The short answer
An assessment should leave you knowing what could realistically go wrong, how likely and damaging each risk is, and what to do about it in what order. Insist on:
- Scope agreed before work starts
- Evidence for every finding
- Risk register by likelihood and impact
- Roadmap with owners and effort
- Executive summary for leadership, board or insurer
- Walkthrough and follow-up check
If a proposal does not promise these, ask why.
Deliverable by deliverable
| Deliverable | What good looks like |
|---|---|
| Scope and authorization | Systems, locations, cloud services and questions agreed; written authorization for any scanning. No paying for unneeded work, no gaps you assumed were covered. |
| A recognized baseline | Something you can look up, such as the NIST Cybersecurity Framework or the CIS Controls, so reports compare year to year; CISA's Secure Our World is a plain-language start for smaller organizations. Financial institutions will also want mapping to the FFIEC IT Examination Handbook, the GLBA Safeguards Rule or (New York-regulated firms) NYDFS Part 500; defense contractors may need CMMC 2.0. |
| Coverage where attacks start | At minimum: identities and admin access, MFA, devices and patching, email and domain authentication, remote access and internet-facing systems, backups and restore tests, cloud configuration, third-party access, payment change verification, incident response. |
| A risk register, not a vulnerability count | Scanner items grouped, de-noised and ranked: missing MFA on an admin account above a low-severity printer finding. |
| A roadmap you can budget for | Quick wins in days, next-quarter projects, longer-term work; each with owner and effort, so you can plan spending in US dollars without surprises. |
| Reports for two audiences | A plain-language executive summary and a technical report your IT team or provider can act on. |
Example: what a useful finding looks like
| Field | Example |
|---|---|
| Finding | Backups are stored on a network share that all staff accounts can reach |
| Evidence | Share permissions export, dated, attached as appendix B |
| Risk | Ransomware running as any user could encrypt or delete the backups |
| Likelihood / impact | Medium / High |
| Recommended fix | Move one copy offline or to immutable storage; restrict access to a dedicated backup account; test a full restore |
| Effort | Medium |
| Suggested owner | IT lead with the backup provider |
Red flags when comparing proposals
- A "score" with no evidence. A number out of 100 says little without the findings.
- Scan-only work sold as an assessment. Configuration review and talking to the people who run your systems find what scanners cannot.
- Promises of compliance or certification. An assessment shows risk and gaps. Compliance with HIPAA, the GLBA Safeguards Rule or state privacy law is a legal question, and certification, such as a CMMC assessment or a SOC 2 report, comes from an independent assessor or accredited body.
- No plan for your data. Ask how access is granted, how sensitive configuration data is stored and when it is deleted.
- The assessment as a sales funnel. Findings that all point to one product deserve a second look.
Rather talk it through? Tell us what prompted the question, whether an insurer, a client or a near miss, and we will scope an assessment around it. Talk to a Promatics specialist
Common objections, answered honestly
Scope scales down for small organizations, an independent review backs your IT person rather than replacing them, AI cannot log in to your systems or own the findings, the work barely disrupts staff, and ranking means you fix first where risk drops most.
The five objections in full
| Objection | Honest answer |
|---|---|
| "We are too small to need this." | Smaller organizations are attacked through the same routes: stolen passwords, phishing, unpatched devices. Scope and effort scale down with your size. |
| "Our IT person already looks after security." | Often well. An independent review gives them evidence, priorities and support for budget requests, and catches what anyone misses in systems they built. |
| "We could ask an AI tool." | A useful starting point. It cannot log in to your tenant, confirm which servers lack protection, interview your finance team about payment changes, or put its name to the findings. |
| "It will disrupt staff." | Mostly configuration review and short interviews; any scanning runs in agreed windows. |
| "We cannot afford to fix everything." | You do not have to: ranking means spending first where risk drops most. |
What working with Promatics looks like
- Scoping callSystems, sites, questions and scanning rules agreed in writing.
- CollectRead-only named accounts, approved scans, short interviews with IT, finance, operations.
- AnalyzeCompare with a recognized baseline; rank by likelihood and impact.
- Report and walk throughExecutive summary, technical report and roadmap, reviewed together.
- Follow upAfter an agreed period, check fixes and update the register.
You can then fix the findings with your own team, another provider or us. Assessment data is deleted at the end as agreed.
Buyer's checklist
- Written scope and scanning authorization
- Named baseline or framework
- Identity, devices, email, network, backups, cloud and process all covered
- Evidence attached to every finding
- Findings ranked by likelihood and impact
- Roadmap with owners and effort estimates
- Executive summary and technical report
- Walkthrough with leadership
- Follow-up check included or priced
- Clear handling and deletion of assessment data
When to bring in help
A very small environment on one cloud platform can self-assess with CISA's small business guidance and the NIST Cybersecurity Framework. Bring in a professional when an insurer, client or board wants evidence, systems grew through several people and providers, after a merger or cloud move, or after a near miss. Our security assessments are built around these deliverables, and remediation can follow as a project or as part of our cybersecurity services.
Limitations
This guide describes a general security assessment. It is not a penetration test specification, an audit standard or legal advice, and an assessment does not certify compliance.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Secure Our World, Cybersecurity and Infrastructure Security Agency (CISA)
- Cybersecurity Framework, National Institute of Standards and Technology
- Data security, Federal Trade Commission
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.