What an IT security audit covers and why your business needs one