Cybersecurity Assessment for Small Business: What It Checks and Costs

A cybersecurity assessment shows a business owner how exposed the company really is. Most small businesses only find out when something goes wrong. A staff member clicks a fake invoice, a former employee still has a working login, or the office firewall is running the same password it shipped with. None of these show up on a normal day. They show up when an attacker finds them first.

A security assessment finds those weak spots on your schedule instead of theirs. This guide explains what an assessment checks, what you get at the end, what it costs at TechBoss and how to prepare, so you can buy one with clear expectations. We run these assessments for offices, clinics, shops and warehouses across Toronto and the GTA.

If you are still deciding whether you need an assessment or a full penetration test, read our guide on vulnerability assessment vs. penetration testing first. This post focuses on the assessment itself.

What Is a Cybersecurity Assessment?

A cybersecurity assessment, sometimes called a cybersecurity audit or IT security audit, is a structured review of how well your business protects its systems, data and people. A security specialist looks at your network, computers, cloud accounts, email, backups and staff habits, then compares what they find against accepted security practice.

The goal is a clear answer to three questions:

• What do we have that an attacker would want, and where is it stored?
• Where are the gaps that would let someone reach it?
• What should we fix first, and what will it take?

An assessment is not the same as buying antivirus or installing a new firewall. It is the step before those purchases. It tells you which tools and changes actually matter for your business, so you do not spend money on the wrong things.

What a Cybersecurity Assessment Checks

A good assessment covers technology, process and people. The network security assessment for small business is only one part of it. Here is what we look at on a typical small business engagement.

Network and Firewall

• Firewall rules: which ports are open to the internet, and whether each one still has a business reason.
• Router, switch and firewall settings: default passwords, outdated firmware and remote management left switched on.
• WiFi security: encryption type, whether guests share a network with your office computers, and who knows the password.
• External scan: what your business looks like from the internet, the same view an attacker starts with.
• Internal scan: what a person or a piece of malware could reach once inside your network.

Computers, Servers and Devices

• Operating system and software updates on every workstation, laptop and server.
• Antivirus or endpoint protection, and whether it is actually running and reporting.
• Local administrator rights. Staff who do not need admin access should not have it.
• Disk encryption on laptops that leave the office.
• Printers, cameras and other connected devices that often get forgotten.

Accounts, Email and Cloud

• Multi-factor authentication (MFA): whether it is turned on for email, remote access and admin accounts. Our post on why MFA is non-negotiable explains why this is usually the first fix.
• Old accounts: logins belonging to people who have left, shared accounts and accounts with more access than the job needs.
• Email security: spam and phishing filtering, plus SPF, DKIM and DMARC records that stop others from sending email as your domain.
• Microsoft 365 or Google Workspace settings: sharing rules, forwarding rules and admin roles.

Backups and Recovery

• Whether backups run, where they are stored and whether a copy is kept offline or out of reach of ransomware.
• When a restore was last tested. A backup you have never restored is a hope, not a plan.
• How long the business could run if the main server or cloud account were unavailable.

People and Policies

• Whether staff have had security awareness training and know how to report a suspicious email.
• Written policies for passwords, remote work, personal devices and new or departing staff.
• Whether you have an incident response plan. If not, our guide on building an incident response plan is a good place to start.

What You Get at the End

The assessment is only as useful as the report. A useful report is written for two readers: the owner who has to approve spending, and the person who has to make the changes. Expect these parts:

1. Executive summary: a short, plain-language overview of your overall risk and the most important findings.
2. Findings list: each issue with what was found, where, why it matters and a severity rating such as critical, high, medium or low.
3. Remediation plan: fixes in priority order, so you know what to do this week and what can wait for next quarter.
4. Technical detail: the evidence your IT person or provider needs to confirm and fix each issue.

Watch for reports that are just a raw scanner export with hundreds of pages of alerts. That shifts all the real work back onto you. The value of an assessment is a person deciding which findings matter for your business.

