middle.network
Health check
Guide for auditors

The ten-minute external security review: a checklist for auditors

A repeatable outside-in review of any organisation’s domain, with what to record.

Auditors and third-party risk teams6 min readUpdated

When to use it

  • At the start of an audit, to decide where to look closer.
  • Before onboarding a supplier, as part of third-party risk assessment.
  • Between audits, to spot drift without a site visit.

The checklist

  • 1. List the domains: the main one, email domains, marketing and parked domains.
  • 2. Run a health check on each and keep the dated result.
  • 3. Email: is DMARC enforcing? Is SPF valid? Is DKIM present for the main sender?
  • 4. Encryption: TLS 1.2+ only, certificate valid more than 14 days, HSTS present.
  • 5. Exposure: no remote desktop, SMB, database or admin ports open.
  • 6. Reputation: no domain or mail server IP on a blocklist.
  • 7. Ownership: domain renews more than 60 days out, transfer lock on.
  • 8. Surface: subdomains from certificate logs match what the organisation knows about.

Recording what you found

For each finding, record the domain, the time of the test, what was seen, the control it relates to and the plain-English impact. The result page gives you each of those; the technical view holds the exact records if an engineer disputes it.

Tip: Use the score as a conversation starter, not a pass mark. A low score with a credible remediation plan can be a better position than a high score nobody owns.

Wording findings so they get fixed

  • Say what someone could do, not just what is missing: “anyone can send email that appears to come from example.com” lands better than “DMARC p=none”.
  • Give the fix with the finding. Every issue in the report includes the change to make.
  • Set a re-check date. The health check is free to run again, so ask for a clean result as closure evidence.

What this review won’t tell you

It can’t see inside the network, patch levels, user access or backups. It doesn’t test applications for vulnerabilities. Treat it as the outside layer of the evidence, alongside the organisation’s own records and, where the risk warrants it, a penetration test.

This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.

More guides

ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners
Auditing email authentication: SPF, DKIM and DMARC explained for auditors What each record proves, the five findings that matter, and the questions to ask. 7 min read · Auditors, GRC teams, IT managers
TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7 Protocol versions, certificate management and HSTS: what to check and what to ask for. 6 min read · Auditors and security engineers
DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy The domain itself is an asset. How to check it is owned, protected and resilient. 6 min read · Auditors and IT managers