What Does an IT Security Assessment Include? A Guide for GTA Businesses

The terms get mixed up, and the difference matters when you compare quotes. A security assessment looks across the whole environment and asks whether the right controls exist and work. It is mostly configuration review, interviews and evidence gathering.

• A vulnerability scan is an automated tool that looks for known weaknesses in devices and services. It is one input to an assessment, not a substitute for one. A scan will not tell you that a former employee still has a working Microsoft 365 account.
• A penetration test is a person actively trying to break in, within agreed rules. It answers "can someone get in this way?" for a defined scope. It is valuable once the basics are in place; run before them, it mostly confirms what an assessment would have found more cheaply.
• An audit measures you against a specific standard or contract, usually for a third party such as a client, a regulator or a certification body. An assessment is for you; an audit is for someone else.
• An online self-assessment, like our security assessment self-check, is a questionnaire you answer yourself. It is a good way to see which areas you are unsure about before paying anyone, but it only knows what you tell it.

The areas below are where small-business incidents in practice tend to start. An assessment that skips any of them is incomplete, whatever it is called.

1. 01

   Identity and sign-in

   Most business systems now sit behind one sign-in, usually Microsoft 365 or Google Workspace, so this is where an assessment should start. It should confirm that multi-factor authentication is enforced for every account, not just offered; list who holds global or super-admin rights and whether those accounts are used for everyday work; find accounts belonging to people who have left; and check for older sign-in methods that bypass MFA. Shared mailboxes and service accounts with passwords nobody has changed in years are common findings.

2. 02

   Email

   Email is still the most common way attacks start, through phishing and invoice fraud. The assessment should check the filtering in front of the mailboxes, the rules that forward mail outside the company, and whether your domain publishes SPF, DKIM and DMARC records so others cannot easily send mail that appears to come from you. When we checked public DNS for 290 mail-enabled Vaughan business domains in October 2026, only 17.9% enforced DMARC, so this is rarely a wasted check.

3. 03

   Devices and patching

   Every laptop, desktop and server should be listed, running a supported operating system, receiving updates, encrypted, and protected by current endpoint security. The assessment should compare the device list against what the management tools actually see; the gap between the two is often where the risk is. Servers deserve their own line, because an old file or application server is frequently the most exposed machine in the office.

4. 04

   Network, firewall and remote access

   This covers the firewall's firmware and rules, what is exposed to the internet, how staff and vendors connect remotely, whether guest Wi-Fi is separated from the business network, and who holds the admin credentials for each device. Remote access left open for a vendor years ago, or a firewall that no longer receives security updates, are typical findings.

5. 05

   Backups and recovery

   Having backups is not the same as being able to recover. A good assessment asks what is backed up, including Microsoft 365 or Google data, where the copies live, whether at least one copy is isolated from the network so ransomware cannot reach it, and when a restore was last tested. If nobody can remember the last test restore, that is a finding in itself.

6. 06

   Data and access

   Who can see the payroll folder, the client files, the shared drive? Assessments regularly find permissions that grew over years, and files shared with "anyone with the link". For businesses handling personal information, this ties directly to PIPEDA obligations, including reporting breaches that create a real risk of significant harm.

7. 07

   Monitoring and detection

   If someone signed in from another country at 3 a.m. and started creating mailbox rules, would anyone know? The assessment should establish what is logged, how long logs are kept, and whether anyone, internal or external, actually reviews alerts. Many businesses have security tools that alert into a mailbox nobody reads.

8. 08

   People and process

   Technology is only half of it. Is there a written process for starting and leaving staff? Do staff get any phishing awareness training? Is there a one-page plan for what to do in the first hour of an incident, with phone numbers that work outside office hours? Which outside vendors have access to your systems, and how?

The deliverable is where assessments differ most. A useful report has:

• A short summary a non-technical owner can read in five minutes: the few things that matter most and why.
• Findings ranked by risk, each with the evidence behind it (a screenshot, a setting, an account name), so the finding can be checked and the fix verified later.
• A practical fix for each finding, with a rough effort estimate, separating quick wins such as enforcing MFA from projects such as replacing a server.
• A list of what was not checked and why, so nobody assumes coverage that was never there.

Introductory reviews from IT providers are common. They are useful for spotting the obvious gaps, but be clear about what they are: a provider spending a few hours to understand your environment, usually in the hope of a support agreement. That is a fair exchange as long as you know it. Ask what access they need, what they will check, and whether you keep the findings whether or not you sign anything.

Online self-checks sit at the lighter end. Our Microsoft 365 security check and the self-assessment linked above are questionnaires; they help you ask better questions but do not inspect your systems.

A paid assessment is worth it when you need written evidence for a third party, such as a cyber insurance application or a client's security questionnaire, or when you want an independent view of your current provider's work. We do not publish package prices for assessments; outside a managed agreement, we bill IT work by the hour and scope the work in writing before starting, so you know the hours up front.

An assessment goes faster, and finds more, if a few things are gathered first:

• Admin access, or at least the name of whoever holds it, for Microsoft 365 or Google Workspace, the firewall, and any server.
• A rough list of staff, devices and the business applications you rely on.
• Your current IT provider's contact details and any documentation they have given you.
• What you know about backups: what is covered, where it goes, and when someone last restored a file.
• Any questionnaire you need to answer, such as a cyber insurance renewal form, so the assessment collects the evidence it asks for.

Once a year is a sensible baseline for most small businesses. Reassess sooner after anything that changes the picture: a cyber insurance renewal, a switch of IT provider, an office move, a merger or a new location, a key IT person leaving, or a security incident. Each of those moments tends to leave accounts, devices or rules behind that nobody owns. If you are preparing for an insurer specifically, our cyber insurance readiness checklist lists the controls insurers commonly ask about.

Before you agree to an assessment, ask: which of the areas above are in scope; whether it includes Microsoft 365 or Google configuration, not just the network; what access is needed and how it is removed afterwards; what the report looks like (ask for a redacted sample); who owns the findings; and whether fixing the findings is a separate decision. A provider confident in the work will answer all of these in writing.

We carry out security assessments for businesses across Toronto and the GTA, from our office on Keele Street. Local businesses can read about our IT support in Vaughan, and if you already know you want ongoing protection rather than a one-off review, our managed security services page explains how monitoring and response work after the assessment. For the regional picture behind those checks, our GTA small-business cybersecurity report sets out the Canadian data and our own measurement of GTA business email authentication.