How to Run a Cybersecurity Assessment for Your Business (Without Overpaying)
Most businesses don't know their actual security exposure until something breaks. A ransomware attack, a phishing incident, or a compliance audit becomes the first real look at what's unprotected. Here's how to get ahead of that — with a 10-point checklist you can work through yourself or use to evaluate a consultant.
A cybersecurity assessment covers 10 domains: network security, endpoint protection, access controls, backup and recovery, employee training, incident response, vendor security, compliance requirements, physical security, and insurance. For most small businesses, a basic DIY assessment using the CIS Controls framework is a reasonable starting point. Hiring a consultant makes sense when you have compliance obligations, client data at risk, or a significant infrastructure change. Red flags: vendors who lead with scare tactics, refuse to put scope in writing, or bundle products without explaining why. The Tech Ref evaluates cybersecurity vendors on your behalf at no cost.
Why Most Businesses Don't Know Their Real Risk Until It's Too Late
There is a predictable pattern in how small and mid-sized businesses discover their cybersecurity gaps. The first signal is almost never a proactive audit — it is an incident. A vendor gets compromised and sends malicious invoices from a trusted email address. An employee clicks a link and ransomware encrypts the file server. A client calls to say their data appeared somewhere it should not have been.
At that point, the conversation shifts from "how exposed are we?" to "how bad is this?" The distinction matters because post-incident discovery is always more expensive than pre-incident assessment. Breach response, forensics, legal notifications, client communications, and potential regulatory fines dwarf the cost of finding the gap before exploitation.
The reason most businesses skip proactive assessment is not indifference — it is that the cybersecurity industry does a poor job of making assessment accessible. Vendors use technical jargon and fear-based selling to push expensive engagements that don't match actual risk. Business owners walk away unsure of what they bought, whether it addressed the right problems, and whether the price was justified.
This guide skips that. It covers what a real cybersecurity assessment includes, what you can evaluate yourself, where you need outside help, and how to evaluate vendors without getting oversold. It connects directly to IT procurement decisions and the broader question of how your IT security posture fits your overall IT strategy — see also our guide to IT vendor management for how to think about security vendors alongside your other IT relationships.
The 10-Point Cybersecurity Assessment Checklist
A complete cybersecurity assessment covers people, process, and technology across ten domains. Work through each one honestly — the goal is an accurate picture of current state, not a passing grade.
Network Security
Your network is the perimeter through which most attacks enter. Assess whether your firewall is current and properly configured, whether Wi-Fi networks are segmented (guest traffic separated from internal traffic), whether remote access uses a VPN, and whether unused ports and services have been disabled. An unpatched firewall, an open RDP port, or a flat network where any device can reach any other device are high-priority findings.
What to look for: Firewall model and firmware age, guest Wi-Fi isolation, VPN policy for remote workers, port scan of internet-facing assets (tools like Shodan show what is publicly visible).
Endpoint Protection
Every laptop, desktop, server, and mobile device that touches your business data is a potential attack surface. Assess whether endpoint detection and response (EDR) software is deployed on all devices, whether operating systems and applications are current on patches, and whether there is visibility into what devices are connecting to your network. "No antivirus" was acceptable 20 years ago. Today, unmanaged endpoints are the most common ransomware entry point.
What to look for: EDR coverage across all devices (not just laptops), patch management process and cadence, mobile device management (MDM) for phones and tablets used for work, device inventory — do you know every endpoint on your network?
Access Controls
Who can access what — and could they access more than they need? Weak access controls are behind a significant portion of data breaches, including both external attacks and insider incidents. Assess whether multi-factor authentication (MFA) is enforced for email, cloud applications, and remote access. Review whether users have least-privilege access (no one has admin rights they don't actually use). Check whether former employees' accounts have been disabled promptly.
What to look for: MFA enrollment rate, admin account count and justification, offboarding process for account termination, privileged access to sensitive systems (finance, HR, customer data), password policy and whether a password manager is in use.
