Security Assessment
Security assessments for California organizations.
When responsibility for security is spread across staff, vendors, and systems, it can be hard to see the whole picture. I review the agreed scope and turn the findings into a report you can use to decide what happens next.
Who this is for
California small and midsize businesses, water districts, public agencies, and nonprofits that need to understand their security position.
Start here when a leadership transition, insurance question, partner request, or change in systems has raised questions you cannot answer with confidence.
What you receive
An agreed assessment scope
A written boundary for the systems, access, and risks to be reviewed. The scope identifies the people and information needed before work begins.
A plain-language findings report
A description of each finding, why it matters, and the decision it creates. Technical details support the explanation rather than replace it.
Prioritized fixes
A list of next steps in priority order. You can use it to discuss ownership, dependencies, and implementation with your staff or IT contractor.
Illustrated guide
Read the diagram as text
- Scope: Agree the systems and questions.
- Review: Examine access, systems, and risk.
- Decide: Use the report to prioritize fixes.
How the work happens
- Scope the question
A 20-minute call establishes what prompted the review, what systems matter, and who should participate.
- Review the agreed areas
I assess systems, access, and risk within the agreed boundary. Any additional work is discussed before it becomes part of the engagement.
- Discuss the findings
I walk through the report and the priority order. You decide which actions to authorize and who will carry them out.
Agree the scope before the work.
The assessment is scoped. It is not a promise to find every issue, a certification, or an audit opinion. Penetration testing, remediation, and operational technology testing are not implied by the offer; any additional work needs an explicit scope.
What to bring to the first conversation
- The question or event that prompted the assessment.
- A high-level list of systems and service providers.
- The person responsible for IT and the person who can authorize decisions.
- Any existing policies, prior findings, or external requests that are relevant.
Start with a high-level description. Do not send passwords, access credentials, or sensitive client records.
Book a 20-minute callQuestions, answered
What you may be wondering.
What do I receive from a security assessment?
You receive a scoped review of systems, access, and risk, a plain-language report, and prioritized fixes. The call establishes the assessment boundary before work begins.
Can you work alongside an existing IT provider?
Yes. The report gives you and your IT provider a basis for discussing priorities and ownership. The engagement scope defines who supplies information and who implements changes.
How much does a security assessment cost?
The fee depends on the agreed scope. Book a 20-minute call to discuss the systems, questions, and deliverables you need. No fixed assessment price is published.
Does an assessment include fixing every finding?
No. The published offer is an assessment and prioritized report. Implementation needs to be agreed separately.
Start with a conversation
What security question is on your desk?
Tell me what prompted the question. A 20-minute call is a place to establish the next step.