What an IT & security risk assessment actually checks

Why start with an assessment

Most businesses cannot answer basic questions about their own IT: how many devices they have, who still has access, whether the backups would actually restore. That is not negligence. It is what happens when technology grows one urgent fix at a time.

An assessment answers those questions in writing before anyone recommends spending money. Here is what mine covers, and why each part matters.

1. A device inventory

Every computer, server, network device and cloud account that touches your business, with its age, operating system and support status. Unknown devices are unmanaged devices, and unmanaged devices are where problems start.

The inventory alone often surfaces the first surprises: machines past the end of security updates, a server nobody remembers setting up, or accounts belonging to people who left.

2. A Microsoft 365 or Google Workspace security review

For most small businesses, the email and identity platform holds the keys to everything else. The review looks at sign-in protection and multifactor authentication, admin accounts, external sharing, email authentication for your domain, and the settings that decide how easy it is for an attacker to get in or for data to leave.

This is usually where the most important findings are, because the default settings favour convenience over protection.

3. A backup check

Not just whether backups exist, but what they cover, where the copies live, and whether a restore has ever actually been tested. A backup job that reports success is not proof you can recover.

The goal is a clear answer to one question: if your most important system disappeared today, how long until you are working again, and what would be lost?

4. A written, risk-ranked findings report

Everything is written up in plain language and ranked by risk, so urgent items are separated from roadmap items. You get a report you can act on with anyone, not a list designed to sell a contract.

5. A 30-minute walkthrough

We go through the report together. You can ask questions, push back on priorities, and decide what to do next, including doing nothing. There is no obligation, and the report is yours to keep either way.

What it is not

It is not a penetration test. Active testing of your defences is a separate engagement, coordinated through a certified security partner when it is needed.

It is not a compliance audit. If you work under HIPAA, PCI-DSS or SOC 2, the assessment shows where your technology stands, but Lebtek is the technical partner, not the auditor or your attorney.

What I need from you

Three things: admin access to Microsoft 365 or Google Workspace, or a short guided session if you would rather not share credentials; a contact on site who can let me see the equipment; and 30 minutes for a kickoff call.