top of page

IT Baseline Assessment for Small Businesses

For businesses that want to understand their IT environment before making decisions.

What Is This?

An IT Baseline Assessment is a comprehensive audit of your current IT environment. I document what you have, identify security gaps, assess your backup and disaster recovery procedures, review access controls, and give you a prioritized list of what needs attention and in what order.

​

The result is a clear picture of your IT posture right now — no mystery, no guessing. You get documentation you can use for cyber insurance applications, compliance reviews, or as the foundation for planning your next steps.

Why You Need It

Most small businesses don't know what they don't know. You might have servers that nobody's looked at in years. Files scattered across personal devices. Backup procedures that haven't been tested. Devices accessing company data with no security controls. An outdated M365 setup that's not configured for security or compliance.

This assessment finds all of it and gives you a roadmap.

​

Who This Is For

Small businesses without formal IT infrastructure or documentation. Companies that grew informally and never built a proper IT foundation. Businesses preparing for cyber insurance renewal and realizing they don't know what controls they actually have in place. Companies considering managed IT services but want to understand their current state first. Organizations that have had an incident or a close call and want to know how exposed they actually are. Any business that's been running on "it works" for so long they're not sure what "it" actually is.

What Happens When You Don't Know Your IT Posture

  • Ransomware hits and you discover your backup doesn't work. You're either paying a ransom or losing years of business data.

  • Cyber insurance denies a claim because your controls didn't match your application. You bought coverage you thought you had, then found out you didn't when you actually needed it.

  • A staff member leaves and you realize you can't revoke their access. They still have company data and you have no way to get it back.

  • You get audited for compliance and can't produce documentation. HIPAA, FTC Safeguards, or other regulations catch gaps that cost money to remediate and potentially expose you to penalties.

  • A device gets stolen with unencrypted customer data on it. You're legally required to notify customers and the fallout damages your reputation.

  • A breach happens and you have no incident response plan. You don't know what to do, who to call, or how to communicate with customers and authorities. The situation spirals.

  • You renew your cyber insurance and discover your coverage was reduced or the premium doubled because your environment doesn't meet carrier requirements.

 

An IT Baseline Assessment finds these problems before they become crises. The cost of knowing now is far less than the cost of finding out the hard way.

What's Included

Environment Inventory

  • Complete documentation of servers, workstations, devices, and network infrastructure

  • List of software and applications in use

  • Cloud services and platforms currently active

  • Mobile device inventory and management status

Security Posture Review

  • MFA implementation status across systems

  • Endpoint protection and antivirus coverage

  • Firewall and network security configuration

  • Email security and anti-phishing controls

  • Device encryption status

Data Locations & Access Control Review

  • Where company data lives (local drives, cloud storage, email, file shares)

  • Who has access to what

  • Shared accounts or weak password practices

  • Remote access setup and security

Compliance & Insurance Readiness

  • Review against HIPAA technical safeguards (if applicable)

  • FTC Safeguards compliance gaps (if applicable)

  • Cyber insurance requirements not currently met

  • Documentation and evidence gaps

Backup & Disaster Recovery Assessment

  • Current backup procedures and retention

  • Tested restore procedures (or lack thereof)

  • Recovery time estimates

  • Off-site backup and redundancy status

Prioritized Recommendations

  • Top 5-10 items that need attention

  • Sequencing and dependencies

  • Estimated effort and priority

  • Options and trade-offs for each recommendation

What You Get


Written Report

A professional, documented assessment of your IT environment with findings, gaps, and recommendations

 

Executive Summary

High-level overview for business decision-makers. What's working, what's broken, what matters most.


Detailed Inventory

Complete documentation of your hardware, software, cloud services, and infrastructure.


Gap Analysis

Specific security, compliance, and operational gaps identified with severity and impact.


Prioritized Action Plan

Clear, sequenced recommendations for what to fix and in what order.


Evidence Package

Documentation suitable for cyber insurance applications or compliance reviews.


Consultation Call

30-minute call to walk through the findings, answer questions, and discuss options.

Pricing

$2,500 flat

No surprises. No hourly billing. Fixed price regardless of environment size.

Timeline

Assessment and documentation typically take 2-3 weeks depending on environment complexity. You get the written report and have a 30-minute consultation call to review findings.

What Happens After

You get the assessment. You can:

  1. Use it to plan your own improvements

  2. Use it for cyber insurance applications

  3. Use it as the foundation for a managed IT engagement with SNL-Tech Services

  4. Share it with another IT provider

This assessment stands on its own. It's yours to use however you want.

Frequently Asked Questions

 

How long does this actually take?

The assessment itself takes 2-3 weeks depending on how complex your environment is. I'll schedule interviews with you and your team, audit your systems and configurations, test your backup procedures, and compile everything into a report. You get the full written report and a 30-minute consultation call to walk through findings.

​

What if I don't like the recommendations?

That's fine. The assessment is yours. You can implement recommendations at your own pace, prioritize differently, or use it for planning purposes. There's no obligation to do anything with it beyond understanding your situation.

​

Can I do this on my own instead of hiring you?

You can try, but most businesses don't have the time or expertise to audit their own environment objectively. You might miss critical gaps. An external assessment also carries more credibility with cyber insurance carriers and compliance auditors than a self-assessment.

​

Do I have to use SNL-Tech Services after this?

No. This is a standalone engagement. You own the assessment and can use it however you want. Many clients use it as a foundation to start a managed IT engagement with me, but that's your choice.

​

What if the assessment reveals something expensive to fix?

Then you know. And you can make informed decisions about how to handle it. Sometimes expensive fixes are priority. Sometimes you can phase them in. Sometimes you decide to accept the risk. But you're making that decision from a position of knowledge instead of guessing.

​

Will this assessment work with cyber insurance applications?

Yes. The assessment includes an evidence package suitable for insurance applications and renewal questionnaires. Many clients use the assessment specifically to prepare for insurance renewal conversations.

​

What if you find a critical security issue during the assessment?

I'll flag it immediately so you can address it right away. You won't wait for the final report to find out about a serious problem.

​

Can you give me a rough estimate before we start?

I can tell you which areas are likely to need attention based on your business type and current setup. But the full assessment is $2,500 regardless. Once we start, I'll give you a timeline estimate based on what I'm finding.

Ready to understand where you stand?
 

bottom of page