Security Assessment · Posture Review
Service group: CybersecurityA clear picture of your security posture, and what to fix first
We review how your organization governs, protects and recovers its systems and data, compare what we find against recognized baseline controls, and give you a prioritized, plain-language plan.
At a glance
- Service
- A one-time, broad review of organizational and technical security posture with a prioritized remediation plan
- Best suited to
- Organizations of roughly 5 to 200 employees that do not know where their biggest security gaps are
- Areas reviewed
- Governance and policies, asset inventory, identity and MFA, endpoints, email, backup and recovery, network perimeter and incident readiness
- Deliverables
- Findings report, risk-ranked remediation roadmap, executive summary and a walkthrough meeting
- Not included
- Penetration testing, exploitation of vulnerabilities, code review, physical security testing and formal audit opinions
- Pricing basis
- Fixed fee based on size and complexity, proposed and confirmed in a written quotation
- How to start
- Book a consultation to agree the scope, or order a focused assessment such as the Microsoft 365 Security Assessment
What a security assessment is
A security assessment is a structured review of how well your organization manages cyber risk across people, process and technology. It looks wide rather than deep: who is responsible for security decisions, which policies exist, how accounts and devices are protected, how email is filtered, whether backups can be restored, and whether anyone knows what to do during an incident.
We use the Canadian Centre for Cyber Security baseline controls for small and medium organizations, the CIS Controls Implementation Group 1 safeguards and the NIST CSF 2.0 functions as reference points. These give the review a consistent structure and let you compare progress over time.
This is different from a vulnerability assessment, which scans systems for specific technical weaknesses, and from a penetration test, which attempts to exploit them. A posture review often recommends one of those as a next step, scoped separately.
When organizations ask for an assessment
No baseline to start from
Leadership wants to invest in security but has no objective view of what is already in place or where the biggest gaps are.
Insurance or client questionnaires
A renewal form or a client due-diligence request asks detailed questions nobody can answer with confidence.
A change of provider or leadership
A new IT provider, owner or executive wants an independent view of inherited risk.
After a near miss
A phishing incident, suspicious sign-in or lost laptop has raised concern about what else might be exposed.
What we examine
Governance and policy
Security roles, acceptable use, access approval, vendor risk and whether policies reflect what actually happens.
Asset and data inventory
Which devices, cloud services and data repositories exist, who owns them, and where sensitive information lives.
Identity and access
MFA coverage, administrator accounts, conditional access, guest access, password policy and offboarding practice.
Endpoints and patching
Protection coverage, encryption, update compliance, local administrator rights and unsupported operating systems.
Email and collaboration
Filtering, SPF, DKIM and DMARC, external sharing settings and forwarding rules.
Backup, recovery and incident readiness
Backup coverage, isolation and restore testing, plus whether an incident response plan and contact list exist.
Assessment scope
The written quotation lists the systems, locations and interviews included.
Included
- Interviews with leadership and whoever manages IT today
- Read-only review of Microsoft 365 or Google Workspace security configuration
- Review of endpoint protection, patching and encryption reporting
- Review of backup configuration and recent restore evidence
- Review of firewall and remote access configuration where access is provided
- Findings mapped to baseline controls with risk ratings
- Remediation roadmap and executive summary with a walkthrough meeting
Not included unless separately scoped
- Penetration testing or any attempt to exploit vulnerabilities
- Authenticated vulnerability scanning of every device (see Vulnerability Assessment)
- Application source code or web application security testing
- Physical security or social engineering tests
- Formal audit opinions, compliance attestation or certification
- Legal advice on privacy or breach obligations
Systems and references we commonly assess
- Microsoft 365, Entra ID, Intune and Microsoft Defender configuration
- Google Workspace admin and security settings
- Windows and macOS endpoint fleets and Windows Server
- Business firewalls, VPN and remote access gateways
- Cloud and on-premises backup platforms
- Canadian Centre for Cyber Security baseline controls, CIS Controls IG1 and NIST CSF 2.0 as reference frameworks
Who it suits
First-time security investment
Organizations that want to spend wisely and need a prioritized list rather than a sales pitch.
Regulated or confidentiality-focused firms
Professional services, healthcare and financial teams preparing evidence for clients, insurers or their own advisers.
Organizations planning CyberSecure Canada
Teams considering the CyberSecure Canada program who want a gap view against the baseline controls before deciding.
What you walk away with
- An objective view of your security posture in plain language
- Findings ranked by risk and effort so you can sequence investment
- Evidence to support insurance and client questionnaires
- A baseline you can measure future progress against
- Clear recommendations on whether deeper testing is worth scoping
How the assessment runs
Scoping
We agree which systems, sites and people are included, and arrange read-only access.
Interviews and data collection
Short interviews with leadership and IT contacts, followed by configuration exports and reports.
Analysis
Findings are mapped to baseline controls and rated by likelihood and business impact.
Report and roadmap
You receive the findings, an executive summary and a sequenced remediation plan.
Walkthrough
We present results to your leadership and answer questions; remediation can then be done by your team, by us, or by another provider.
Assessment options
Fixed fees are proposed and confirmed in a written quotation.
Full security assessment
The broad posture review described on this page, scoped to your size and locations.
Focused assessments
Microsoft 365 Security, Endpoint Security, Backup and Recovery or Network Health assessments when you already know the area of concern.
Infrastructure Health Check
A wider operational review that includes security alongside reliability and lifecycle risks.
Frequently asked questions
Is a security assessment the same as a penetration test?
No. We review configuration, practices and evidence against baseline controls. We do not attempt to exploit systems. If the findings justify it, we can help you scope a penetration test with a specialist firm.
Will the assessment make us compliant or certified?
It will not. It identifies gaps against recognized controls. Any compliance determination or formal assessment is a separate matter for your auditors and advisers.
Do we have to buy managed services afterwards?
No. The report is yours, and the roadmap can be carried out by your own staff, by us under a separate quotation, or by another provider.
How long does it take?
Timelines depend on size and how quickly access and interviews can be arranged; we confirm the schedule in your quotation.
Will it disrupt our staff?
Disruption is minimal. Most work uses read-only access and reports, plus a few short interviews scheduled around your team.
Related services
Products and packages
Industries we support
Service areas
Start with an honest view of your security posture
Tell us about your organization and we will propose an assessment scope and fixed fee in writing.