IT Infrastructure Audit

What is an IT infrastructure audit?

An IT infrastructure audit is a structured review of everything your company runs on: from the server room and the network, through Active Directory accounts and backups, to licences and cloud services. First we record what is actually in use, then we assess the condition of each area, and finally we put together a list of actions in an order that makes sense for your budget and risk. Such a review also brings order to IT asset management: you know what you have, who is responsible for it and when vendor support expires.

Attribute	Description
Subject	The company’s IT infrastructure: hardware, software, licences, network, servers, cloud
Areas	Inventory, network, servers and virtualization, Active Directory, backup, workstations, cloud and Microsoft 365, documentation
Result	Report with priorities, remediation plan and presentation of results

When to commission an IT infrastructure audit

IT infrastructure is rarely built according to a single design. It grows over the years: new servers, branches, cloud services and licences are added, and documentation does not keep up. An audit is worth commissioning when:

• you do not have an up-to-date inventory of hardware, software and licences, or documentation that describes the environment,
• you are planning a modernization or an IT budget for the coming years and want to base it on facts — we write about planning a modernization in the guide how to optimize IT infrastructure for small and medium-sized businesses,
• the administrator who built the environment has left, or you are changing your IT service provider,
• you are preparing to move systems to the cloud and want to know what to migrate and what to switch off,
• you are acquiring another company or merging companies,
• you are preparing for a security audit and first want to know exactly what is to be audited.

What we check — eight areas

The audit price covers eight areas. We assess each one based on data from administrative consoles, documentation and conversations with the people who maintain the infrastructure.

• Hardware, software and licence inventory: what is in use, in which version and whether the vendor still supports it. We also check which licences are expiring or unused.
• LAN, WAN and Wi-Fi network: network topology, network segmentation, meaning the division into zones, firewall configuration, remote access via VPN, and Wi-Fi coverage and protection.
• Servers and virtualization: the condition and age of servers, virtualization platforms, resource usage and single points of failure, meaning components whose failure stops the company’s work.
• Active Directory: domain structure, privileged accounts and unused accounts. If a deeper analysis is needed — privilege escalation paths, Kerberos, GPO — we recommend the Active Directory Security Audit.
• Backup and recovery: what is covered by backups, where they are stored and whether restores are tested. We check whether the company has defined an RTO, meaning the time within which a system must be back up and running, and an RPO, meaning how much data the company can afford to lose, measured as the time since the last backup. Implementing and maintaining backups is the job of the Backup and Disaster Recovery service.
• Workstations and updates: operating system versions, systems no longer supported by the vendor and the way updates reach computers.
• Cloud and Microsoft 365: which cloud services the company uses and how the Microsoft 365 tenant connects to the on-premises infrastructure. An in-depth assessment of the tenant is provided by the Microsoft 365 and Entra ID Security Review.
• Documentation: whether documentation exists, whether it is up to date and whether it allows the environment to be rebuilt without the person who built it.

Audit after an acquisition or merger

When you acquire a company or merge with another, you take over IT infrastructure that your team did not build and does not know. Before you connect networks and systems, it is worth knowing exactly what you are taking over. In this kind of audit we focus on three things:

• Inventory — hardware, software, licences and cloud services of the acquired company, including what is expiring and what is no longer supported by the vendor.
• Technical debt — outdated hardware and systems, gaps in documentation, temporary solutions that became permanent, and knowledge held by a single person.
• Integration risks — connecting networks (addressing, firewalls, links between locations), trust relationships between Active Directory domains and privileged accounts, licence terms after a change of ownership, and backups of the acquired systems.

The result is an integration plan: what can be connected right away, what should be fixed or isolated first, and in what order.

Report and remediation plan

The audit ends with a document your team can start working with right away, not a list of general recommendations. In the report you receive:

• an inventory of hardware, software and licences with information on vendor support,
• an assessment of each of the eight areas, describing what works and what needs to change,
• a list of risks with priorities, so it is clear what is urgent and what can wait,
• a remediation plan with the order of actions,
• an indication of the areas where a specialist in-depth audit is worth commissioning,
• a presentation of the results for your IT team and management.

How the infrastructure audit differs from other nFlo audits

Service	What it focuses on
IT Infrastructure Audit	a full picture of the infrastructure: inventory, technical condition and remediation plan
Security Audits	the state of safeguards, processes, policies and compliance with standards (ISO 27001, NIS2, GDPR)
IT System and Infrastructure Configuration Review	configuration of servers, networks and devices against CIS Benchmarks, with hardening recommendations
IT Security Architecture Analysis	cybersecurity architecture: network segmentation, access control, Defense in Depth and Zero Trust
Active Directory Security Audit	configuration, permissions and privilege escalation paths in Active Directory
Public Sector IT Security Audit	verification of the security of public entities’ ICT systems under the Polish KRI regulation

The IT infrastructure audit is often the first step: when it points to an area that needs a deeper look, we recommend one of the specialist audits from the table.

Audit price and scope

Attribute	Value
Price	from €4,700 net
Scope included	up to about 100 workstations, 1 location
Larger environments	quote after agreeing the scope
Result	report with priorities, remediation plan and presentation of results

Several locations, more workstations or additional systems are quoted after agreeing the scope. Contact us to agree the scope and date of the audit.

Who is this for?

This service is for you if:

• you manage IT in a company that has grown faster than the documentation of its infrastructure,
• you are taking over an environment from a previous administrator or IT service provider,
• you are preparing a modernization budget and want to know where to start,
• you are acquiring another company or merging companies and need to connect their infrastructure,
• you want to know whether your backups would let you restore the company after a failure.

Related Glossary Terms

Learn more about the key concepts related to this service:

• IT Infrastructure Audit
• IT Infrastructure
• IT Asset Management
• Active Directory
• RTO
• Disaster Recovery
• Network Segmentation
• Virtualization