The NFC Tag and Card Audit Checklist

Use this checklist as a structure for a full audit, or pick the section that matches the problem in front of you.

1. Records

• Export every active tag and card from the system or register
• Match each one to a named owner, item or location
• Disable cards with no current holder
• List items that should be tagged but are not

2. Readability

• Tap a sample of tags with at least two different devices
• Note tags on metal, near heat or in high-wear spots
• Replace any tag that fails two reads
• Check readers respond quickly and consistently

3. Configuration

• Card technology. Note the chip family. Older families may have known weaknesses. See whether cards can be cloned.
• Keys. Confirm default or shared keys have been changed.
• What the reader trusts. A system that only checks a card’s ID is easier to fool than one that authenticates the chip.
• Write protection. Public and product tags should be locked or protected. See locking tags.

4. Access rules

• Review access levels: who can open which doors, at what times
• Remove levels nobody uses
• Check that temporary and visitor cards expire

5. Process

• Lost cards are disabled the day they are reported
• Leavers return cards and are removed from the system
• Disposed equipment has its tag record closed
• Someone owns the next audit date

Frequency

Full audit yearly, reconciliation quarterly. More on that in how often to audit access cards. For physical inventory, follow our walkthrough guide.

This checklist is general guidance and does not replace a professional security assessment for high-risk sites.