- Home
- Engagement
Six weeks of audit prep became four days.
A Fortune 500 healthcare organization, one campus, swept on a Wednesday. By Friday they had a device record they were willing to hand to an auditor.
Somebody senior walked the closets.
Ahead of every audit cycle, a senior engineer spent roughly six weeks physically walking communications rooms, reading labels, and rebuilding the device list in a spreadsheet. The list was accurate on the day it was finished and decaying from the next.
The organization knew this was not a good process. What it did not have was an alternative that produced something an auditor would accept.
Six weeks hurt. Worse, the answer expired before anyone used it.
Audit preparation, before and after.
Devices with no record anywhere. Found, named and dated by Friday.
Switches nobody had recorded, added by contractors over the years.
Devices run by outside vendors that the IT team could not see.
It declined to name some of what it found.
A sweep that names every device is guessing about some of them. Devices where the signature was thin were listed as unidentified, with their port and their hardware address, and they stayed in the denominator of the coverage figure.
That list was what the security team worked through first, and it was the part of the engagement they described as most useful.
One switch will tell you whether your campus looks like this.
Run a discovery pass on one switch and compare it with your own asset register. It takes one afternoon.