SECURITY REVIEW & HARDENING
Know what is really in place, and what to fix first.
// THE PROBLEM
Most small businesses do not know how secure they are. Security was set up piece by piece over the years: an old router, shared passwords, a backup drive nobody has tested, a former employee who still has an account.
Most incidents start with something that ordinary. The fix is rarely expensive. The hard part is knowing what is actually in place, and what to do first.
// WHAT GETS CHECKED
Six areas, checked against what is really set up: accounts, MFA, backups, email, network, devices.
- Accounts and access: who can get into what, shared logins, former staff, admin rights.
- Sign-in protection: multi-factor authentication on email, banking, and remote access.
- Backups: whether they run, whether they are off site, and whether a restore actually works.
- Email: spoofing protection for your domain (SPF, DKIM, DMARC) and phishing exposure.
- Network: firewall rules, Wi-Fi, guest access, and whether office, machines and visitors are kept apart.
- Devices: updates, disk encryption, antivirus, and anything no one is patching.
Every item is checked against what is really configured, not what a policy says. Interviews and hands-on configuration review, not a questionnaire.
// WHAT YOU GET
A plain-language report and a ranked to-do list. Fixes are quoted separately.
- Security Review: a written report in plain language. What is covered, what is missing, what each gap risks, and roughly what it costs to close.
- Hardening Plan: the fixes ranked by risk and effort, with owners and target dates, so the most important work happens first.
Fixing the gaps is separate work, quoted once you know what is needed. ISS can do it, or your own people can work from the plan.
// BUILT ON HANDS-ON WORK
The review comes from building and running secured systems, not reading about them: segmented networks, hardware-backed sign-in, encrypted storage, audit logging, and documentation written as the system was built. It is organized by recognized security control areas, so the findings carry forward if a customer or insurer asks for something more formal later.
// WHO THIS IS FOR
Small businesses, offices and manufacturers that want an honest read on their security without hiring a full IT department, and anyone who just received a security questionnaire from a customer or insurer and is not sure how to answer it.
// FAQ
Questions people ask first.
We are a small shop. Is this overkill?
No. Small businesses are targeted because they are easier, and most incidents start with something ordinary. A review finds those first.
Do you fix what you find, or just report it?
The review and the plan are the deliverable. Fixing the gaps is quoted separately once you know what is needed, and can be done by ISS or by your own people.
What does the review produce?
A written report in plain language, every gap ranked so you know what to do first.
A customer or insurer sent us a security questionnaire. Can you help?
Yes. The findings map onto the questions they ask, and the plan shows them what is being done about any gaps.