Signs Your Business Needs an Assessment Now

• You have never had one, or the last one was more than a year ago.
• You recently moved offices, changed IT providers or moved to Microsoft 365.
• A customer, insurer or partner has sent you a security questionnaire you cannot answer.
• You store customer personal information, health records or payment data.
• Someone on your team fell for a phishing email, or you had a near miss.
• Staff now work from home on their own devices.

Small businesses are often targeted because attackers expect weaker defences. Our article on why small businesses are the top target for ransomware covers the reasons in detail.

Privacy Obligations in Canada

If your business collects personal information about customers in the course of commercial activity, Canada's federal privacy law, PIPEDA, generally requires you to protect it with safeguards suited to how sensitive it is. It also requires you to report breaches that pose a real risk of significant harm to the Privacy Commissioner and to affected people, and to keep a record of every breach.

An assessment does not make you compliant by itself, but it shows whether your safeguards match the data you hold. Our PIPEDA compliance checklist goes through the requirements step by step. This is general information, not legal advice.

What a Cybersecurity Assessment Costs

At TechBoss, an IT Security Audit costs $1,500 to $5,000. It includes a vulnerability assessment, penetration testing and a security recommendations report. Where your business falls in that range depends on:

• the number of computers, servers and users in scope
• how many office locations and networks are included
• whether cloud services such as Microsoft 365 and any websites or web applications are tested
• how deep the penetration testing goes

After a free consultation, you get a fixed written quote before any work starts. The audit covers finding and reporting the issues. Fixing them is a separate decision, made once you have seen the report.

If you would rather keep security covered month to month, our managed plans include much of what an assessment usually recommends. The Business plan, at $139 per user per month with a 10-user minimum, includes advanced cybersecurity (EDR, DNS filtering and dark web monitoring), security awareness training with phishing simulations and full firewall management. The Enterprise plan, starting from $189 per user per month with a 20-user minimum, adds annual penetration testing. Full details are on the pricing page.

How It Works with TechBoss

1. Free consultation: we learn how your business works, what data you hold and what you are worried about.
2. Scope and quote: we agree in writing on what will be tested, when and how, and you get a fixed price.
3. Written authorization: you sign off on the scope before any scanning or testing begins.
4. Assessment: we review settings, run internal and external scans and test the areas agreed in the scope, with care to avoid disrupting your staff.
5. Report and walkthrough: we take you through the findings and the remediation plan in plain language and answer your questions.

Our team works out of North York and covers Toronto and the GTA, including Mississauga, Brampton, Markham, Vaughan, Richmond Hill and Durham Region. Much of an assessment can also be done remotely for businesses elsewhere in Canada.

Frequently Asked Questions

How much does a cybersecurity assessment cost in Canada?

Prices vary with the size of the business and what is tested. At TechBoss, an IT Security Audit costs $1,500 to $5,000 and includes a vulnerability assessment, penetration testing and a recommendations report. You get a fixed written quote after a free consultation.

How often should a small business get a cybersecurity assessment?

Once a year is a sensible baseline for most small businesses. You should also book one after a big change, such as an office move, a new IT provider or a move to the cloud. If a customer or insurer asks for proof of security, a recent assessment gives you something to show them.

Will the assessment disrupt my staff?

It should not. Most of the work is reviewing settings and running scans that staff never notice. Any testing that could affect systems is scheduled with you in advance, and outside business hours if needed.

Do I need to give you passwords and admin access?

For a full internal review, yes, some admin access is usually needed so we can check settings directly. We agree on exactly what access is needed in the scope, and you can change those passwords as soon as the work is done.

What happens if you find a serious problem?

A critical finding should not sit in a draft report for weeks. Agree in the scope that anything critical is raised with you as soon as it is confirmed, along with the risk and the quickest safe fix, so it can be dealt with immediately.

Book a Cybersecurity Assessment in Toronto

You cannot fix gaps you do not know about. TechBoss provides cybersecurity assessments for small businesses across Toronto and the GTA, with a clear report and a fixed price agreed up front. Request a free quote for your assessment and find out where your business stands.