Risk assessment
Cybersecurity Risk Assessment for Small Businesses
A cybersecurity risk assessment tells you where your business is exposed, how likely each problem is, and what to fix first.
You get a plain-English report ranked by risk, not a hundred pages of scanner output.
- Serving Los Angeles
- Business IT since 1998
- Remote first, on-site when needed
Why assess
What a cybersecurity risk assessment gives you
Most owners know security matters but are not sure where to start. An assessment replaces guesswork with a list. It shows which accounts lack MFA, which computers are out of date, whether backups would really restore, and who has access to what.
Insurers, clients, and regulations such as the FTC Safeguards Rule and HIPAA increasingly expect a documented risk assessment. Having one ready makes those conversations easier.
You receive
- A ranked list of risks with plain explanations
- Quick wins you can fix this week
- Longer-term recommendations with rough effort
- Notes that support insurance and client questionnaires
- A follow-up meeting to walk through results
10 areas we check in a cybersecurity risk assessment
1. Accounts and MFA
Who can sign in, how, and with what protection.
2. Admin rights
Who holds the keys, and whether they need them.
3. Devices
Operating system age, updates, encryption, and protection.
4. Email
Filtering, forwarding rules, and impersonation risk.
5. Network
Firewall, segmentation, WiFi, and remote access.
6. Backups
Coverage, encryption, separation, and restore tests.
7. Data
Where sensitive files live and who can open them.
8. Vendors
Outside services with access to your systems.
9. People
Phishing awareness and safe habits.
10. Response
Whether there is a plan when something goes wrong.
How the assessment works
- KickoffA short interview about how the business runs and what data it holds.
- ReviewRemote and on-site checks of accounts, devices, network, and backups.
- ReportA ranked list of risks and a meeting to plan the fixes.
Cybersecurity risk assessment vs. penetration test
A cybersecurity risk assessment looks broadly at how your business is protected: settings, habits, gaps, and plans. A penetration test is narrower and deeper. It tries to break in to prove a weakness is real. Most small businesses should start with an assessment, then consider penetration testing once the basics are fixed.
Using a recognized framework
We organize findings around the NIST Cybersecurity Framework, so results are easy to compare year to year and map to insurer or regulatory questions. For small businesses, CISA’s small business guidance is another good reference.
What happens after
You can fix the findings yourself, have your IT staff handle them, or have us do the work. Many clients start with MFA, backups, and patching, which remove a large share of risk quickly. We recommend repeating the assessment yearly, or after big changes like an office move or a new system.
Who it is for
Law firms, accounting firms, medical and dental offices, financial advisors, and any business that holds client data or moves money by wire. See also IT for law firms and FTC Safeguards Rule compliance.
What we need from you
An hour with the owner or office manager to talk about how the business runs, admin access to the systems we review, and a list of the outside services you use, such as accounting software, client portals, and banking. That is enough for a thorough cybersecurity risk assessment. Everything we see is treated as confidential, and access we are given for the review is removed when it is complete unless you ask us to keep supporting you.
Cybersecurity risk assessment FAQ
How long does it take?
Most small offices take a few days from kickoff to report, depending on size and how many locations there are.
Will it disrupt work?
No. Most checks run in the background, and on-site time is short.
Do we need one every year?
Yearly is a good habit, and after any major change to your systems.
Is the report technical?
The main report is plain English. Technical details are included for your IT staff if you have them.
Related services
Cybersecurity
Our full cybersecurity overview.
Managed security services
Keep protections running every day.
Law firm IT risk checklist
A 15-point self-check.
Cyber insurance requirements
What insurers ask about.
Find your biggest risks before an attacker does
Book a cybersecurity risk assessment and get a ranked list of fixes.
On-site and remote IT since 1998.