IT security audit in Casablanca: process, steps and deliverables

The short answer: a serious IT security audit runs in three stages. First, scoping: objectives, scope, criteria and a signed agreement. Then execution: interviews, a visit of the premises, configuration review, vulnerability scans, with a gap sheet for each finding. Finally, closing: a report, a findings meeting with management and a prioritised action plan. What sets a good audit apart from a scanner printout is the deliverables: ask for the list at the very first meeting.

This guide walks through that process step by step, as we run it for businesses in Casablanca and the surrounding region, based on the information systems security audit guide published by Morocco’s DGSSI. If you are still deciding between an audit and a penetration test, start with our comparison security audit or penetration test.

What an IT security audit covers

The DGSSI guide distinguishes two main strands, combined according to need.

Strand	What is examined	How
Organisational and physical audit	Security policy, organisation, human resources, asset inventory, access control, physical security, operations, suppliers, incident management, business continuity, compliance	Questionnaires, interviews, document review, site visit
Technical audit	Vulnerabilities of systems and devices, network architecture, configurations (firewall, servers, endpoints, email, cloud), applications	Discovery and scanning tools, configuration analysis, targeted tests

The guide recommends running the organisational audit before the technical one, to identify the critical points that deserve in-depth analysis. Penetration tests and source code review are possible technical activities, not mandatory ones: the scope is decided at the scoping stage.

For an SMB, the technical strand almost always targets the same things, the ones attackers exploit first: accounts and remote access, the firewall and internet-facing services, email and cloud, endpoints, backups and network segmentation.

Step 1: scoping and the audit agreement

Everything starts with a written request, then a first discussion to set the objectives, scope and criteria. An audit can serve different needs: measuring maturity, checking that a security policy is applied, validating a new device, responding to an attack or preparing for ISO 27001 certification. The chosen objective changes the depth and the deliverables.

The DGSSI guide calls for an audit agreement signed by both parties. It should at least specify:

• each participant’s roles and responsibilities;
• the audit objectives;
• the scope and terms: deliverables, milestones, coverage, duration;
• the audit criteria: security policy, standards, frameworks;
• the dates and locations of the engagement;
• the documents the company commits to provide;
• contacts and communication channels;
• logistics: access to the premises, a room, test accounts;
• confidentiality clauses.

For the technical strand, add a written authorisation listing the IP addresses, sites and devices in scope, and the time windows. It protects both the company and the auditor.

On frameworks, the DGSSI’s National Information Systems Security Directive (DNSSI) is mandatory for public administrations, public bodies and critical infrastructure operators. A private company chooses its own framework: ISO 27001 and 27002, the DNSSI as a checklist, or a simplified approach. We cover this in our article on law 05-20 and the DGSSI.

Step 2: preparation

The auditor then prepares a work plan: approach, activities, provisional schedule, and a test strategy for each control point. The DGSSI guide lists five techniques found in any serious audit:

1. Document review: network diagram, inventory, security policy, backup procedures, supplier contracts.
2. Questionnaires and checklists, built from the chosen criteria.
3. Interviews with management, the IT lead and sensitive functions (finance, HR, sales).
4. On-site observation: watching real practice, such as an unlocked workstation or an open server cabinet.
5. Technical test scenarios.

On the company side, gather what you have: even a rough network diagram and the list of admin accounts save time. Our article IT audit for an SMB lists what to collect.

Step 3: the opening meeting

Execution starts with an opening meeting. It validates the work plan, presents the schedule and activities, confirms contacts and clears up any ambiguity. The guide calls for minutes of this meeting and lists as deliverables of this phase a quality assurance plan, a scoping note and a provisional schedule.

This is also when you agree the escalation rule: if the auditor finds a major risk (no backups, admin access exposed to the internet, a former employee’s account still active), they warn you immediately, without waiting for the report. The DGSSI guide makes this an obligation for the audit lead.

Step 4: execution on site and remotely

In Casablanca, we do most of the work on site: interviews, a visit of the technical rooms, a review of the equipment in the rack. External tests are run remotely from the internet, within the authorised windows.

