Define the questions before reviewing the systems
An assessment should have a purpose. You may need to understand account access, clarify backup ownership, document device management, or prioritize improvements after a change in your business.
Layer Zero Consulting offers security assessments and related work involving MFA, conditional access, endpoint protection, backups, and policies aligned to your needs. The systems reviewed and the deliverables provided are set out in the engagement scope.
An example assessment scope
| Review area | Evidence to discuss | Decision it supports |
|---|---|---|
| Identity and access | Account inventory, administrative roles, and configured controls | Who should retain access and who owns reviews? |
| Devices | Device inventory and management responsibilities | Which devices need attention first? |
| Endpoint protection | Coverage and ownership of protection tools | Who monitors and acts on issues? |
| Backup and recovery | Coverage records and recovery-test history | What business information can be recovered? |
| Policies and responsibilities | Existing procedures and named owners | What needs to be documented or clarified? |
Agree on useful deliverables
- A written scope naming the systems and review boundaries.
- A record of the evidence reviewed and any limitations.
- A prioritized set of findings or recommendations, if included in the scope.
- An agreed discussion of responsibilities and next steps.
Keep assessment and implementation distinct
A review does not automatically authorize configuration changes, scanning, remediation, or access to every system. Those activities require an agreed scope and appropriate authorization.
An assessment is not a guarantee against incidents or a certification of compliance. If your business has contractual or regulatory obligations, identify those requirements when planning the engagement.
Questions before you get started
How much does an assessment cost?
Pricing depends on the systems, scope, evidence, and deliverables. Request a free consultation to discuss a separately priced engagement.
Will you make changes during the review?
Only work included in the agreed scope and authorization is performed. Assessment and remediation can be separate engagements.
Can this replace a formal compliance audit?
Do not assume so. The engagement must be matched to the specific requirements and the type of assurance you need.