Backup and Recovery
Backup is your primary defense against ransomware. But many businesses discover their backup is inadequate — or nonexistent — only after an incident. Assess whether business-critical data is backed up, how frequently, where backups are stored (offsite or cloud backups isolated from production systems), and whether backups have been tested by actually restoring from them. An untested backup is not a backup — it is a hope.
What to look for: Backup frequency for critical systems (daily minimum, hourly for high-value data), offsite/cloud backup isolation from production (ransomware encrypts network-connected backups), restore testing cadence, recovery time objective (how long to restore) vs. actual business tolerance for downtime.
Employee Security Training
Phishing is responsible for the majority of successful breaches — and phishing succeeds because employees click. Assess whether your organization runs security awareness training, how recently it was conducted, and whether training is accompanied by simulated phishing tests to measure actual click rates. One-time annual training is better than nothing but falls short of what the threat environment requires.
What to look for: Training frequency and format (once-a-year compliance training vs. ongoing micro-training), phishing simulation results and trend over time, coverage of high-risk scenarios (invoice fraud, impersonation of executives, fake IT support calls), and whether employees know how and where to report suspicious activity.
Incident Response Plan
When something goes wrong — and eventually something will — does your business have a documented plan for how to respond? An incident response plan (IRP) defines who makes decisions, who gets notified (including legal counsel, cyber insurer, and affected customers), how systems get isolated to prevent spread, and who handles external communications. Businesses without a plan spend the first hours of an incident figuring out who is in charge while the damage compounds.
What to look for: Written IRP that has been reviewed in the last 12 months, defined roles and contact list (including cyber insurance carrier), tested tabletop exercise — has the team practiced the plan? — regulatory notification timelines documented (some regulations require notification within 72 hours).
Vendor and Third-Party Security
Your security is only as strong as the weakest link in your vendor chain. Third-party breaches — where a vendor is compromised and that compromise extends to your business — are an increasing share of total incidents. Assess what access your vendors have to your systems and data, whether your MSP or IT provider uses MFA and privileged access management, and whether vendors with access to sensitive data have completed a security review or provided a SOC 2 report.
What to look for: Vendor inventory with access levels, MSP security practices (your MSP typically has admin access to everything — their security is your security), data processing agreements (DPAs) with vendors who handle client data, and review of any third-party integrations with admin access to your cloud applications.
Compliance Requirements
Many businesses have compliance obligations they are only partially aware of. Healthcare organizations handling patient data must meet HIPAA requirements. Businesses that accept credit cards fall under PCI DSS. Organizations handling European personal data must satisfy GDPR. Government contractors face CMMC. State-level requirements — like New York's SHIELD Act — apply broadly. Assess which frameworks apply to your business and where your current controls fall short.
What to look for: Industry and client contract obligations, state privacy law applicability, any data breach notification requirements you're subject to, and whether your current controls map to the relevant framework — even partially. Compliance gaps identified before an audit are correctable; gaps discovered during an audit carry penalties.
Physical Security
Cybersecurity assessments often stop at the digital perimeter, but physical access to systems and devices is a legitimate attack vector. A visitor who can walk into the server room, an unlocked laptop left unattended, or a USB drive left in a parking lot are physical security problems with digital consequences. Assess whether server and networking equipment is physically secured, whether clean desk and screen-lock policies are in place and enforced, and whether office access controls are appropriate for the sensitivity of the data handled.
What to look for: Physical access controls on server rooms and network closets, screen-lock auto-timeout on workstations, device encryption on laptops and mobile devices (so stolen hardware doesn't become a data breach), visitor access policies.
Cyber Insurance Coverage
Cyber insurance is not a substitute for security controls — but it is the financial backstop when controls fail, and they eventually do. Assess whether you have cyber insurance, whether the coverage limits are appropriate for your revenue and data exposure, and whether you understand what is and isn't covered. Insurers increasingly require specific controls (MFA, EDR, backup isolation) as prerequisites for coverage or for claims to be honored. An unchecked gap in your controls can void a claim at the worst moment.
