Access and email
We review accounts, permissions and sign-in protection. We identify unnecessary access and email settings that need attention.
We assess your security controls.
We review the security of accounts, devices and services.We identify risks and recommend the next steps.We tailor the scope to your business.
Choose assessment scopeWhat do we check?
Accounts, devices and services form one environment.We assess them together within an agreed scope.
Computers and networks
We review device protection and network settings. We identify missing updates, unnecessary external access and risks from remote work.
Servers and services
We map systems, their dependencies and operating arrangements. We check settings and identify faults that could interrupt your business.
Data and backups
We review backup coverage and restore evidence. We identify what is missing to recover data and resume work after an outage or incident.
Choose your assessment scope.
Every option includes a report and an action plan.The size and complexity of your environment determine the scope and depth.
Standard
For a small business using email and computers. We assess protection and set clear priorities for improvement.
from PLN 2999
one-off, excluding VATUp to 10 people and 10 computersDiscussion and retest of up to 3 findings
- Email, access, devices and networks
- Report and a 30 / 60 / 90-day plan
- Typically 3–5 business days
Business
For a business running servers and several services. We assess protection, dependencies and readiness to recover.
from PLN 5499
one-off, excluding VATUp to 25 people and 25 computersDiscussion and retest of up to 5 findings
- Assessment of up to 2 servers
- Workshop and a restore test
- Typically 5–10 business days
Bespoke
For a distributed business or a selected system. We tailor the scope and depth to support your decision.
Tailored quote
one-off, excluding VATScope agreed togetherReview meeting and verification
- A specific system or multiple locations
- Detailed scope and assessment method
- Schedule tailored to your environment
Prices exclude VAT, which is added at billing. We confirm a fixed price and the systems to be assessed before work begins.
We perform a baseline check on every computer in scope. Deeper tests depend on configuration and risk. Delivery is remote; the schedule starts when access is ready.
Findings and actions.
Get the evidence you need to make decisions and plan changes.Every significant finding includes its rationale and a next step.
Evidence
We verify our findings.
We combine configuration readouts, available logs and input from your IT contact. The report separates confirmed issues from missing information.
Priorities
We explain what the risk means.
We explain the impact on your data and operations. Findings are ordered by urgency so the most important improvements come first.
Improvement plan
Know what to do next.
We plan actions for the next 30, 60 and 90 days. For each issue, we describe the improvement, identify its owner and explain how to verify the outcome.
Follow-up
We revisit the findings.
After you report completed improvements, we recheck the agreed findings. We update their status and identify gaps that still need attention.
A finding from the report.
We show the issue, evidence, priority and closure criteria.These examples use fictional data.
Administrator sign-in without MFA
An example policy and sign-in record confirm that multifactor authentication (MFA) is not required. Priority in this example: high. Recommendation: protect sign-in and account recovery. Closure criterion: verified settings and a controlled sign-in test.
Account owner to be confirmed
An example account list shows an active account without a confirmed owner. Status: clarification needed. Recommendation: confirm why access is required. Closure criterion: a documented justification or agreed removal of access.
Unverified backup recovery
An example backup history confirms successful jobs, but no restore result is available. Recommendation: agree a safe restore test. Closure criterion: a recorded outcome and confirmation that the recovered data is usable.
Assessment scope and terms.
Compare the packages and review the detailed terms. We confirm the asset list and access arrangements before starting.
| Assessment scope | Standard | Business | Bespoke |
|---|---|---|---|
| Organisation profile | Up to 10 people, 1 location | Up to 25 people, 2 locations | According to the agreed scope |
| Email and accounts | 1 email organisation | 1 email organisation | Selected platforms and directories |
| Computer baseline checks | Up to 10 computers | Up to 25 computers | Every computer in scope |
| Network and services | 1 router, 1 public service | 2 devices, 2 public services | Agreed scope |
| Servers and backups | Review of 1 backup chain | Up to 2 servers and 2 backup chains | Agreed systems and data |
| Follow-up check | 1 round, up to 3 findings | 1 round, up to 5 findings | Scope agreed for the project |
Email, identity and access
We review sign-in protection, administrator accounts, roles, former users and provider access. For email, we assess the agreed protection settings together with SPF, DKIM and DMARC.