Activity	What is checked	Example finding
Interviews and observation	Real practice against the stated policy	Shared passwords in the accounts department
Site visit	Access to the rack, UPS, cooling, cabling	Server cabinet left unlocked in a corridor
Architecture review	Topology, segmentation, Wi-Fi, flows between zones	Cameras and workstations on the same network
Configuration review	Firewall, VPN, servers, endpoints, email, cloud	Firewall admin interface reachable from the internet
Vulnerability scan	Systems and services with known vulnerabilities	Server missing updates for a long time
Backup review	Off-site copy, isolation, restore test	Backup on a permanently connected disk

Each finding is documented in a gap sheet. According to the guide, it holds the auditor’s finding, the recommendation, the commitment or action proposed by the company, and the auditor’s comment on that proposal. Interview minutes are validated with your staff, and any change made to the system during the audit is logged. The golden rule set out by the DGSSI: at the end of the engagement, the system must not be less secure than at the start.

Step 5: analysis and consolidation

The auditor then consolidates the evidence: scan results, vulnerability analysis, list of configuration anomalies, gap sheets. They fill in a maturity grid against the objectives set at the start, write clear findings and prepare realistic recommendations.

This is where the audit earns its value. A weakness does not carry the same weight on the payroll server as on an isolated test machine: findings must be ranked according to your business, not just an automated score.

Step 6: closing, report and findings meeting

The engagement ends with a closing meeting with management: presentation of the findings, questions and answers, validation of the conclusions. The report must be issued within the agreed timeframe, shared only with the designated people and kept confidential.

Deliverables to ask for

Deliverable	Purpose	For whom
Executive summary	Overall risk level, major findings, decisions needed	Senior management
Technical report	For each finding: description, evidence, severity, fix	IT lead, service provider
Gap sheets	Finding-by-finding follow-up, with commitments made	Security lead
List of vulnerabilities and configuration anomalies	Working basis for the fixes	Technical team
Maturity grid	Measurable baseline for the next audit	Management, security lead
Prioritised action plan	Who does what, in which order, with which prerequisites	Everyone

Depending on what was agreed at the start, the DGSSI guide also lists other possible deliverables: a security policy, an IT acceptable-use charter, a risk matrix and risk map, specifications for the chosen solutions, and procedures (inventory, physical access, backup). These are often the documents that last the longest.

After the audit: fix and verify

An audit is useless if the action plan stays in a drawer. The agreement can require the auditor to follow up on the fixes and report on progress. We recommend a re-test of the major points once fixed.

The first fixes are almost always the same: enable MFA, see rolling out MFA in a business; harden the firewall, see 10 FortiGate security settings; isolate a backup copy, see 3-2-1 immutable backup. If the audit touches personal data, it also feeds your compliance with law 09-08.

Common mistakes

1. Ordering an audit without a written scope, then finding out that the cloud or remote sites were not covered.
2. Running scans without written authorisation or agreed time windows.
3. Accepting a raw scanner report, with no context or prioritisation.
4. Leaving management out, so neither the budget nor the decisions get approved.
5. Forgetting the organisational side: departing staff, shared passwords, suppliers with permanent access.
6. Never verifying the fixes, so the same finding reappears at the next audit.

Checklist before launching a security audit

• Audit objective written in one sentence.
• Scope: sites, networks, servers, cloud, applications, with or without a penetration test.
• Chosen framework: ISO 27001, DNSSI as a checklist, or a simplified approach.
• Signed agreement, with confidentiality clauses.
• Written authorisation for technical tests.
• Contacts available and documents gathered.
• List of deliverables fixed from the start.
• Follow-up of fixes and re-test planned.

How we work

We start with a free initial audit: a first review of your access, firewall, email and backups, to decide together whether to go further and on which scope. For a full audit, we draft the agreement, work on site from Casablanca, document every finding and present a report and prioritised action plan to your management. We can then implement the fixes, including as a Fortinet integrator in Morocco, and monitor your systems 24/7 with critical incidents handled in under 15 minutes.

Explore our cybersecurity services in Morocco and our managed IT in Casablanca, then request your free initial audit: we reply within 24 business hours.