Audit WLAN and Mobile Devices: Security Checklist

Wireless networks and mobile devices extend your network beyond walls and desks. That convenience brings risk: weak Wi-Fi encryption, rogue access points, lost phones full of company email and personal devices that IT has never seen. To audit WLAN and mobile devices, you check both the wireless infrastructure and the devices that connect to it.

This guide covers the scope, useful tools, the audit steps and two practical checklists.

Scope of the audit

A typical audit includes:

wireless controllers, access points and their management;
SSIDs for staff, guests and IoT devices;
authentication methods, such as WPA2-Enterprise, WPA3 or pre-shared keys;
company-owned and personal (BYOD) phones, tablets and laptops;
mobile device management (MDM) or unified endpoint management (UEM) platforms;
policies for acceptable use, remote work and lost devices.

Useful tools

Wireless survey tools: apps such as Kismet or commercial survey tools map access points and signal coverage.
Rogue AP detection: most enterprise controllers include wireless intrusion detection.
Configuration exports: controller and MDM settings show encryption, policies and compliance.
MDM reports: list enrolled devices, OS versions, encryption status and jailbroken or rooted devices.

Steps to perform the audit

Collect documents: wireless design, SSID list, MDM policies and BYOD rules.
Survey the site: walk the premises and outside the building to find all access points and see how far the signal reaches.
Review configurations: check encryption, authentication, management access and firmware.
Test segmentation: connect to the guest network and try to reach internal systems.
Review devices: sample MDM records and compare them with the HR staff list.
Report: rank findings and agree on fixes.

Checklist: wireless LANs

Staff networks use WPA3-Enterprise or WPA2-Enterprise with 802.1X, not a shared password.
If a pre-shared key is unavoidable, it is long and the team changes it when staff leave.
No access point uses WEP, WPA (TKIP) or open authentication for internal access.
Guest Wi-Fi sits on a separate network with internet-only access, and it has a captive portal or time limits.
IoT devices, such as cameras and printers, use their own segmented network.
Wireless intrusion detection alerts on rogue access points and evil-twin networks.
Admins manage controllers over HTTPS or SSH, with central authentication and MFA.
Access point firmware is current and supported.
WPS and other insecure legacy features stay disabled.
Logs from controllers go to a central log server.

Checklist: mobile devices

A mobile device policy covers company devices and BYOD, and staff accept it.
Every device that accesses company email or data enrols in MDM, or uses app-level protection.
Devices require a passcode or biometric lock and auto-lock after a short time.
Storage encryption is on, which is the default on modern iOS and Android when a passcode is set.
The MDM blocks jailbroken or rooted devices.
Devices run supported OS versions, and updates install promptly.
Company apps come only from managed app stores.
Work data stays in a separate work profile or managed apps on personal devices.
IT can remotely wipe company data from lost or stolen devices.
Leavers’ devices lose access on their last day.

Common findings

Auditors often find a shared Wi-Fi password that has not changed in years, guest networks that can reach internal printers, and phones with company email that are not enrolled in MDM. Each of these is easy to fix once spotted.

Related guides

Sources

Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.