity. Auditors also provide recommendations for implementing optimization technologies such as deduplication, compression and thin provisioning, which can significantly increase the efficient use of existing resources.

A data storage infrastructure audit also provides valuable insights into optimizing information storage architecture and strategies. Experienced auditors analyze data usage patterns, identifying opportunities to apply hierarchical storage management (HSM) and information lifecycle policies (ILM). These concepts are based on automatically moving data between storage layers of varying cost and performance, depending on its business value, access frequency and performance requirements. For example, data that is frequently used and critical to current operations can be stored on high-speed but expensive SSDs, while historical or infrequently used information can be automatically moved to less expensive media such as traditional HDDs or even tape systems for long-term archiving. This tiered approach can result in significant savings compared to storing all data on the same class of media.

An important aspect of cost optimization that the audit helps address is also rationalizing the purchasing strategy and lifecycle management of infrastructure components. Auditors review current service contracts, software licenses and hardware refresh schedules, identifying optimization opportunities such as consolidating services, renegotiating licenses or extending the life cycle of selected components. At the same time, they identify components that are obsolete or energy inefficient and whose replacement can yield long-term savings despite the initial investment. Particularly valuable is the analysis of the possibility of using new infrastructure delivery models, such as storage as a service (STaaS), hybrid solutions combining on-premises infrastructure with the cloud, or consumption-based models. These modern approaches can offer greater financial flexibility, better alignment of costs with actual needs, and a reduction in capital expenditures in favor of predictable operating expenses, which is particularly important in a rapidly changing business environment.

Learn key terms related to this article in our cybersecurity glossary:

Learn More

Explore related articles in our knowledge base:

Explore Our Services

Need cybersecurity support? Check out:

Tags:

Cybersecurity Vulnerabilities Storage

Share:

Talk to an expert

Have questions about this topic? Get in touch with our specialist.

Sales Representative
Grzegorz Gnych

Grzegorz Gnych

Sales Representative

+48 664 003 003grzegorz.gnych@nflo.pl
Response within 24 hours
Free consultation
Individual approach

Providing your phone number will speed up contact.

Want to Reduce IT Risk and Costs?

Book a free consultation - we respond within 24h

Response in 24h Free quote No obligations
Book a Call +48 22 487 86 36

Or download free guide:

Download NIS2 Checklist