IT and Cybersecurity Assessment Services
Know where you stand before an attacker or an auditor finds out.
A clear, written review of your systems, security, and backups, with a prioritized plan to fix what matters first.
IT and cybersecurity assessments, answered directly
By Joe Engelking, CEO. Updated October 2026.
What is an IT assessment?
An IT assessment is a structured review of your devices, network, email and cloud accounts, security settings, backups, and documentation. The result is a written report that shows what is working, what is risky, and what to fix first, so decisions about money and priorities rest on facts.
What does a cybersecurity audit include?
A cybersecurity audit reviews access controls, multifactor authentication, patching, endpoint and email protection, backups and recovery, staff training, and written policies. It compares what you have against a recognized standard or your insurer’s requirements and lists gaps in order of risk.
What do I get at the end of an assessment?
A written report with findings ranked by risk, plain-language explanations, and a prioritized remediation plan. You should also get documentation you can use for cyber insurance renewals, customer security questionnaires, and compliance reviews, plus a clear next step.
Can an assessment help with cyber insurance or customer questionnaires?
Yes. Insurers, customers, and regulators send detailed security questionnaires, and your answers become commitments. An assessment shows what is actually in place so the answers are accurate, and it finds gaps before someone else does. We complete these with clients and take responsibility for the answers.
| Area | What we review | Common findings |
|---|---|---|
| Accounts and access | Multifactor authentication, admin accounts, former employees | Shared passwords and old accounts still active |
| Devices and patching | Updates, endpoint protection, encryption | Unpatched systems and unprotected laptops |
| Email and phishing | Filtering, spoofing protection, training | Weak filtering and no staff training |
| Backups and recovery | Coverage, testing, recovery time | Backups that were never test-restored |
| Network and firewall | Configuration, segmentation, remote access | Open ports and a single flat network |
| Policies and documentation | Written policies, incident plan, inventory | Nothing written down |
How we handle a 20-page security questionnaire
Hartmann Electric does work at O’Hare Airport, so they have to meet certain regulatory standards to win jobs. They get sent 20-page questionnaires full of questions about SIEM, log retention, RMM, patch management, and firmware updates.
We fill them out with them, take responsibility for the answers, and make sure they are actually compliant with what they filled out.
Joe Engelking, CEO
More questions about IT assessments
It depends on the size of your environment and how deep the review goes, so there is no single price. We scope it after a short call about your setup and goals and give you the quote the same day, so you know what you will pay before you start.
It can, but an outside review gives a fresh view and avoids grading our own work. We recommend periodic independent assessments regardless of who manages your IT, and we are glad to work with your findings either way.
At least once a year, and again after major changes such as a merger, a move to the cloud, a new office, or a security incident. Threats and systems change constantly, so a review that is two years old is already out of date.
A vulnerability scan automatically looks for known weaknesses and produces a list. A penetration test has a person actively try to break in to show what an attacker could really do. Many small businesses start with an assessment and scan, and add a penetration test when a customer or regulation requires one.
Not much. We will ask for admin access, a list of your systems and vendors, and any existing policies or insurance questionnaires. We do the rest and keep disruption to your staff minimal.
You decide what to do with the findings. We can fix the high-risk items, help you budget for the rest, or hand the report to your current provider. The point is that you leave with a clear, prioritized plan and not a pile of jargon.
Yes. Insurance carriers and larger customers increasingly send security questionnaires, and an assessment gives you documented, accurate answers and shows which controls are missing before you submit. We have helped clients work through those questionnaires, so we know what they tend to ask.