AnnexA3Annex Planning and software
IT assessment and IT audit for GTA offices
A fixed-price review of your devices, accounts, network, backups and licences, scored against the Canadian Centre for Cyber Security's baseline controls. You get a written report, a costed 12-month plan and a list of what to fix first.
- Every device, account and licence counted
- Scored against Canadian baseline controls
- A written report and a costed plan
- Fixed priceQuoted before we start
Five questions an IT assessment answers
An IT assessment is a structured look at everything your business runs on, written up so that an owner can act on it and a technician can fix it. It is the right first step when nobody has reviewed your systems in a while, when a new manager inherits them, when an insurer sends a long questionnaire, or when something has just gone wrong.
What do we actually have?
Very few offices can produce a complete list of their laptops, servers, accounts, domain names and subscriptions. Yet every other decision depends on that list. It is the first thing we build, and you keep it.
Where are we exposed today?
Accounts without multi-factor sign-in, an administrator account used for everyday email, a firewall whose admin page is reachable from the internet, a backup nobody has ever restored. These are the gaps behind most of the incidents we are called in to clean up, and they are usually quick to close once someone has found them.
What will fail or fall out of support next?
Software support ends on fixed dates, and hardware ages whether or not anyone is watching. SQL Server 2016 and SharePoint Server 2016 and 2019 reached the end of support on July 14, 2026, Windows Server 2016 follows on January 12, 2027, and Windows 10 has been out of support since October 2025. We list every date that applies to you, so replacements become budget lines instead of emergencies.
Where are we paying for things nobody uses?
Licences still assigned to people who left, subscriptions for tools that were replaced, two products doing the same job, and plans larger than the work needs. These savings often cover a good share of the fixes.
What should we do first, and what will it cost?
The answer is a 12-month plan in priority order, with cost ranges for each step, so you can decide what to do now, what to schedule and what to accept.
What we check
A full assessment covers nine areas. Each one is checked with read-only access and, where it helps, a short visit to see the server room or network cabinet in person.
| Area | What we look at | What we often find |
|---|---|---|
| Accounts and sign-in | Multi-factor sign-in coverage, admin accounts, shared mailboxes, former staff, password policy | Admin rights on everyday accounts, and ex-employees who can still sign in |
| Microsoft 365 or Google Workspace | Secure Score, external sharing, mail forwarding rules, legacy sign-in methods, audit logging | Files shared with anyone who has the link, and old protocols that bypass multi-factor sign-in |
| Computers and phones | Operating system versions, encryption, patch levels, endpoint protection coverage, who manages them | Windows 10 machines still in daily use, and laptops with unencrypted disks |
| Network and firewall | Firmware age, exposed management pages, remote access method, Wi-Fi security, separation of guest and staff traffic | A firewall years behind on updates, and one Wi-Fi network shared by staff, guests and cameras |
| Servers and applications | Operating system and database support dates, roles, storage health, warranties, the software that depends on them | A server past end of support running one application nobody wants to touch |
| Backup and recovery | What is backed up, where the copies live, whether one copy is offline or immutable, the date of the last test restore | No backup of Microsoft 365 at all, and backups that have never been restored |
| Licences and subscriptions | Every paid service matched to a person or a purpose, with renewal dates | Paid licences on empty mailboxes, and duplicate tools |
| Vendors and access | Who holds admin passwords for the domain registrar, DNS, website, phone system and line-of-business software | A domain name registered to a former employee’s personal email |
| Physical and power | Server room or cabinet, battery backup, cooling, cabling, labelling | A UPS with a dead battery that will not survive the next power cut |
How findings are scored
A long list of problems is not useful on its own. Every finding is measured against two published standards, then given a severity that reflects your business rather than a generic checklist.
The first standard is the Canadian Centre for Cyber Security’s baseline controls for small and medium organizations, the same set of controls the federal CyberSecure Canada certification is built on. The second is Implementation Group 1 of the CIS Critical Security Controls, the safeguards the Center for Internet Security describes as essential cyber hygiene for any organization. Between them they cover what Canadian clients, regulators and cyber insurers most often ask about: patching, multi-factor sign-in, backups, access control, security awareness and an incident plan.
| Severity | What it means | Typical example | Suggested timing |
|---|---|---|---|
| Critical | Could be exploited now, or would stop the business if it failed | An administrator account with no multi-factor sign-in | This week |
| High | A real weakness that an attacker or a hardware failure would find before long | Backups with no offline or immutable copy | Within 30 days |
| Medium | Raises risk or cost over time, with no immediate threat | A server due to fall out of support next year | This quarter |
| Low | Good practice, worth doing when convenient | Network cabinet cables without labels | Within the year |
Where you have a cyber insurance renewal coming up, we also map the findings to the questions insurers typically ask, so you can answer the application accurately and know in advance which answers will raise your premium.
