Storage systems hold the crown jewels: databases, file shares, virtual machines and backups. If an attacker can read, delete or encrypt them, the business stops. When you audit storage systems, you check who can reach the data, how it is protected and whether you can get it back after a failure or attack.
This guide explains the main types of storage, the audit scope and steps, and a practical checklist.
Types of storage to include
| Type | Description | Typical risks |
|---|---|---|
| Direct-attached storage (DAS) | Disks inside or attached to one server | Theft, failure without redundancy |
| Network-attached storage (NAS) | File shares over SMB or NFS | Open shares, ransomware encryption |
| Storage area network (SAN) | Block storage over Fibre Channel or iSCSI | Weak zoning, exposed management |
| Object storage | Cloud or on-premises buckets, such as Amazon S3 | Public buckets, leaked access keys |
| Backup and tape | Copies for recovery and archive | Missing offline copy, untested restores |
Scope of the audit
Include the storage arrays and their management interfaces, file share permissions, cloud storage accounts, backup systems and the processes for capacity, change and disposal. Also include who administers each system, whether internal staff or a managed service provider.
Steps to perform the audit
- Inventory: list all storage systems, their locations, owners and the data they hold.
- Classify: mark which systems store confidential or regulated data.
- Review access: export admin accounts and share or bucket permissions.
- Review configuration: check firmware, encryption, management access and logging against vendor hardening guides.
- Test recovery: pick critical datasets and confirm recent successful restores.
- Check disposal: review how the team wipes or destroys old disks.
- Report: rank findings and agree on fixes with owners.
Checklist
Management and patching
- Storage firmware and management software run supported, patched versions.
- Admins use named accounts with central authentication and MFA.
- Only a management network can reach storage admin interfaces.
- Logs from arrays and NAS devices go to a central log server.
Access control
- File share permissions follow least privilege; no “Everyone: Full control” on business data.
- Owners review access to sensitive shares regularly.
- SAN zoning and LUN masking limit each host to its own volumes.
- Cloud buckets block public access unless a bucket is meant to be public.
- Applications use short-lived credentials, and the team rotates any long-lived keys.
Data protection
- Encryption at rest protects sensitive data, with keys stored separately.
- Encryption in transit protects replication and remote access.
- Snapshots protect against accidental deletion, but they are not the only backup.
Backup and recovery
- Backups follow the 3-2-1 rule: three copies, two media types, one off-site.
- At least one copy is immutable or offline, so ransomware cannot delete it.
- The team tests restores and records how long they take.
- Backup admin accounts are separate from normal domain admin accounts.
Capacity and change
- Monitoring warns before volumes fill up.
- Changes to storage follow change management.
Disposal
- The team wipes or destroys disks before reuse or disposal, and keeps certificates.
- Returned faulty disks under warranty follow a secure process, or the company keeps them.
Common findings
Typical findings include open file shares with sensitive HR or finance files, storage consoles reachable from the office network, backup servers joined to the same domain as everything else, and no tested restore in the past year.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
