What a Cybersecurity Assessment Should Include, and What You Get at the End

A cybersecurity risk assessment for a small business is a scoped review of your computers, network, cloud accounts, data and daily habits that ends in a written, prioritized list of fixes. A good one combines automated scans with interviews and a hands-on review of settings. It rates every finding by how likely it is to be used against you and how much it would hurt, then hands you a plan your team can work through. If all you get at the end is a raw scanner export, you bought a scan, not an assessment.

This guide is for owners and IT leads who need one for a reason: an insurance renewal, a compliance requirement, a customer's security questionnaire, or a switch to a new IT provider.

What is a cybersecurity risk assessment for a small business?#

NIST, the federal standards agency, defines risk as a function of how likely a threat event is and how much harm it would do if it happened (NIST SP 800-30 Rev. 1 (opens in a new tab)). An assessment measures both for your business. The same missing patch can get the same severity score on the firewall that faces the internet and on a back-office PC that never touches customer data. They are not the same risk.

A good yardstick is the NIST Cybersecurity Framework (opens in a new tab). Its current version, CSF 2.0, was released in February 2024 (opens in a new tab). It sorts security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST also publishes a free Small Business Quick-Start Guide (opens in a new tab) that turns those functions into plain actions. A useful assessment tells you where you stand on all six, not only the technical ones.

Three services often get mixed up:

A scan is usually one input to an assessment. A penetration test is a separate, deeper purchase; our post on choosing between a vulnerability scan or a penetration test explains when each makes sense. Our security assessment services cover four types: vulnerability scanning, risk assessment, penetration testing and compliance gap analysis.

What should a cybersecurity assessment include?#

Scope is the list of what gets looked at, written down before anyone runs a tool. For a business with 5 to 100 employees, a complete scope covers these 10 areas. Most of them match actions in NIST's small business guide.

1. Asset inventory. Every computer, server, phone, printer, network device and cloud service, with a named owner for each.
2. Accounts and access. Who has administrator rights, which accounts belong to people who left, and whether multi-factor authentication (MFA) is on for email, banking, accounting, payroll, and Microsoft 365 or Google.
3. Internet-facing systems. The firewall, remote access, VPN, website and anything else reachable from outside.
4. Inside the network. Patch levels, unsupported operating systems, Wi-Fi setup, default device passwords, and whether guest traffic is kept apart.
5. Email. Filtering, spoofing protection, and how the office verifies a request to change where a payment goes.
6. Endpoint protection and monitoring. Whether every device runs antivirus or EDR, and whether anyone watches the alerts.
7. Backups and recovery. What gets backed up, where the copies live, and when someone last tested a restore. NIST lists "regularly backing up your data and testing your backups" as a priority.
8. Vendors. Which outside companies have remote access or hold your data.
9. People and plans. Security training, written policies, and an incident response plan with real names and phone numbers in it.
10. Your requirements. The legal, regulatory and contractual rules that apply to you, which NIST places under the Govern function.

The scope should also name the locations included, what is out of scope, when scanning will run, and who at your company authorized it. If a provider will not put that in writing, stop there.

How does a security assessment run?#

NIST's risk assessment guide breaks the work into four steps: prepare for the assessment, conduct it, communicate the results, and maintain it. In a small business, that looks like this:

1. Kickoff and scoping. Agree on the purpose first, because an insurance renewal, a HIPAA requirement and a provider change each call for a different emphasis. Bring the insurance application, customer questionnaire or contract clause that started all this.
2. Scans and configuration review. Automated tools check internal and external systems for known weaknesses. A person then reviews what scanners judge poorly: Microsoft 365 or Google admin settings, firewall rules, backup jobs and the endpoint protection console.
3. Interviews. Short conversations with the owner, the office manager, whoever handles IT and whoever moves money. A tool cannot tell you that one person approves bank detail changes by email. People can.
4. Validation and ranking. Someone confirms each finding is real, drops the false positives, and rates the rest by likelihood and impact. CISA recommends using its Known Exploited Vulnerabilities catalog (opens in a new tab) as an input to that ranking, so a flaw attackers are actively using moves ahead of a theoretical one.
5. Readout. Someone walks you through the findings, live and in plain language.
6. Maintain. Fixes get rechecked, and the assessment gets updated when something big changes.