What to look for: Policy limits relative to breach response costs in your industry, coverage inclusions (ransomware, business interruption, regulatory defense, notification costs), insurer's security control requirements and whether you currently meet them, and whether your policy covers third-party liability if a breach affects clients.
DIY vs. Hiring a Cybersecurity Consultant
Not every business needs an outside consultant to run a useful assessment. The right approach depends on your internal expertise, compliance obligations, and what you intend to do with the results.
| Factor | DIY Assessment | External Consultant |
|---|---|---|
| Cost | Staff time only (no direct fees) | $1,500–$5,000 basic; $5,000–$15,000 with pen testing or compliance scope |
| Best for | Businesses with internal IT staff; no compliance obligations; small footprint | Compliance deadlines (HIPAA, PCI, CMMC); client data at risk; significant IT change; prior incident |
| Framework to use | CIS Controls (tiered by business size); NIST CSF (broader but more complex) | Consultant matches framework to your compliance obligations and industry |
| Objectivity | Limited — internal staff may underreport gaps or lack visibility into their own blind spots | Higher — external view catches what internal teams normalize or miss |
| Output | Internal gap list with self-assessed priority; useful for planning, not for client or insurer consumption | Written report with findings, risk ratings, and recommendations; usable for compliance, audit, and insurance documentation |
| Technical depth | Limited by internal expertise; policy and process gaps are easier to find than technical vulnerabilities | Includes vulnerability scanning, network analysis, and optionally penetration testing |
| Timeline | Flexible; can be done over several weeks alongside normal operations | Typically 2–4 weeks for assessment and reporting; 4–8 weeks for comprehensive engagements |
Start with the CIS Controls. The Center for Internet Security publishes a prioritized set of controls specifically designed for resource-constrained organizations. The Implementation Groups (IG1, IG2, IG3) let you start with the 56 most essential controls for small businesses before tackling the full 153-control framework. It is free, framework-agnostic, and maps to most compliance requirements. Start there before spending money on a consultant — you will have a better conversation with any vendor if you know your current position on a recognized framework.
Red Flags When Evaluating Cybersecurity Vendors
The cybersecurity market has a vendor problem. Fear sells — and the industry has not been shy about using it. Here are the warning signs that should slow down or stop an evaluation.
Red flag: Leading with scare tactics instead of your actual risk profile. A legitimate cybersecurity assessment starts with understanding your environment, your data, and your threat landscape. A vendor who opens with breach statistics and worst-case scenarios before asking a single question about your business is selling, not advising. Your risk profile is specific to your industry, size, client data sensitivity, and existing controls. Generic fear does not map to specific risk.
Red flag: No written scope of work before engagement. Any cybersecurity assessment of consequence should have a clearly defined scope in writing before work begins: what systems will be assessed, what testing methods will be used, what deliverables you receive, and what is explicitly out of scope. Verbal commitments about what is "included" become disputes after the engagement. If a vendor will not provide a written scope, that tells you something about how they operate.
Red flag: Recommendations that are entirely their own products. A vendor who assesses your environment and concludes that the solution to every finding is one of their own products has a conflict of interest that is structural, not incidental. A legitimate assessment produces prioritized findings with remediation options — which may include their products, other vendors' products, or process changes that cost nothing. If the output maps cleanly to their sales catalog, the assessment served their interests, not yours.
Red flag: No review of prior incident history. Understanding whether your business has had security incidents — and what happened — is a standard part of any serious assessment. A vendor who does not ask about past incidents cannot properly contextualize current findings. Incident history reveals which controls failed, what data was exposed, and whether the same vulnerabilities remain. Skipping this step means the assessment is based on the current state snapshot rather than your actual risk trajectory.
For a deeper look at evaluating security vendors specifically, see our guide to cybersecurity services for business and the broader framework in our IT vendor management guide.
How The Tech Ref Helps With Cybersecurity Assessment
Navigating the cybersecurity vendor market is genuinely difficult. Every provider claims comprehensiveness and vendor-neutrality. Pricing is opaque. Scope creep is common. And most businesses do not have the internal expertise to evaluate the quality of a security assessment until after they have paid for one.
