Virtualization packs dozens of servers onto a few physical hosts. That saves money, but it also concentrates risk. Anyone who controls the hypervisor or its management console controls every virtual machine on it. To audit virtualized environments, you check the hypervisors, the management platform, the virtual networks and the life cycle of the VMs themselves.
This guide applies to VMware vSphere, Microsoft Hyper-V, Proxmox, KVM and similar platforms.
Scope
A typical audit covers:
- hypervisor hosts and their firmware;
- the management platform, such as vCenter, System Center or the Proxmox web interface;
- virtual switches, VLANs and distributed firewalls;
- storage used by VMs, including snapshots and templates;
- VM provisioning, ownership and decommissioning;
- backup and recovery of VMs.
Useful tools
- Platform reports: vSphere, Hyper-V and Proxmox export host, VM and permission lists.
- Hardening guides: VMware security configuration guides and CIS Benchmarks for hypervisors.
- Vulnerability scanners: check hypervisor and management versions against known flaws.
- Backup reports: show which VMs are protected and when they last restored successfully.
Steps to perform the audit
- Inventory: export all hosts, clusters and VMs, with owners and purposes.
- Review management access: check who has admin rights and how they log in.
- Check versions: compare hypervisor and management versions with vendor support and security advisories.
- Review configuration: compare settings with the hardening guide.
- Review networks: confirm that VMs of different trust levels are separated.
- Test recovery: pick a few VMs and check backup and restore evidence.
- Report: rank findings and agree on fixes.
Checklist
Hypervisor and management
- Hypervisors and management servers run supported versions with current security patches.
- Admins log in with named accounts through central authentication and MFA.
- Only a dedicated management network can reach the hypervisor and console.
- Nobody browses the web or reads email from the management network.
- Lockdown or similar modes restrict direct host access where the platform supports it.
- Logs from hosts and the management platform go to a central log server.
Recent ransomware campaigns have targeted ESXi hosts directly, so patching and isolating management interfaces is especially important.
Virtual machines
- Every VM has a named owner and a business purpose.
- The team removes unused VMs, old snapshots and orphaned disks, which reduces “VM sprawl”.
- New VMs start from hardened, patched templates.
- VMs with sensitive data use encryption where supported.
- Snapshots are short-term only, not a substitute for backups.
Networks and segmentation
- Virtual switches separate production, test, DMZ and management traffic.
- VMs with different trust levels do not share network segments without firewall control.
- Promiscuous mode, MAC changes and forged transmits stay disabled unless a VM needs them.
Storage and backup
- VM storage traffic runs on an isolated network.
- Backups cover all critical VMs, and at least one copy is immutable or offline.
- The team tests VM restores regularly and records the time taken.
Change and capacity
- Changes to hosts and clusters follow change management.
- Capacity monitoring warns before CPU, memory or storage run out.
Common findings
In practice, auditors often find the same issues. For example, the vCenter or Hyper-V console sits on the normal office network. Admins share one powerful account. Old test VMs keep running for years without patches. And nobody has restored a VM from backup since the platform went live. Fixing these four issues removes a large share of the risk.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