What you get at the end: the report and the fix list#

The deliverable is where assessments differ most. A good report serves two readers: the owner who decides and the person who does the fixing. Expect these parts:

• Executive summary. One or two plain-English pages: the overall picture and the few issues that matter most.
• Scope and method. What was tested, when, with which tools, and what was left out.
• Findings with evidence. Each issue with the affected system, proof it exists, a severity rating and the business impact.
• The prioritized fix list. The page you will actually use. Each item has a rank, an owner, a rough effort and a target date.
• A risk register. A running list of risks with likelihood, impact and your decision on each: fix, accept or transfer (insurance is one way to transfer). NIST's small business guide recommends keeping one.
• Framework mapping, when needed. If compliance drove the work, findings mapped to the rule or framework in question, such as HIPAA, the FTC Safeguards Rule or CIS Controls Implementation Group 1 (opens in a new tab), the 56 safeguards CIS calls "essential cyber hygiene."
• Raw scan output as an appendix. Useful to your IT person, never the main document.
• A retest. Confirmation that the top fixes worked.

What a prioritized fix list looks like#

Picture a 20-person office. Here is a hypothetical top five from its assessment, invented for illustration, in the shape you should expect to receive.

Every row names a fix and an effort, in words an owner can act on. Vulnerability ID numbers and scanner jargon go in the appendix.

Red flags in an assessment report#

• The "report" is the scanning tool's export with a logo on the cover.
• Everything is rated critical, so nothing is.
• There is no scope statement and no test dates.
• Nothing covers people or process: no interviews, no questions about how money moves.
• There is no readout meeting and no retest.
• Findings do not tell you what to do next.

When a law, contract or insurer requires an assessment#

Some businesses do not get to choose.

• FTC Safeguards Rule. Non-bank financial businesses, including tax preparation firms, mortgage brokers and financial advisors, must base their security program on a risk assessment, and the rule requires that assessment to be written with criteria for evaluating risks (16 CFR 314.4 (opens in a new tab)). Without effective continuous monitoring, it also requires annual penetration testing and vulnerability assessments at least every six months. Institutions holding customer information on fewer than 5,000 consumers are exempt from several provisions, including the written-assessment and testing-schedule requirements (16 CFR 314.6 (opens in a new tab)). The FTC's plain-language guide (opens in a new tab) covers the rest of the rule.
• HIPAA. Covered entities and business associates must "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" (45 CFR 164.308 (opens in a new tab)). The rule labels it a required specification.
• Insurance and customer questionnaires. These vary by carrier and by customer. Hand the actual form to whoever does your assessment, so the findings answer its questions.

If compliance is the reason, a compliance gap analysis compares what you have with what the rule asks for. This section is general information, not legal advice. For how a rule applies to your business, talk with your attorney.

Getting an assessment in La Crosse, Eau Claire or Fort Myers#

Part of a good assessment happens in the building: the network closet, the Wi-Fi, the shared computer at the front desk. Coulee Tech provides local, on-site service from engineers in the region, not a remote-only help desk. Our Holmen and La Crosse team serves the Coulee Region, our Eau Claire office serves the Chippewa Valley, and our Fort Myers office serves Lee County. See cybersecurity services in La Crosse, cybersecurity services in Eau Claire and cybersecurity services in Fort Myers.

Our managed plans already include quarterly security scans and quarterly vCIO reviews. To see where you stand first, try our IT security checklist for businesses with under 100 employees.

Frequently asked questions#

Book a security assessment#

A useful assessment starts with a written scope and ends with a fix list you can act on. Book a security assessment and tell us what is driving it (an insurance renewal, a compliance requirement or a change of IT provider), so the scope matches the reason.