AutoQ content pack
Network Administration Review
This review assesses whether the controls used to design, administer, protect and monitor the organization's network are designed well and operating as intended.
The pack is a complete control questionnaire, ready to run on AutoQ Standalone or Enterprise Version 3.1 alongside your other reviews, with its own installer. Your team answers each control and records the evidence it inspected, and AutoQ writes the statement of fact, risk, effect and recommendation for every answer, rates each domain and produces the reports.
High-risk controls are those where a failure most directly lets an attacker into the network or takes it offline.
Who it's for
- IT auditors and internal audit teams
- Network and infrastructure managers
- Managed service providers reviewing their own practice
- Security consultants
When to use it
- A review of how the network is designed, administered and monitored
- A check after a network change or a new site
- An assessment of a managed network provider
What it covers
Governance and Architecture
20 controls, 5 of them high risk
High-risk focus: supported equipment, a zoned network architecture, approved and recorded changes, controlled third-party connections, and independent testing of the perimeter.
Examples of the controls:
- Network devices are supported by their manufacturer and receive security updates; devices nearing end of support have a replacement plan.
- The network is designed in documented zones of different trust, such as internet-facing services, servers, staff devices, guests and management, with defined rules for traffic between them.
- A network security policy defines how the network is designed, managed, protected and monitored, is approved by management and is reviewed at least annually.
Administrative Access
20 controls, 12 of them high risk
High-risk focus: no default credentials, individual and multi-factor administrator accounts, management interfaces restricted to a management network, encrypted management protocols, access reviews, prompt removal of leavers, protected credentials, controlled vendor access, and logged and reviewed administrative activity.
Examples of the controls:
- Default passwords on every network device are changed before the device is connected, and default accounts are removed or disabled where possible.
- Network administrators sign in to devices with individual named accounts, not shared ones, so every action can be traced to a person.
- Administrator sign-ins to network devices are authenticated centrally, for example through RADIUS or TACACS+, with a local emergency account kept sealed.
Perimeter and Segmentation
20 controls, 9 of them high risk
High-risk focus: deny-by-default firewalls, documented and reviewed port forwarding and firewall rules, segmentation, a separate zone for internet-facing services, multi-factor remote access, no remote desktop or database ports on the internet, monthly external scans, and administrative pages restricted to approved networks.
Examples of the controls:
- Every internet connection passes through a firewall that denies all incoming traffic not explicitly allowed.
- Each port opened or forwarded from the internet is documented with its purpose, destination and owner, and the list is reviewed at least quarterly against the router and firewall configuration.
- Every firewall rule records its purpose, requester, approver and review date.
Device and Service Security
20 controls, 6 of them high risk
High-risk focus: timely firmware updates, hardened device configurations, internal vulnerability scanning, configuration backups, secure corporate wireless, and secure DNS management.
Examples of the controls:
- Firmware on routers, firewalls, switches and access points is updated within defined times after security releases, with critical updates within 14 days.
- Network devices are configured to the secure configuration standard, with unneeded services such as Universal Plug and Play, remote management from the internet and discovery protocols on untrusted ports switched off.
- Security advisories from the manufacturers of the network equipment in use are monitored, and each relevant advisory is assessed and acted on.
Monitoring, Resilience and Recovery
20 controls, 5 of them high risk
High-risk focus: central logging, alerting on important network events, weekly log review, a tested network recovery plan, and network scenarios in the incident response plan.
Examples of the controls:
- Logs from firewalls, routers, switches, wireless controllers, VPN and DNS are collected centrally.
- Alerts are raised for important network events, such as configuration changes, administrator sign-ins from unexpected places, repeated failed sign-ins, intrusion detections and device outages.
- Network logs are kept for at least 90 days online and longer in archive where required, and are protected from change.
Frameworks
Every control carries references to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and CIS Controls v8.1, so findings can be tied to the criteria your audit uses.
Criteria references mapped from NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and CIS Critical Security Controls v8.1 (safeguard numbers). Verify against the editions your audit uses.
What's in the workbook
| Control Library | Every control with its domain and subdomain, the control assertion, type, nature, frequency and risk weight, the framework references, the suggested test procedure, the evidence to request, the statements of fact if true and if false, the effect if false and the recommendation. |
|---|---|
| Questionnaire | The working sheet the review team answers, control by control, with the evidence they inspected; AutoQ fills in the findings from the answers. |
| Domain Summary | The rating of each domain, weighted by risk, ready for the report. |
| Column Guide | What every column means and how it is used. |
| Sources | The framework editions the references were mapped from, with a column for the reviewer to record the date each reference was checked. |
Delivered with its own installer, which adds it to AutoQ as a new review (or as a .zip to add on the Admin tab). The questionnaire is an Excel workbook, so it can be adapted with your own controls and ratings.
The framework references were mapped from the published texts and should be checked by a qualified reviewer against the editions your audit uses. The pack supports a review; it does not replace professional judgement or the requirements of your regulator.