Wireless Security Audit Checklist: 10 Checks for Your Wi-Fi Networks

A wireless security audit checklist should confirm ten things: that you know every authorised access point, corporate Wi-Fi uses enterprise authentication, devices validate the authentication server, legacy protocols are gone, guest and IoT networks are isolated, rogue access points are detected, management interfaces are locked down, firmware is patched, coverage matches your premises, and wireless events are logged. If PCI DSS applies, you must also scan for unauthorised access points every three months.

Wireless networks extend your network beyond your walls. Anyone within range, in the car park or the office next door, can see your networks and try to join them. This guide explains what a professional audit covers, gives the 10-point checklist, and maps it to PCI DSS, ISO 27001 and Cyber Essentials. You can also download the wireless security audit checklist as an Excel workbook, with a results column, a quarterly rogue access point log and an access point inventory.

Key takeaways

• Treat wireless as an untrusted network edge, segmented from critical systems.
• Use WPA3 or WPA2/WPA3 Enterprise with 802.1X for corporate access, not a shared password.
• Look for rogue and imitation access points, not just the networks you know about.
• PCI DSS requires quarterly checks for unauthorised access points, whether or not you use wireless.
• A proper audit needs someone on site; the radio environment cannot be tested from a desk.

Why does wireless need its own security audit?

Because wired networks are protected partly by physical access and wireless networks are not. The common risks are:

• Shared passwords. One pre-shared key known by every current and former employee.
• Weak passphrases. WPA2-Personal networks with short or guessable passphrases are vulnerable to offline guessing.
• Imitation networks. A fake network with a familiar name can trick devices or users into connecting.
• Rogue access points. Unauthorised devices plugged into the wired network create an uncontrolled way in.
• Poor segmentation. Guest or IoT networks that can reach internal systems.
• Unmanaged devices. Printers, smart TVs, building systems and personal devices on corporate Wi-Fi.

Newer standards help. Wi-Fi 6E and Wi-Fi 7 require WPA3 in the 6 GHz band, and WPA3 resists offline password guessing far better than WPA2-Personal. But mixed environments, legacy devices and transition modes mean older weaknesses often remain.

What does a professional Wi-Fi security audit cover?

Our wireless penetration testing service follows this approach, with the on-site survey carried out at your premises.

The 10-point wireless security audit checklist

Need a copy to work through on site or share with your IT provider? The wireless security audit checklist (Excel) has the same ten checks with what to verify, the related ISO 27001 Annex A controls and columns for the result, evidence, owner and date. Print it or fill it in on screen.

1. Keep an accurate inventory

List every authorised access point and controller with location, model, firmware and business justification.

2. Use enterprise authentication for corporate access

Use WPA3-Enterprise, or WPA2/WPA3-Enterprise where older devices require it, with 802.1X and individual credentials or, better, device certificates.

3. Make clients validate the server

With 802.1X, configure devices to check the authentication server’s certificate. Without this, an imitation network can collect credentials.

4. Retire legacy protocols

Remove WEP, WPA (TKIP) and open networks for anything except isolated guest access. Where a pre-shared key is unavoidable, for example for some IoT devices, use a long random passphrase, put those devices on their own network, and change the key when people who know it leave.

5. Segment and isolate

Put guest, IoT and corporate wireless on separate networks, with firewall rules controlling what each can reach. Guest networks should reach the internet only. Test the isolation; do not assume it.

6. Detect rogue and imitation access points

Use wireless intrusion detection in your controller, or regular manual surveys, and check switch ports for unknown devices.

7. Protect management interfaces

Restrict controller and access point administration to a management network, require MFA where supported, change default credentials and disable insecure management protocols.

8. Patch firmware

Keep controllers, access points and client wireless drivers up to date.

9. Control signal coverage

Place access points and set transmit power so coverage matches the space you occupy, as far as practical. This does not replace encryption.

10. Log, monitor and review

Send wireless authentication and controller logs to your central logging platform, alert on repeated failed authentications or new access points, and review configuration changes.

What does PCI DSS require for wireless?

• 11.2.1: detect and identify all authorised and unauthorised wireless access points at least every three months, whether or not you use wireless in the cardholder data environment.
• 11.2.2: keep an inventory of authorised wireless access points with a business justification.
• 1.3.3: install network security controls between all wireless networks and the cardholder data environment.
• 2.3.1 and 2.3.2: for wireless environments connected to the cardholder data environment, change vendor defaults, and change encryption keys when anyone who knows them leaves or a compromise is suspected.
• 4.2.1.2: wireless networks transmitting cardholder data must use strong cryptography.

How do you evidence rogue access point detection (11.2.1)?

Any method that finds both authorised and unauthorised access points works, as long as it covers every in-scope location at least every three months and leaves a record an assessor can check:

If you rely on automated monitoring, it must alert your staff (11.2.1), and your incident response plan must cover alerts about unauthorised wireless access points (12.10.5). The downloadable checklist includes a quarterly log sheet for these checks.

If wireless is kept out of scope through segmentation, that segmentation must be tested under Requirement 11.4 as part of PCI penetration testing. Our guide to building a PCI-compliant network covers where wireless fits.

What about ISO 27001 and Cyber Essentials?

ISO/IEC 27001:2022. Annex A controls 8.20 (networks security), 8.21 (security of network services) and 8.22 (segregation of networks) all apply to wireless. Audit results provide evidence and feed your risk treatment plan.

Cyber Essentials. The scheme focuses on internet-based attacks, so attacks that need physical proximity are outside its scope. Wireless routers and devices that can be reached from the internet must still meet the firewall and secure configuration controls in the Cyber Essentials requirements.

How does a wireless audit fit with other testing?

Wireless is one entry point among several. Internal penetration testing shows what an attacker could reach after getting onto your network by any route, including Wi-Fi. If you are deciding what to test first, our comparison of internal vs external penetration testing may help.

Why Sovereign Secure

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, an IASME-licensed Cyber Essentials certification body and ISO 27001 certified. From our Accrington headquarters we carry out on-site wireless work across Manchester and the North West, and map the results to PCI DSS and ISO 27001 where relevant.

Next step

Start with the free checklist to see where you stand. When you want the radio environment tested properly, tell us how many sites, floors and wireless networks you have: our penetration testing quote form turns that into a quote for an on-site wireless audit and test.