The Short Answer
A production IT and infrastructure audit is a structured look at the network, storage, workstations and security of a studio, post house or production office, followed by a written report. You come away with a map of what you have, measurements of how it performs, a list of risks and a ranked plan for what to fix first. It is the cheapest way to find out why the edit bay is slow, what would break first as the team grows, and where you stand before a security review.
Who Needs One
Three situations come up most.
- Moving or building a space. A new facility is the easiest time to get cabling, rack layout, power and network design right.
- A growing team. A setup that suits three people can fall over at eight. An audit shows where.
- Before a security review. If a client has asked about TPN or a vendor security questionnaire, an audit gives you a baseline. It is not a TPN assessment, which an independent assessor performs. See our TPN readiness checklist.
What an Audit Looks At
The scope depends on the site, so the list below shows the usual areas.
Network
- What switches, routers, firewalls and access points exist, and how they connect
- Link speeds on each port and cable runs where something is negotiating below its rating
- Whether editing traffic, office traffic and guest Wi-Fi are separated
- Firewall rules, remote access method and who has admin accounts
Storage and backup
- The NAS or shared storage model, drive health, free space and RAID configuration
- How storage is shared to editors and what the real read and write speeds are under load
- What gets backed up, to where, how often and whether anyone has tested a restore
- The state of cloud or archive copies
If you are thinking about a storage change, see how to choose NAS storage for post.
Workstations
- Machine age, GPU, memory, local cache drives and operating system versions
- How well each machine suits the codecs and resolutions you cut
Security
- Patch and firmware status on workstations, NAS, switches and firewalls
- Multi-factor authentication, password practice, encryption of laptops and drives
- Admin rights, shared accounts, leftover accounts for people who left
- Physical access to the equipment room
Documentation and inventory
- A list of every device with age, warranty and expected end of life
- Whether anyone has a diagram, passwords in a vault and notes on how things were set up
How It Works
- Scoping call. You describe the site, the team, the software and what hurts today.
- Access. You give site access, and admin or read-only access to the network gear. Someone who knows the history of the setup joins for an hour.
- Discovery. Mapping, inventory and configuration review. These do not disrupt anyone.
- Measurement. Throughput tests from storage to workstations, internet speed and Wi-Fi. These load the network, so they are scheduled outside busy hours.
- Review and report. Findings are written up with a risk level for each, and a plan puts them in order.
- Walkthrough. A call to go through the results and answer questions.
How long it takes depends on the size of the site and how well documented it is, so ask for an estimate once the scope is clear.
What You Get at the End
- A network topology map. A diagram of switches, routers, wireless, servers and how they connect.
- A performance baseline. Measured throughput from storage to workstations, plus internet and Wi-Fi results, so you know where the slowdown is.
- A security gap report. Unpatched systems, firewall misconfigurations, weak access controls and missing encryption, each with the risk it carries.
- A hardware inventory. Every device with age, warranty status and expected end of life, for replacement planning.
- A prioritized remediation plan. A ranked list with urgency and expected effect, so you know what to do first and why.
- A one-page summary for ownership. Current state, main risks and where to spend.
The report is yours. You can hand the plan to your own IT provider, or ask us to carry out the fixes.
What an Audit Is Not
- It is not a penetration test. The Best Practices that studios use ask for a penetration test by an independent party or an internal red team, which is a separate piece of work.
- It is not a TPN assessment or certification. An independent, TPN-accredited assessor does that.
- It does not guarantee that nothing will fail. It tells you where the risks are today.
Getting Value From the Result
Fix the items that are cheap and high risk first, such as shared admin passwords, unpatched firmware and an untested backup. Plan the structural items, such as network separation or storage upgrades, around your production calendar. For ideas on the network side, see small studio network setup.
Want a person to help?
A real person on our team can scope an audit for your site, run it and walk you through the report. We can also make the fixes or hand the plan to your own IT provider. We do not certify anyone, and the report describes your setup on the day we looked at it. Read about our infrastructure audit, or contact us with a short description of your site.
Questions people ask
What do you need from us to run an audit?
Access to the site, admin or read-only access to the network gear, and someone who knows the history of the setup. A diagram or password vault helps if you have one.
Will the audit interrupt our work?
Mostly no. Mapping and inventory do not affect anyone. Throughput tests load the network, so they are scheduled outside busy hours.
Is an infrastructure audit the same as a TPN gap assessment?
No. An audit looks at the whole IT setup. A TPN gap assessment compares your studio with the MPA Content Security Best Practices. The audit gives a useful baseline for one, and the formal assessment is done by an independent assessor.
Who owns the report?
You do. You can use it internally, hand it to your IT provider or ask us to carry out the fixes.
Written by the team at Clouds Agency, a Los Angeles creative and production consulting agency.