What a free IT assessment actually looks at

Every managed IT provider offers a free assessment, and almost none of them publish what it covers. That vagueness is doing work: it lets a two-hour sales call and a three-day technical review carry the same label. Here is what ours covers, partly so you know what to expect and partly so you have something concrete to hold other quotes against.

The estate, not just the complaint

Most enquiries start with a single symptom — the VPN drops, email is slow, a backup failed. The symptom is rarely the problem. So the review covers the whole estate rather than the part currently making noise:

• Servers, endpoints and how they are patched
• Identity: who has access to what, and whether MFA is actually enforced rather than merely available
• Backups, including whether a restore has ever been tested
• Network: segmentation, firewall rules, remote access
• Cloud and licensing: what you are paying for against what is in use

Findings in writing, ordered by risk

A verbal summary is easy to agree with and impossible to act on. You should get a written document that separates what is urgent from what is merely untidy, with the reasoning shown rather than asserted. If a finding says a system is at risk, it should say why, and what an attacker or an outage would actually do with it.

It should also be readable by someone who is not technical. If the report needs an engineer to interpret it, it is not a report — it is a sales tool.

The awkward question to ask

Ask whether the findings are yours to keep, and whether you can take them to another provider. If the answer is anything other than a plain yes, the assessment is a lead magnet rather than a piece of work. Ours are yours either way, because a report you cannot act on independently is not worth much.

One more thing worth saying plainly: sometimes the honest finding is that nothing needs urgent attention. That is a legitimate outcome, and you should expect to be told it if it is true.