How to prepare for a cyber security health check
By Sanderson Cyber Security · Published
A useful health check starts with understanding how your business works. You do not need to fix everything before the visit or produce a polished set of policies. The aim is to establish an honest picture of the systems, people and processes in the agreed scope.
Explain what matters to your business
Tell Brian your staff count, location, main services and the concerns behind your enquiry. A growing team, new cloud system or uncertainty about backups can each change the focus of the assessment. Mention busy periods and any equipment that must not be interrupted.
Sanderson visits clients across Thanet and Kent. Include your postcode so the quotation can cover the visit and any travel charges. Assessment duration and the report delivery date are agreed with the scope; there is no single visit length that suits every business.
Prepare a simple systems overview
A short list is enough to start. It helps identify the right people to involve and avoids spending the visit discovering who manages each system.
- Business email and cloud services, such as Microsoft 365 or Google Workspace.
- Approximate numbers of work computers, phones and locations.
- Important applications, shared storage and backup arrangements.
- Your IT provider, software suppliers and the person who can approve access.
- Existing policies, previous reports or recovery procedures, where available.
Agree access and authority before the visit
The pre-assessment questionnaire and written scope establish what can be reviewed. Arrange for the relevant owner or IT provider to be available. Third-party systems may need permission from their owner; owning an account does not automatically authorise testing of the supplier's service.
Do not email passwords, MFA codes or recovery keys. Discuss safe evidence sharing and access arrangements first. A Sanderson health check does not automatically include intrusive testing, phishing simulation or changes to production systems.
Decide who needs to understand the report
Identify who will approve improvements and who will carry them out. The report includes an executive summary, prioritised findings and a remediation roadmap. Important findings explain the business risk and a practical next step, with useful evidence where appropriate.
Raise any customer, insurer or procurement requirement during scoping. A health check is advisory and does not issue Cyber Essentials certification or replace a specialist penetration test.
Plan what happens after the report
Set aside time to review the priorities with the person responsible for IT. Decide who owns each action and how completion will be checked. A recommendation to change a system is not permission for the change to happen without planning.
Follow-up or remediation reassessment is separately scoped and is typically £195–£295. The initial health check starts at £395 for a micro business with up to 10 staff and one location. Sanderson is not VAT registered, so VAT is not charged. Your quotation confirms the final scope and price.