Chapter 2:
Audit for an infrastructure reality check

You can't protect what you don't know you have.

Before a CISO can introduce change, they must understand what already exists. Most organizations fail from the get-go because they build strategies on assumptions. This chapter provides a systematic approach to understanding the current state across two critical dimensions: technical infrastructure and human capabilities. The goal is to identify what's working, what's misaligned, and where strategic improvements can begin.

Infrastructure review

What does the organization's security environment look like? A thorough review builds visibility across the tech stack, identifies outdated or misconfigured components, and assesses whether the current architecture supports the organization's risk profile and goals. For simplicity, let's split them into three categories: documentation, cloud security, and tools.

Documentation analysis

Begin by collecting all existing documentation and identifying document owners. Mature organizations typically have extensive documentation, but quantity doesn't always equal quality. Security documentation can be cataloged in one of four ways:

• A. Current and actionable — Accurately reflects the environment and provides clear guidance.
• B. Outdated but valuable — Needs updating but contains important historical context.
• C. Compliance-driven but impractical — Exists primarily to meet audit requirements, but doesn't guide actual operations.
• D. Missing critical elements — Documentation gaps that could indicate process weaknesses.

Network and architecture documentation always need to be current and actionable. Identify the top five documents that need immediate attention and assign owners (if unassigned) with deadlines to restructure. Work in phases to complete periodic review.

Cloud security review

Unlike on-premises infrastructure that requires physical installation and network integration, cloud services can be activated instantly, creating security gaps that mature organizations frequently overlook. Unfortunately, traditional assessment methodologies were designed for static, perimeter-based environments. Cloud infrastructure calls for dynamic models that require specialized assessment approaches. Audit cloud security posture by examining:

• A. IAM policies — Identify accounts or services lacking MFA protection, validate trust relationships between cloud accounts, and map potential routes for privilege escalation across cloud accounts.
• B. Least privilege enforcement — Focus on access pattern analysis, such as unused permissions, dormant accounts, and anomalous access. Assess time-based and just-in-time access implementations as well.
• C. Access logs and audit trails — Verify comprehensive logging is enabled across all cloud services, compare log retention periods against regulatory requirements, and evaluate centralized log analysis capabilities. Ensure suspicious access patterns trigger automated alerts.
• D. Encryption at rest and in transit — Validate encryption standards for stored data across all cloud storage services and verify all API communications use current TLS versions. Review backup encryption practices and ensure internal cloud traffic protection meets data sensitivity requirements.
• E. Misconfigured storage — Review permission structures for excessive access rights and validate that storage security policies align with data classification levels. Identify temporary file shares without expiration dates and assess whether backup locations maintain production-level security controls.
• F. Third-party API integrations — Document what data flows between integrated systems, review authentication mechanisms, and evaluate integration risks. Review API usage logging, anomaly detection, and the impact of API service disruption on business continuity.

Tool rationalization

The average enterprise uses 76 security tools. A CISO's job is to determine which ones deliver value and which are just security theater.

Mature organizations face two key challenges. One, security tool sprawl. Their arsenal is filled with tools, often a result of reactive purchases following incidents/audit findings, changes in security goals (and even leadership), or shadow IT solutions implemented across departments.

Two, some of these tools might not even be fully configured, optimized, or monitored by security teams. This gap poses a threat and requires a framework to consolidate and analyze the toolkit. Here's where CISOs can implement a four-step rationalization process:

1. Step 1

   Define security capabilities:

   First, identify the security functions the organization needs (for example, core tools, network and infrastructure security, endpoint and device security, etc.) and, second, its owners. If cross-functional collaboration is required for a function, this would be a good point to add a RACI matrix and ensure alignment of responsibilities.

2. 

   Warning: If the RACI matrix shows security being solely responsible for most functions, there's a critical cultural gap. Security must be integrated throughout the organization.

3. Step 2

   Map existing technologies:

   Document all security tools, their costs, and each tool's contribution to security capabilities. Here, we can also evaluate integration maturity, such as standalone tools, basic integration, orchestrated platforms, or AI-driven integrations.

4. Step 3

   Identify redundancies and coverage gaps:

   Identify overlapping technologies addressing the same capabilities and where capabilities lack adequate technological support.

5. Step 4

   Set up a decision matrix:

   Evaluate how well each technology delivers its intended capability. Answer the following questions:

• Business criticality: Does this tool protect a critical business process?
• Effectiveness: Does it demonstrably reduce risk or detect threats?
• Efficiency: Is the operational overhead justified by the security value?
• Integration: Does it work well with other tools or create silos?
• Total cost of ownership: Beyond licensing, what are the hidden costs?

After completing the decision matrix evaluation, create a tool rationalization roadmap that prioritizes actions based on business impact and implementation complexity. Tools scoring poorly across multiple criteria become candidates for retirement or replacement, while high-performing tools with strong integration capabilities form the foundation for future security architecture.

Security team review

Team capabilities and dynamics are critical for building an effective security organization that can execute a CISO's strategy. Here, we focus on two categories: team structure and skills.

Team structure evaluation

Streamline the organization's security structure based on size, complexity of the tech stack, resource availability, the region, and its regulatory requirements. Another key factor to consider is the level of business autonomy the CISO office retains.

Remember, there's no perfect organizational model. The best structure depends on numerous factors, but emphasizes clear accountability and efficient communication.

Skill assessment

A multi-dimensional skill assessment values three critical dimensions that reflect the evolving nature of cybersecurity roles: technical, business, and leadership competencies. The assessment should be objective and focused on both current capabilities and future potential.

Watch out for red flags. If team members struggle with new tools, fail to explain concepts without jargon overuse, or reference outdated security practices, it indicates a skill gap that calls for immediate course correction. At an individual level, teams can get involved with targeted training programs and cross-functional projects. At the organizational level, CISOs can use this opportunity to introduce mentorship programs, role restructuring, and knowledge transfer exercises.

The audit phase sets the foundation for all subsequent transformation activities. Invest the time to get it right because the future success depends on the accuracy and completeness of this assessment.