The Security Reality Check
The Security Reality Check is an independent, fixed-fee review of whether the IT and security services you pay for are actually being delivered, and who is responsible for what they leave uncovered.
What it is
The review takes one to two weeks and covers the agreements, configuration records, and operational evidence behind your IT and security, across twelve domains. We read what exists and talk to the people involved. We do not test systems or change anything.
The environment, participating providers, available records, and people who need to attend are confirmed during scoping. They determine the final scope, fee, and schedule.
What you get
You receive one written report, walked through with leadership. The report is yours to keep and use, with or without further work from us. Read a sample report.
Independent of your providers
We do not run or monitor your systems, sell tools, or take commissions or referral fees, and we do not assess work we did. Read our six independence commitments.
Who it is for
The review is for owners and managing partners who pay for IT and security, through an outside provider, their own staff, or both, and cannot tell from the invoices and reports whether it is working or what risks it leaves open. Internal IT teams can also use the review when they manage security with limited time and budget, and need to decide whether to harden what they have or plan for a growing program.
You hold client data or client funds, and you want someone with no stake in the answer to check what the records show before the next renewal, audit, or insurance review. The review is suited to law firms, medical practices, insurance agencies, accountants, and other practices with the same duties.
- Typical duration
- 1-2 weeks, from records received to walkthrough
- Scope
- 12 domains
- Pricing
- Fixed fee, quoted after free scoping by call or email
What we need from you
You name a point of contact and arrange participation from the people responsible for the systems in scope. We start with agreements, configuration exports, and operational records. Before work begins, we confirm when the review window starts and how unavailable records or delayed provider access affect the schedule and conclusions. Do not send confidential records with your initial inquiry.
Before the report is final, you and participating providers can correct factual errors or supply relevant records. A missing record is reported as missing, not scored as a failure. How we handle corrections.
Preparing for the review
Start by identifying who holds your service agreements, configuration records, and operational reports. Your point of contact helps arrange access to those records and conversations with the people responsible.
During scoping, we agree which records and participants are needed and discuss the time required from your team and providers. If records are unavailable, we explain how that limits the conclusions and affects the schedule before work begins.
You do not need to collect or send confidential records for the initial inquiry.
What you receive
The report is one document. These are its three main parts; the full report has five sections. Each finding carries a NIST CSF 2.0 reference to make its basis easier to discuss.
Executive findings summary
The executive summary explains what the reviewed evidence supports, where questions remain, and which findings require a leadership decision.
Security confidence scorecard
The scorecard brings together domain ratings, control ownership, and immediate actions. Missing ownership and insufficient evidence are clearly identified.
30/60/90-day roadmap
The roadmap puts recommended actions in priority order, with an owner and the evidence needed to confirm completion.
See the report structure and one finding as written
Decisions the report can support
- Whether to renew a provider on the same terms.
- What to show an auditor, an insurer, or a client who asks how their information is protected.
- Which fixes to fund first, and who owns each one.
- Whether the controls around wire, escrow, and trust account instructions would stop a compromised mailbox or a forwarding rule nobody is watching.
What we review
Every review covers the same twelve domains.
Governance
Whether security decisions, owners, and exceptions are documented and reviewed.
Asset Management
Whether you can identify the devices and systems that need protecting.
Identity & Access
Whether access is limited to the right people and removed when it should be.
Endpoint Security
Whether computers are managed, protected, and supported across their working life.
Network Security
Whether network access and equipment are configured to limit inappropriate connections.
Email Security
Whether email protections reduce spoofing, malicious delivery, and unsafe forwarding.
Vulnerability Management
Whether operating systems and everyday applications are patched within an agreed timeframe.
Monitoring & Detection
Whether important alerts are seen by someone responsible for acting on them.
Incident Response
Whether people know who does what when something goes wrong and how response is recorded.
Vendor Risk
Whether provider responsibilities, access, and assurances are understood before they affect your business.
Security Awareness
Whether people receive practical guidance and the business learns from reported concerns.
Backup & Recovery
Whether copies can be recovered when needed and are protected from deletion.
Process and timing
- 1.
Scoping
Before work begins we confirm the environment, the providers taking part, the records we will ask for, who attends, and the fee. This happens on the free scoping call, or by email if you prefer, and needs nothing confidential from you.
- 2.
Review
We compare the agreement, the configuration, and the operational records against the twelve domains and record where they do not support the same conclusion. See how we check the evidence.
- 3.
Walkthrough
Findings are delivered to leadership in plain language, with the roadmap in order, so the first conversation is about what to do next.
We resell nothing and take no commissions. We do not perform technical testing or implementation as part of this review. If either is needed, we identify it during scoping and it belongs in an agreed scope with the appropriate provider or specialist. Ongoing oversight is separate work. Read more on how we work.
Find out what is actually protecting your business
Tell us about the concern or decision that prompted your interest. We reply within two business days to arrange a free 30-minute scoping call, or to scope by email if you prefer. You get a written fixed-fee quote before any work starts.
Discuss your review