I am currently serving out an internship with a small MSP (4 employees, 50-100 clients with between a couple and 100 employees).
My main project is to work on a information/cyber security audit document that is to be used by the employees to perform audits for client networks. It contains a checklist of items to check (about 70 items) split into 12 sub-categories (Security Policy, Security Training, AV Measures, Firewall, Operating Systems/service[out-of-date], business contingency, Wi-Fi Access, etc).
The audit checklist seems comprehensive enough but I am unsure if I am missing anything. Even though I majored in cyber security, I don't seem to have any idea of resources for standards relating to this.
I basically wanted to ask how I should go about ensuring that this checklist is thorough enough to be able to develop a solid security posture baseline for the clients.
The current issue with this document is that it takes too long for the template to be used to produce an audit report from. So I have decided to streamline the report generation by pre-writing generic text for each checklist item that explains the consequence of failing that particular checklist item. Using a VB form, the auditor will tick what items have failed and the produced document will remove all the pre-filled writing for items that have passed.
Do you guys have any advice on where I can get information from regarding these items?