Network Security Assessment Checklist: What to Inspect and Which Tools Actually Help

A network security assessment is a structured review of your firewall, network segmentation, wireless configuration, identity and access controls, endpoints, logging, and patch status, checked against a defined framework and ranked by risk. It’s the infrastructure-focused slice of a broader cybersecurity assessment. If someone asked you for one specifically, rather than a full security review, this is what they meant, and this article is the checklist plus the tooling landscape behind it.

We wrote a broader guide to what a full cybersecurity assessment covers for businesses figuring out where to start. This piece goes deeper on the network layer specifically: what to inspect, how to check it, what category of tool helps at each step, and how to read the results once you have them.

What a network security assessment actually inspects

Seven areas, in the order most assessors work through them.

Perimeter and firewall. The rules governing what traffic gets in and out. This includes checking for overly permissive rules (any-any, ports left open from a project that ended years ago), whether the firewall firmware is current, and whether logging is turned on. CISA’s Known Exploited Vulnerabilities catalog tracks how quickly attackers weaponize disclosed firewall and edge-device flaws, often within days, which is why firmware currency gets checked first, not last.

Network segmentation. Whether your network is flat (everything can talk to everything) or divided into zones that limit how far an intruder can move if one device is compromised. A guest Wi-Fi network that can reach your file server is a segmentation failure. So is a point-of-sale system sitting on the same VLAN as an office printer with no restriction between them.

Wireless configuration. Encryption standard (WPA2 versus the weaker options still found on older access points), whether guest and staff networks are actually separated, and whether the Wi-Fi password has been rotated since the last employee who knew it left.

Identity and access controls at the network layer. Who can VPN in, whether that access requires multi-factor authentication, and whether accounts for former employees or expired vendor contracts still work. This overlaps with the identity review in a full cybersecurity assessment, but here the question is narrower: can this credential reach the network at all.

Endpoints connecting to the network. Not a full device audit, but a check of what’s allowed to connect: is there a policy for unmanaged personal devices, are IoT devices (cameras, badge readers, smart thermostats) isolated from the main network, and can you actually produce a list of what’s connected right now.

Logging and monitoring. Whether network activity is logged at all, how long logs are retained, and whether anyone is positioned to notice unusual activity. A firewall that logs everything but that nobody reviews provides evidence after an incident and no protection before one.

Patch and update status. Firmware on routers, switches, firewalls, and access points, checked against vendor advisories. This is the single most common gap assessors find, because network hardware gets set up once and then forgotten in a way servers and laptops usually don’t.

The network security assessment checklist

Work through these in order. Each line is something you can verify yourself before deciding whether you need outside help.

Perimeter and firewall

• Firewall firmware is on a currently supported version, not end-of-life
• No rules allow “any source, any destination, any port” without a documented reason
• Every open port maps to a service you can name and a person who owns it
• Firewall configuration is backed up somewhere other than the device itself
• Change log exists for firewall rule modifications, even an informal one

Segmentation

• Guest Wi-Fi is on a separate VLAN with no route to internal systems
• Point-of-sale, medical devices, or industrial equipment sit on isolated segments
• IoT devices (cameras, badge systems, smart building equipment) can’t reach the main office network
• Server or data segments require explicit rules to reach them, not open by default

Wireless

• Wireless networks use WPA2 or better, not WEP or open authentication
• Wi-Fi passwords have been rotated since any departed employee had access
• Access point firmware is current
• Rogue access point check has been done at least once (an unauthorized device someone plugged in)

Identity and access

• VPN and remote access require multi-factor authentication
• A list of who can remotely access the network exists and matches who should have access today
• Former employee and expired vendor accounts have been disabled, not just deprioritized
• Admin access to network hardware is limited to the people who actually need it

Endpoints and connected devices

• A current inventory of devices connected to the network exists
• A policy covers personal or unmanaged devices connecting to any network segment
• IoT and smart devices are on their own segment, not the main network

Logging and monitoring

• Firewall and network logging is enabled, not just available
• Logs are retained long enough to investigate an incident after the fact (30 days minimum, longer if a compliance framework requires it)
• Someone, internal or outsourced, actually reviews alerts on a defined schedule

Patching

• Router, switch, and access point firmware versions are documented
• A process exists for tracking vendor security advisories
• The last patch cycle happened within the last quarter, not “at some point”

If most of these are unchecked, that’s useful information on its own. It tells you the assessment will find real gaps rather than confirm you’re already in good shape, and it sets expectations for the size of the remediation roadmap that follows.