What you receive
The report is written twice over: once for the person who signs the cheques, once for the person who does the work.
For the owner or manager
- A one-page summary in plain language
- The top five risks, each with what it could cost the business
- A 12-month plan in priority order, with cost ranges by quarter
- Licence and subscription savings, with the amounts
- A walkthrough meeting to go through it together
For whoever runs your IT
- Every finding with its evidence, severity and the steps to fix it
- An asset register as a spreadsheet: devices, accounts, domains, licences
- A network diagram as we found it
- An end-of-support calendar for every product you run
- Microsoft Secure Score recommendations mapped to the findings
The report belongs to you. Act on it with us, with your own IT person or with another provider. Nothing in it depends on signing up for anything else.
Choose the assessment that fits the question
Not every office needs the full review. If you have a specific question, a narrower assessment answers it faster and for less.
| Assessment | Covers | Suits |
|---|---|---|
| Full IT assessment | All nine areas above | Offices with no recent review, a new owner or manager, or a change of IT provider |
| Security assessment | Accounts, Microsoft 365, devices, firewall, email and backups, scored against the baseline controls | Cyber insurance renewals, client security questionnaires, or the weeks after a phishing scare |
| Microsoft 365 review | Tenant settings, sharing, licences, Secure Score and readiness for Microsoft 365 Copilot | Firms planning Copilot or wondering whether they hold the right licences |
| Network and Wi-Fi assessment | Firewall, switching, Wi-Fi coverage, internet lines and the network cabinet | Offices with slow Wi-Fi, dropped calls or a move coming up |
| Technology due diligence | The systems, risks and liabilities of a business you are buying or merging with | Acquisitions, partner buy-ins and practice purchases |
What we need from you, and what we will not do
An assessment should not disrupt anyone’s day. We need very little from your team, and we set clear limits on what we touch.
From you
- A 30-minute call with the owner or manager about how the business works and what worries them
- Read-only administrator access to Microsoft 365, the firewall and any servers, or someone who can show us
- A short visit to the server room or network cabinet, for most offices in the GTA
- The names of any software vendors and outside contractors who look after part of your systems
Our limits
- Nothing is changed during the assessment. If we find something critical, we tell you the same day and fix it only with your go-ahead.
- No penetration testing or active attacks, unless you ask for them in writing as a separate engagement.
- Findings stay confidential, we sign your NDA if you have one, and our working copies are deleted on request.
The assessment is a fixed price, set by the number of staff, sites and servers, and quoted before we start. Your timeline comes with the quote. If the plan shows you need help with devices or Microsoft 365 afterwards, our pages on Intune device management and IT planning and vCIO show how that work is done.
Questions people ask
How much does an IT assessment cost?
It is a fixed price, set by the number of staff, sites and servers and by which type of assessment you choose. You get the quote before we start, and the price does not change once the work begins.
What is the difference between an IT assessment and an IT audit?
People use the words interchangeably. An audit usually means checking systems against a fixed standard. Our assessment does that, scoring against the Canadian Centre for Cyber Security baseline controls and CIS Implementation Group 1, and then adds what an audit leaves out: a priority order, cost ranges and a 12-month plan.
Will the assessment disrupt our staff?
Hardly at all. Most of the work uses read-only access to your systems. Staff are not interrupted, and nothing is changed during the assessment unless you approve a fix for something critical.
Is an IT assessment the same as a penetration test?
No. A penetration test actively tries to break in. An assessment reviews configuration, coverage and practice with read-only access. Penetration testing can be arranged separately, in writing, if you need it for a client or a regulator.
Can the assessment help with our cyber insurance application?
Yes. We map the findings to the questions insurers commonly ask, such as multi-factor sign-in, endpoint protection, backups and patching, so you can answer accurately and fix the gaps that would raise your premium before you submit.
Do we have to use IT Support Hub to fix what you find?
No. The report is yours. Many clients use it with their own IT person or another provider. If you would like us to do the work, we quote it separately.
Who sees the report?
Only the people you name. Findings are confidential, we sign your NDA if you have one, and our working copies are deleted when you ask.
How long does an IT assessment take?
It depends on the number of staff, sites and servers and the type of assessment. A narrow review such as a Microsoft 365 check is quicker than a full assessment. The timeline comes with the fixed quote.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.