Cybersecurity assessment: know where you’re exposed
A practical review of your accounts, devices, email, backups and processes, benchmarked against recognised frameworks, with a clear plan to fix what matters most.
The challenge
Most businesses don’t know their real risk
You might have antivirus, a firewall and backups in place, but without an independent check it’s hard to know whether they’re configured properly, whether they cover everything and what an attacker would try first.
Insurers, customers and auditors are also asking harder questions. An assessment gives you clear answers and evidence.
Gaps we commonly find
- Multi-factor authentication missing on some accounts
- Backups that have never been test-restored
- No up-to-date list of devices and software
- Former staff accounts still active
- No written incident response or recovery plan
What’s included
What the assessment covers
Every arrangement is scoped around your business, but most include:
Identity & access
Multi-factor authentication, admin accounts, password practices, conditional access and leaver processes.
Devices & patching
Device inventory, operating system and application updates, endpoint protection and encryption.
Microsoft 365 & email
Security settings in Microsoft 365, mailbox protection, sharing controls and email authentication.
Backup & recovery
What’s backed up, where it’s stored, how long it’s kept and whether restores actually work.
Policies & processes
Incident response, onboarding and offboarding, supplier access and documentation.
Report & roadmap
A plain-English report with risk ratings and a prioritised roadmap, from quick wins to longer-term work.
How we work
Our process
Scope
Agree the systems, sites and questions in scope.
Review
Talk with key people and check configurations directly.
Report
Rate each finding by risk and explain it in plain English.
Roadmap
Agree priorities, timeframes and budget for the fixes.
Why Zenvia
Why choose Zenvia for your assessment?
We benchmark against the ACSC Essential Eight and the CIS Critical Security Controls, then turn the findings into practical actions. You get a plan you can act on, whether or not you engage us to do the work.
- Benchmarked against recognised frameworks
- Configurations checked, not just questionnaires
- Findings ranked by real business risk
- Useful evidence for insurers and customers
- No obligation to use us for the fixes
FAQs
Frequently asked questions
Which frameworks do you assess against?
We use the ACSC Essential Eight and the CIS Critical Security Controls. For smaller businesses we focus on CIS Implementation Group 1, the recommended baseline for organisations with limited IT resources.
How long does an assessment take?
It depends on the size of your business and how many systems are in scope. Most small business assessments can be completed within a few weeks, and we’ll confirm the timeframe when we agree the scope.
Will an assessment disrupt our staff?
Very little. We need short conversations with a few key people and admin access to review settings. Most of the work happens in the background.
Can an assessment help with cyber insurance?
Yes. Insurers commonly ask about MFA, backups, patching and incident response. The assessment shows where you stand on each and what to improve before renewal.
Related services
You might also need
Essential Eight
A gap assessment and practical roadmap towards the Essential Eight at a level that suits your business.
Vulnerability Scanning
Regular scanning of your network, devices and website, with prioritised fixes and help arranging penetration tests.
IT Governance & Compliance
IT policies, risk management, access reviews and privacy readiness that bring structure to your technology.
Ready to get started?
Find out where your business stands. Book an assessment and get a clear, prioritised plan.