We include all accounts in the agreed organisation: administrators, guests, service accounts and disabled accounts. We confirm the list and sources before starting. Registering an MFA method does not mean it is required at sign-in.
Computers, networks and external access
For every computer in scope, we check the operating system and updates, protection, encryption, firewall and local privileges. We record the source and readout date; missing data is identified in the report.
Deeper checks cover different configurations, roles and significant anomalies. If the findings reveal significant differences, we extend the checks. Risk determines the number of tests, rather than a fixed sample limit.
We review the agreed network-edge devices and remote access. The scope defines how public services will be checked and whether any scanning is authorised.
Servers and service dependencies
Business covers up to 2 servers or virtual machines. We review configuration, updates, service accounts, administrative access and dependencies important to your operations.
More systems or a detailed assessment of a specific application require a tailored scope. The report records what was actually checked.
Backups and recovery
Standard reviews one backup chain: its coverage, frequency and available restore evidence. Missing evidence is recorded as requiring verification.
Business covers up to 2 backup chains and one agreed restore test of a file or small dataset into an isolated location. We confirm test conditions before quoting.
Risks, report and action plan
You receive an owner’s summary and technical findings. Each records the evidence, date, confidence, business impact and priority, followed by a recommendation, an action owner and closure criteria.
The report shows how many assets were in scope, how many had baseline evidence and which received deeper checks. Where data is missing, we explain what could not be verified.
The 30, 60 and 90-day plan defines the order of work, responsibilities and closure criteria. Review meetings last up to 60 minutes in Standard and 90 minutes in Business. Business also includes an incident and recovery scenario workshop.
Follow-up checks
The price includes one follow-up round: up to 3 findings in Standard and 5 in Business. Report completed improvements within 30 days of receiving the report.
We agree the follow-up date after you report the improvements. We update the findings; you can commission the changes from us or your existing IT provider.
Method, access and confidentiality
We tailor the scope to your business needs, drawing on NIST and CIS good practices. Tools support the operator’s verification; we distinguish statements from evidence.
Before starting, we agree authorisation, temporary access and secure transfer of materials. We confirm available reports, permitted tool use and how data will be processed and retained.
Price, schedule and next steps
Before starting, we confirm the people, computers and services in scope, the available sources and the tests. These define the fixed price and schedule. The price includes gathering and assessing evidence, the report, review meeting and agreed retest. Additional work requires a separate agreement.
The assessment is a one-off project. Remediation and ongoing care have separately agreed scopes; additional administration is priced at PLN 300 net per hour.
How does the assessment work?
- 01
Agreeing the scope
We establish your objectives, systems and contacts. We confirm the price, evidence sources, access and schedule.
- 02
Checking evidence
We check the agreed assets and verify findings. Significant risks are reported promptly to your designated contact.
- 03
Planning next steps
We deliver the report and action plan. After you report the fixes, we recheck agreed findings and record the result.
Assessment questions.
Does the assessment include fixes?
The assessment delivers a report and action plan. We quote remediation after understanding the findings and before making changes.
The price includes one follow-up round: up to 3 findings in Standard and 5 in Business. Report completed improvements within 30 days of receiving the report.
Is this a full penetration test?
This is a security review of your organisation and the configuration of agreed systems. Findings are based on the evidence collected.
Full penetration tests require separately agreed objectives, methods and scope. We will recommend them where appropriate.
Will the assessment interrupt work?
We start with configuration readouts and available evidence. Active tests and restore testing are agreed with your IT contact.
Before those activities, we confirm the window, method and stop conditions. The assessment itself does not include configuration changes.
Can you visit our office?
Standard and Business are delivered remotely. Visits, travel and physical-security checks are agreed separately.
You can also commission a review of a specific part of your environment. We tailor the scope to the decision you need to make.
What should I prepare before the conversation?
An approximate number of people and computers, a list of important services and a description of your current IT support are enough. Tell us what you want to check or improve.
We agree the required materials and access method together. Only share passwords and customer data through an agreed secure channel.
Let’s discuss your assessment.
Tell us which systems matter to your business. We will agree the assessment scope and how results will be shared.
Discuss your assessment