What to Expect During an IT Assessment

The word “assessment” covers a lot of ground in IT. One provider uses it for a 20-minute checklist call. Another means a multi-week audit with network scans and staff interviews. Most businesses booking one for the first time can’t tell which kind they’re getting until the report shows up.

This guide walks through what a thorough IT assessment involves, from the first conversation to the written report, so you know what to expect and what to question. It’s written for owners, controllers, and operations leads at small and mid-sized Ontario businesses, especially those comparing managed IT services or reviewing a provider before a contract renewal. Where we describe how ACT360 runs its own assessment, we say so. Where an outside framework applies, we link to it.

Before any technical work, a good assessment starts with a discovery conversation. Expect questions about how your team works, which applications you can’t run without, where the business is headed over the next 2 to 5 years, and what’s frustrating about your current setup. System access is arranged only after that conversation.

That order matters more than it looks. A server that’s perfectly adequate today can still be the wrong purchase if the business plans to move its accounting software to the cloud next year, and nobody learns that from a device scan. The business questions are what keep the technical findings tied to how you actually operate, instead of turning into a generic checklist.

You don’t need to prepare anything for the first call. It does speed things up later if you can find a few items, such as a list of the software your team uses every day, your latest Microsoft 365 and IT invoices, any contract with your current provider, and the name of whoever holds the admin passwords. If nobody’s sure who holds them, that’s already a finding.

In ACT360’s experience, most assessments take a few days to about a week from the first conversation to the written report. The biggest variables are the number of locations, whether servers sit on-site, and how quickly admin access can be arranged.

We haven’t found a published industry benchmark for assessment length, so treat any timeline, ours included, as a scoping estimate rather than a standard. A single-office business running mostly on Microsoft 365 moves faster than a multi-site operation with an on-premise server and a line-of-business application nobody ever documented. Adam Bowles, Partner and CEO at ACT360, puts the reason for not rushing it plainly.

“I don’t want to give you a quote based on a headcount and a device list. Give me a week to actually look.”

Adam Bowles, Partner & CEO, ACT360

One caveat worth knowing. A penetration test or a formal compliance audit is a different, deeper exercise, and it takes longer. If an insurer or a client has asked for one of those specifically, say so up front so the scope matches the request.

A thorough IT assessment looks at 6 areas, which are your network and hardware, identity and access, endpoint security and patching, backup and recovery, software and licensing, and documentation. Recognized security frameworks cover much of the same ground, which is a good sign the scope isn’t arbitrary.

• Network and hardware, meaning firewalls, switches, Wi-Fi, servers, and workstations, including their age and whether they still receive security updates. Windows 10 is the most common example right now. Microsoft ended Windows 10 support on October 14, 2025, so any machine not enrolled in Extended Security Updates no longer gets security fixes.
• Identity and access in Microsoft 365 and Entra ID, such as whether multi-factor authentication covers every account, how many people hold global admin rights, whether legacy sign-in protocols are still allowed, and whether former employees can still log in.
• Endpoint protection and patching, for example whether Microsoft Defender or another endpoint detection and response tool is running on every device, and whether updates are actually installing rather than failing quietly.
• Backup and recovery, covering what gets backed up, where the copies live, how long they’re kept, and when someone last proved a restore works.
• Software and licensing, comparing the Microsoft 365 plans and other subscriptions you pay for with what people actually use.
• Documentation, which comes down to whether anyone other than one person knows the passwords, the network layout, and the vendor contacts.

None of this is proprietary. The CIS Critical Security Controls v8.1 open with inventories of hardware and software for a reason, since you can’t protect what you haven’t listed. The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations include automatic patching, strong user authentication, and backups among 13 baseline controls, and they advise organizations to keep clear restore procedures and verify them regularly. NIST’s Cybersecurity Framework 2.0 treats this kind of inventory and risk review as the Identify function, the work that comes before deciding how to protect anything. What varies between providers is how deep they actually go.

Identity is where we’d point most small businesses first. Microsoft states that more than 99.9% of common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication, which makes MFA coverage one of the cheapest, highest-impact items an assessment can check. For Microsoft 365 environments, Microsoft Secure Score is a useful reference number too, though Microsoft is clear that a high score isn’t a guarantee against a breach. If security is your main concern, our guide to what a cybersecurity assessment actually covers goes deeper on that side alone.

