Skip to content
enhanced.ioMSP Security Audit
Partner inquiry
Sold only through managed service providers. Partner pricing on request. ← Back to enhanced.io

Guide

What a Baseline Security Audit checks

The baseline review covers 50 controls across endpoints, identity, email, backup, network access, logging, and tool hygiene. It is a configuration review, and it changes nothing.

Last updated 21 October 2026

Endpoints and EDR

  1. An endpoint agent is deployed on the devices in scope
  2. Prevention is switched on, rather than left in a detect-only or audit mode
  3. Tamper protection is enabled
  4. The asset list and the protected-device list are compared for gaps
  5. Local administrator rights are reviewed
  6. Disk encryption is enabled on in-scope devices
  7. Removable-media handling is defined
  8. Unsupported operating systems are flagged

Identity and MFA

  1. MFA is required for users on the identity provider
  2. Privileged accounts use MFA, and break-glass accounts are not used day to day
  3. Legacy authentication is blocked
  4. A conditional access or equivalent sign-in policy exists
  5. Guest and external accounts are reviewed
  6. Stale accounts are disabled
  7. The number of global administrators is limited
  8. Password policy, including a banned-password list where the platform supports it

Email security

  1. SPF is published
  2. DKIM is signing outbound mail
  3. DMARC is in place, with a policy and reporting
  4. External sender marking is on
  5. Mailbox forwarding and inbox rules are reviewed
  6. Link and attachment protection is enabled
  7. Access to shared mailboxes is reviewed

Backup and recovery

  1. Endpoints and servers in scope are included in backup
  2. Mail and files in Microsoft 365, or the equivalent platform, are protected
  3. Identity configuration is backed up where the platform allows it
  4. An immutable or otherwise isolated copy exists
  5. A restore has been tested inside an agreed interval
  6. Backup administration is separated from day-to-day administration

Firewall and remote access

  1. Edge firewall configuration is reviewed
  2. Management ports exposed to the internet are identified
  3. Remote access (VPN or zero-trust access) and who can use it
  4. MFA on remote access
  5. Guest and corporate wireless are separated
  6. Site-to-site and vendor access is reviewed
  7. Firewall logging is enabled
  8. End-of-support network devices are flagged

Logging

  1. Sign-in logs are retained
  2. Endpoint alerts are retained
  3. Firewall or network logs are retained
  4. There is a named place where alerts are sent
  5. Time is synchronised across log sources
  6. Critical systems that do not log are listed as gaps

RMM and tool hygiene

  1. RMM roles, including who can run scripts, are reviewed
  2. MFA is required on the RMM and related admin portals
  3. A local administrator password solution, or an equivalent control, is in use
  4. Operating-system patch compliance is measured
  5. Third-party application patching is measured
  6. Security tools that are installed or billed but unused are identified
  7. Each security tool has a named owner