Guardium logo

How to prepare for an E-ITS audit

A practical checklist to get your enterprise ready for an efficient, stress-free E-ITS compliance audit.

Practical checklist & tips

Preparing for an E-ITS audit is largely about evidence, clarity and prioritisation. Below are concrete steps, common evidence examples, and quick wins to reduce audit friction.

  1. Inventory systems & suppliers: Build or export an inventory of systems, services, and third-party suppliers. Include owner, purpose, and data classification (patient data, HR, finance).
  2. Access review: Produce a current list of user accounts with roles and last login activity. Flag orphaned or shared accounts for removal and document privilege changes.
  3. Backups & restore tests: Ensure backups are scheduled, encrypted, and that a recent restore test has been performed. Keep restore logs and test checklists as evidence.
  4. Patch and endpoint posture: Export patch reports, AV/EDR status, and vulnerability scan summaries for core servers and endpoints.
  5. Policies and procedures: Gather ISMS-related documents: access policy, incident response plan, backup policy, supplier assessment template, and a recent risk assessment.
  6. Incident history: Prepare a short timeline of recent security incidents (even minor), how they were handled, and lessons learned.
  7. Staff training records: Provide attendance lists, training material, and phishing simulation results where available.
  8. Prioritised remediation list: Convert audit findings into a risk-prioritised list with owner, estimated effort, and target completion date.

Quick wins before the auditor arrives

  • Disable or remove unused accounts and document the change.
  • Ensure critical logs (authentication, firewall) are retained and accessible for the audit window.
  • Complete at least one restore-from-backup test and keep the output as a log file.
  • Collect screenshots or exports of key settings (MFA enabled, backup schedules, patch dashboards).

How to present evidence

Group evidence by requirement: people, process, and technology. For each item provide a short one-paragraph note explaining the artifact (what it is), why it matters, and the date it was generated.

Common pitfalls

  • Relying on undocumented verbal assurances — auditors need records.
  • Providing raw logs without context — include a short guide explaining which lines are relevant.
  • Over-scoped inventories — keep a focused inventory of systems that process regulated data for the audit window.

Suggested timeline (6 weeks)

  1. Weeks 1–2: Gather inventories, access lists, and backup logs.
  2. Weeks 3–4: Run restores, close high-priority findings, prepare documentation.
  3. Weeks 5–6: Internal walk-through and evidence pack; brief key staff for auditor interviews.

If you'd like a one-page evidence checklist adapted to your environment, Guardium can produce a tailored pre-audit pack that auditors recognise—reducing time on-site and helping you get a clean result.