The IT and security assessment
A fixed-price review of your environment, quoted before it starts. We read your configuration under written authorization and give you a findings register that is yours whether or not you hire us. Tell us about your firm below, and the reply comes with a proposed scope.
What we review
- Identity: MFA coverage and method strength, admin accounts, stale access and conditional access.
- Endpoints: patch state, disk encryption and the machines that detection tooling does not cover.
- Network: firewall rules, remote access paths, segmentation and wireless settings.
- Backup and recovery: what is protected, whether copies are immutable and offsite, and whether anyone has watched a restore finish.
- Compliance posture: your controls mapped against the regimes that apply to you, on the same register Compliance & vCISO uses.
Price, and what you receive
The assessment is fixed-price, quoted before we start and agreed in writing. You receive three documents. The scope names each tool we use, the access it needs and the window it runs in. The findings register is written in plain language and ranked by risk and effort, so whoever does the remediation can work from it. The priced plan sets out the order we would fix things in. All three are yours, with no obligation to engage us afterward.
Authorization, and where the work stops
Nothing runs on your systems without your written authorization. Where a question can be answered by reading configuration, we read it; active tooling runs only where the scope names it. This is engineering work, and it stops where engineering stops. A penetration test, an audit opinion, an attestation or legal advice comes from someone else, and the report says where they take over. Remediation is scoped and priced separately.
Three steps
Scope call
A call with the engineer to agree what is in scope and what access is needed. You have the scope document and the fixed price before anything else happens.
Review
We examine the five areas above inside the authorized scope: configuration review and evidence collection first, active tooling only where the scope names it.
Findings walkthrough
A working session through the register: what we found, what fixing it takes and the order we would do it in.