What it is
Cloud or hybrid infrastructure audit: architecture, quantified FinOps costs, tested RTO/RPO, network security, GDPR/NIS2 compliance.
For whom
SMEs, mid-market and SaaS editors needing to cut cloud spend, prove BCP/DRP or pass a client or insurer audit.
Indicative price
EUR 6,000 to 20,000 excl. VAT depending on scope. Report + costed remediation plan delivered.
Here are the moments we get asked for an infra audit.
- 1
Audit before migrating to a new host. You are preparing an infrastructure move (sovereign hosting, shared to dedicated, cloud rework) and want a clean baseline before moving.
- 2
Audit after an incident. A leak, ransomware, a prolonged outage. We investigate the cause, map the residual exposure and write the remediation plan.
- 3
Audit before an enterprise contract. A large client requires security and resilience guarantees. We produce the compliance dossier and identify the gaps.
- 4
NIS2 or ISO 27001 compliance audit. You are covered by a directive or preparing a certification. We measure the gap and build the compliance trajectory.
Typical control points
Grid applied systematically, adapted to the scope defined at kickoff.
Access and permissions
Account inventory, least-privilege, joiner/leaver lifecycle, two-factor authentication, vendor access management.
Internet exposure
Public exposure surface, open ports, accessible services, application firewall, denial-of-service protection.
Encryption in transit and at rest
Inter-service communications, sensitive data storage, key management and rotation, algorithms in use.
Backups and restore
Frequency, location, immutability, access separation. Verification that restore has been recently tested on real data.
Monitoring and alerting
What is watched, thresholds, alert channels, reaction time, night and weekend coverage.
Incident management
On-call procedure, crisis cell, internal and external comms, incident log, formalized post-mortem.
Disaster recovery plan
Acceptable time and data-loss objectives, disaster scenarios covered, last real failover test, operational documentation.
Updates and patches
Patching policy, average application delay, handling of end-of-life components, security watch on used components.
5 to 15 audit days depending on scope. Written report + oral debrief.
Architecture review
Overview: resources, flows, external dependencies, coupling points, redundancy, environment separation.
Configuration review
Methodical check of real parameters — accounts, permissions, exposure, logs, isolation — against domain best practices.
Load and failover tests
Behavior under load, simulation of a major failure, measurement of actual recovery time and data loss.
Security and compliance audit
Cross-referencing with applicable frameworks (ANSSI, NIS2, ISO 27001, GDPR, sovereign hosting where relevant). Gap mapping.
Frequent questions
How much does an infra audit cost?+
Fixed-fee quote. Range 5 to 15 person-days, from €6,500 excl. VAT for a focused audit on a limited scope, up to €22,000 excl. VAT for a full audit with failover tests and compliance mapping.
Do you audit all hosts?+
Yes, indifferently public cloud, sovereign cloud, shared or dedicated hosting, or on-premise. We adapt the grid and control points to the infra type and its criticality.
Do you really test failover?+
Depending on scope: either a real test (controlled failover on staging, simulated resource cutoff) or a documented simulation (tabletop exercise, procedure review). Real tests require more time and coordination with your teams.
Is the report usable in NIS2 or ISO 27001 audits?+
It provides a structured base (mapping, gaps, plan) but is not an official certification deliverable. Certification requires a qualified auditor. Our audit prepares and shortens that certification path.
Do you provide a costed remediation plan?+
Yes, each gap is tied to an action, an order of magnitude in days and a priority. You can hand execution to your team, another vendor, or us — remediation is invoiced separately.
/ En résumé
An infra to audit?
Free 1-hour scoping. Report in 5 to 15 business days.
Continue with
Pages that pair well with this one
Adjacent topics covered by MAG&Cie, hand-curated to stay on your problem.