Most assessments turn up the same handful of problems, and nearly all of them are invisible day to day. The table below maps each area to what gets checked, the problems our team runs into most often in small business environments, and why each one matters to the business.

The Common Problems column reflects what ACT360’s team regularly sees in the field. It isn’t a statistical survey.

Backup is the row that surprises owners most. In our experience, plenty of businesses have a backup job that runs every night and has never been restored, so nobody knows whether recovery would take an hour or a week. When that’s the gap, business continuity and disaster recovery planning is what turns a backup into a recovery plan with a known timeline.

A good report tells you what’s working, what’s a real risk, what can wait, and roughly what each fix would cost. It’s written so an owner or controller can follow it without an IT background, and it ranks findings by business impact rather than technical severity alone.

A useful technology assessment report usually includes these 5 things.

1. A 1-page summary written for leadership, not for technicians.
2. Findings grouped by priority, each with a plain explanation of what it means for the business.
3. A rough effort or cost range for each item, so you can plan a budget instead of reacting to one.
4. A list of what’s fine as-is, because knowing what doesn’t need money is as useful as knowing what does.
5. What isn’t being recommended yet, and why.

That last item is the one most reports leave out. At ACT360 it’s part of every proposal, because “here’s what we’d hold off on” is often the clearest sign a recommendation was built around your business rather than a sales target.

A thorough assessment means someone actually reviews your systems, asks when a backup was last restored, and hands you a written report you keep. A shallow one is built from a headcount and a device list, and it usually ends with a quote.

Here’s the part people don’t expect. Free doesn’t mean shallow, and paid doesn’t mean thorough. Some providers charge for an assessment and still deliver a template. Others, ACT360 included, offer it free because it’s how we earn the right to make a recommendation. Judge it by what gets examined and what you walk away with, not by the price.

Pressure is the other tell. If the findings arrive already packaged with an urgent recommendation to sign a specific agreement this week, treat the document with some skepticism. A genuine assessment stands on its own, whether or not you ever work with the people who did it.

A 35-person commercial painting contractor came to ACT360 about a failing server and a $60,000 replacement quote from its existing provider. Asking what the business was planning next cut that number to $25,000, and later monitoring surfaced a security problem nobody knew about.

The symptoms were familiar. Sage, the company’s accounting and job-costing system, could take up to 30 minutes to open, the file share crawled, and the server’s drives were failing. The previous provider had reached the right technical conclusion, that the hardware was finished, and then sent a quote by email without a conversation.

The discovery conversation changed the answer. The company plans to replace its ERP, which will move Sage off-premise within a couple of years. Buying a full-specification server built for 5 to 7 years of use made little sense in that context. ACT360 delivered a server sized to bridge the migration for $25,000, including hardware, installation, setup, and migration.

The second finding came after onboarding, not during the assessment itself, and it’s worth being precise about that. Within weeks of the new security monitoring going live, identity monitoring flagged account access from Latvia, the Philippines, and the United States, plus 1 incident serious enough to isolate an account automatically. None of it had been visible before. The company had come to talk about a server.

The client asked to stay anonymous, so identifying details are generalized. The full painting contractor server right-sizing case study has the numbers and the timeline.

ACT360’s IT Readiness Assessment is free, carries no obligation, and follows the Assess and Comprehend steps of our ACTION methodology. It starts with a conversation about your business, then moves to a technical review of network, security, backups, and licensing, done by the senior team that would do the work.

Jeffrey Bowles, Partner and Director of IT Services, runs the technical side, including the environment review, security posture, and backup verification. The report that follows is written for a business owner, with findings ranked by risk and cost. If the honest answer is that your current setup is mostly fine, that’s what you’ll hear.

What happens next depends on what the report shows. A security gap usually leads to a conversation about cybersecurity services. If you already have an internal IT person who just needs backup, co-managed IT keeps them in charge while we cover the gaps. And sometimes the right next step is nothing at all for another year.

An IT assessment is only as useful as what it actually looks at and how clearly the results come back to you. A thorough one gives you a real starting point for decisions about spending, security, and your provider. A shallow one mostly serves whoever is selling something at the end of it.

If you’d rather know than guess, ACT360’s IT Readiness Assessment is a free, no-obligation review of your network, security, backups, and licensing, with a written report you keep either way.

Call 705-739-2281 or email [email protected]