IT Infrastructure Domains: 7 Areas to Audit

A security audit can feel overwhelming because IT touches everything. One popular way to organise the work is to split the environment into seven IT infrastructure domains. Each domain has its own risks and controls, so auditors can cover the whole estate without missing a layer.

This guide explains the seven domains, the typical risks in each and the controls an auditor should check. You can use it as a scoping tool for an internal audit, an ISO 27001 project or a vendor review.

The seven domains at a glance

Domain	What it covers	Main risk
User	People who use systems and data	Phishing, mistakes, insider misuse
Workstation	Laptops, desktops, phones	Malware, theft, unpatched software
LAN	Internal network, switches, Wi-Fi	Lateral movement, rogue devices
LAN-to-WAN	Edge where the internal network meets the internet	Exposed services, weak firewall rules
WAN	Links between sites and to the internet	Outages, interception
Remote access	VPN, remote desktop, zero-trust access	Stolen credentials, unmanaged devices
System/application	Servers, databases, business apps, cloud	Data breaches, misconfiguration, vulnerabilities

1. User domain

People are both the first line of defence and the most common entry point. Therefore, auditors check:

an acceptable use policy that staff have read and accepted;
security awareness training and phishing simulation results;
background screening for sensitive roles;
a clear process to report suspicious activity;
prompt removal of access for leavers.

2. Workstation domain

Endpoints hold data and give access to everything else. Key controls include:

full-disk encryption and screen locks;
endpoint protection or EDR on all devices;
automatic patching for the operating system and browsers;
no local admin rights for normal users;
mobile device management for phones and tablets.

3. LAN domain

Once an attacker is inside, a flat network lets them reach everything. So check:

network segmentation with VLANs and internal firewalls;
secure switch configurations, such as port security and disabled unused ports;
WPA3 or WPA2-Enterprise on Wi-Fi, with guest networks isolated;
network access control for new devices;
an up-to-date network diagram.

4. LAN-to-WAN domain

This is the boundary between your network and the internet. Auditors usually review:

firewall rules, looking for “any-any” rules and unused openings;
intrusion detection or prevention;
web and DNS filtering;
the list of internet-facing services, compared with what scanning tools find;
logging of allowed and blocked traffic.

5. WAN domain

The WAN connects offices, data centres and cloud services. Typical checks include:

encryption of traffic between sites, for example with IPsec;
redundant links and providers for critical sites;
service agreements with carriers, including security terms;
monitoring for outages and unusual traffic.

6. Remote access domain

Remote work makes this domain critical. Look for:

multi-factor authentication for all remote access;
device health checks before access is granted;
no direct RDP or SSH exposed to the internet;
session timeouts and logging;
a regular review of who has remote access.

7. System/application domain

Finally, this domain holds the data attackers want. Auditors check:

hardening baselines for servers and cloud services;
vulnerability scanning and patch timelines;
role-based access and privileged access controls;
backups, including offline copies and restore tests;
secure development and change management for in-house apps.

How to use the domains in an audit

Scope: list the assets in each domain.
Assess risk: decide which domains matter most for your business.
Map controls: link each domain to your framework, such as ISO 27001 Annex A or the CIS Controls.
Test: gather evidence, from configuration reviews to interviews.
Report: present findings per domain, so owners know what to fix.

This structure also makes reports easier to read. For example, the network team owns LAN findings, while HR and training cover the user domain.

Common findings across the domains

In practice, the same problems appear in most audits:

User: training records exist, but phishing click rates stay high, so the training is not working.
Workstation: a few old laptops miss encryption or patches because they are rarely online.
LAN: guest Wi-Fi can still reach internal printers or file shares.
LAN-to-WAN: firewall rules for finished projects were never removed.
Remote access: contractors use VPN accounts without MFA.
System/application: backups run, but nobody has tested a full restore in over a year.

Because these gaps are common, check them first. As a result, you often find the biggest risks in the first few days of an audit.

Related guides

Sources

CIS Critical Security Controls

Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.