The Tech Ref handles cybersecurity vendor evaluation as part of our broader IT procurement service. Here is what that looks like in practice:
- Scope review before you engage: We review proposed scopes of work before you sign anything — flagging gaps, vague language, and exclusions that will matter later.
- Provider comparison: We compare cybersecurity consultants on methodology, qualifications, deliverable quality, and price — across providers who serve businesses of your size and in your industry.
- Compliance mapping: We help you understand which frameworks apply to your business before you engage a consultant — so you are not paying for discovery work you could have done in advance.
- Managed IT coordination: If you are evaluating managed IT services that include security components, we ensure security coverage is explicit and measurable — not bundled in language that sounds comprehensive but delivers little.
- Ongoing vendor relationship: After you engage a cybersecurity provider, we remain the contact for scope disputes, follow-up assessments, and renewals — so you are not managing those relationships alone.
This service costs your business nothing. We are compensated by the providers we place, which means our incentive is to find the right fit for your actual risk profile — not to push the highest-margin engagement. The same model applies across every IT category we work with.
If you are ready to run a cybersecurity assessment — or evaluating consultants and want a second opinion on a proposal you have received — email hello@thetechref.com. Tell us your industry, size, and what you are trying to accomplish. We will help you figure out the right next step.
Frequently Asked Questions
What is a cybersecurity assessment for a business?
A cybersecurity assessment is a structured evaluation of your business's IT environment to identify security gaps, vulnerabilities, and risks before they become incidents. It covers network security, endpoint protection, access controls, data backup and recovery, employee training, incident response readiness, vendor security, compliance requirements, physical security, and cyber insurance coverage. The goal is an honest picture of where you are exposed — so you can prioritize fixes based on actual risk rather than vendor recommendations.
How much does a cybersecurity assessment cost for a small business?
For a small business (under 50 employees), a basic cybersecurity assessment by an outside consultant typically runs $1,500 to $5,000. More comprehensive assessments including penetration testing, compliance gap analysis, or detailed reporting can run $5,000 to $15,000. Many managed IT providers include basic security reviews as part of their service agreements. A DIY approach using frameworks like NIST CSF or CIS Controls costs staff time rather than direct fees, but quality depends heavily on internal IT expertise.
How often should a business run a cybersecurity assessment?
For most small and mid-sized businesses, a full cybersecurity assessment once per year is a reasonable baseline. Certain events should trigger an unscheduled assessment: a security incident or breach, a significant infrastructure change (major software migration, new office, remote work expansion), adding a new line of business with different data handling requirements, or an approaching compliance deadline. Annual rhythm plus event-triggered reviews covers most organizations adequately.
What is the difference between a cybersecurity assessment and a penetration test?
A cybersecurity assessment is a broad evaluation of your security posture across people, process, and technology — identifying gaps, reviewing policies, and measuring controls against a framework. A penetration test (pen test) is a targeted, technical exercise where a security professional actively attempts to exploit vulnerabilities in your systems. Pen tests are a component of a thorough assessment, but a full assessment covers far more ground. Most small businesses should start with a complete assessment before investing in a standalone pen test.
How does The Tech Ref help with cybersecurity assessments?
The Tech Ref evaluates cybersecurity vendors and consultants on your behalf — comparing scope, methodology, pricing, and qualifications — so you do not overpay for a generic report or undersell your needs to a vendor with limited expertise. We also help businesses understand their compliance requirements before engaging a consultant, which prevents scope creep and surprises. This service costs your business nothing. We are compensated by the providers we place, with our incentive aligned to finding the right fit.
The Tech Ref is a free, vendor-neutral IT procurement service for small and mid-sized businesses. We handle every vendor, every quote, and every evaluation — at zero cost to your business.
Get a Vendor-Neutral Cybersecurity Assessment Review
Tell us your industry, team size, and what you are trying to protect. We will help you identify the right assessment approach and evaluate providers without getting oversold.
Email hello@thetechref.com