Network audit tools: what the category landscape looks like

Assessors don’t rely on one tool. A network security assessment typically draws from four tool categories, and understanding what each one does (and doesn’t) helps you evaluate whether a provider’s process is thorough or superficial.

Vulnerability scanners. These tools scan network devices and connected systems for known vulnerabilities, matching what’s running against public vulnerability databases. Nessus, OpenVAS, and Qualys are commonly used in this category. A scanner tells you what’s exposed. It does not tell you which exposure actually matters to your business, which is where an assessor’s judgment comes in. A scan result full of medium-severity findings on a segment that’s already isolated from anything sensitive is a very different risk than the same findings on your core server VLAN.

Network discovery and mapping tools. Before anyone can assess a network, they need an accurate picture of what’s on it: devices, connections, and traffic flows. Nmap is the long-standing open-source standard for network discovery and port scanning. Enterprise network monitoring platforms extend this into continuous asset inventory. This step catches the device nobody remembers is still plugged in, which is more common than most owners expect.

Firewall rule analysis. Some firewall vendors, including Fortinet, Palo Alto Networks, and Cisco, provide built-in tools for reviewing and cleaning up rule sets. Third-party firewall policy analyzers can also flag redundant, shadowed, or overly permissive rules across a rule base that’s grown unmanaged for years. This is closer to manual review than automated scanning; a rule that looks fine in isolation can still be a problem in context.

Wireless auditing tools. Purpose-built tools check for weak encryption, rogue access points, and wireless configuration issues that a general vulnerability scanner tends to miss, since wireless problems are as much about physical coverage and device behavior as they are about software versions.

The reason this tooling category carries outsized commercial attention (it’s the highest-value keyword tied to this topic) is that the tools themselves are only half the picture. A scan output without someone who can read it against your actual environment is a spreadsheet, not an assessment. If a provider’s process is “we ran a scanner and here’s the PDF it generated,” that’s the tooling without the judgment. Ask what happens between the scan and the report.

How to read your results

A network security assessment should hand you three things, not a raw findings dump.

A severity ranking, not a checklist of everything scanned. A flat firewall rule set and an unpatched printer firmware are not the same risk, even if a scanner flags both. Findings should be sorted by what’s actually exploitable and what sits in front of something that matters.

Context for each finding. “Port 3389 open to the internet” means something different on a server holding customer records than on an isolated test machine with nothing on it. A useful report explains why a finding matters in your specific environment, not just that it exists.

A remediation sequence. What to fix first, what can wait, and what each fix requires: a configuration change, a policy decision, or new hardware. You should be able to hand this to any competent network provider and have them act on it, not just the one who wrote the report.

If your assessment surfaces gaps in segmentation or firewall configuration specifically, that’s typically where managed firewall services come in; see our breakdown of what managed firewall services cost for what ongoing management looks like once the initial gaps are closed. If the findings point to a broader pattern across identity, endpoints, and policy as well as the network, that’s the signal you need the full cybersecurity assessment rather than the network-only slice.

Where to start

If you want a starting point before committing to a paid network security assessment, our Free IT Assessment covers the basics across your environment, including network fundamentals, in about sixty minutes. It’s built on the CTGA Framework, which is how we scope engagements once a deeper look is warranted. It tells you honestly whether a full assessment is the right next step, not just that one is available for purchase.

We’re based in Portsmouth and work with businesses across Hampton Roads on networking and the security work that sits on top of it. If a follow-up conversation makes sense after you run through this checklist yourself, that’s a local one.