Cybersecurity Assessment vs Managed IT: Which Do You Need?

Two different jobs

Think of a vineyard. The vineyard manager works the rows every week: pruning, irrigation, fixing what breaks. Once in a while you bring in someone from outside to test the soil and tell you plainly what they see. You need the weekly work. The outside check makes the weekly work better.

Managed IT is usually a monthly agreement with an IT company or a solo technician. Typical duties include help desk support, applying updates, running backups, adding and removing users, handling Microsoft 365 or Google Workspace accounts, and keeping laptops and servers working. It is ongoing and reactive by design, because tickets come in every day.

An independent security assessment is a defined project with a start, an end and a written report. Keith Systems scopes the work in writing and states the fee before anything begins. A typical security assessment looks at:

• Network design and segmentation, including whether guests, staff and connected devices share one flat network
• Firewall rules and what is reachable from the internet
• Wi-Fi separation for guests and devices
• Accounts, admin rights and multi-factor authentication (MFA)
• Whether backups exist offline and have actually been restored in a test
• Email security settings
• Written policies and your incident response plan
• An external exposure review, only with written authorization from the owner

The result is a prioritized list of findings in plain language: what matters most, why, and what a fix looks like.

Why independence matters

This is not about distrust. Plenty of local IT providers do careful work. But the person who built a network is the person least likely to spot their own blind spots, and a busy provider triages tickets before projects.

There is also a simple conflict to avoid. If the same company finds a problem and sells the fix, the finding can start to look like a sales pitch. Keith Systems sells no equipment, no software and no monthly plan, and does not recommend products, brands or providers. The findings are just findings.

When you need managed IT

You likely need day-to-day IT support if:

• Nobody is clearly responsible for updates, backups or new-hire accounts
• Staff wait days for help with basic problems
• Your "IT department" is a relative who helps on weekends
• You cannot say who holds the admin passwords for email and your firewall

Keith Systems is not an IT provider and does not refer you to one. If you are choosing one, the guide on how to vet a security vendor has questions that work for IT providers too.

When you need an assessment

An outside assessment makes sense when someone else is asking hard questions, or when you need to know where you stand:

• Cyber insurance renewal. Insurers commonly ask about MFA, endpoint detection, tested offline or immutable backups, an incident response plan and training. If you are guessing at the answers, see the insurance questionnaire guide.
• Medical and dental practices. The HIPAA Security Rule requires a risk analysis (45 CFR 164.308(a)(1)), and HHS OCR's Risk Analysis Initiative is active against small and mid-size practices. Census County Business Patterns (2023) counts about 240 dentist offices and 416 physician offices in Santa Barbara County alone. Keith Systems supports that risk analysis. It is not legal advice.
• Accountants and tax preparers. The FTC Safeguards Rule calls for a written risk assessment and a written information security program. See the Safeguards Rule guide.
• Defense suppliers near Vandenberg Space Force Base. NIST SP 800-171 self-assessments and SPRS scores need an honest baseline. Keith Systems offers readiness help only, not certification.
• Before you switch IT providers, so you have a baseline the new provider can work from.
• After a scare, like a convincing phishing email or an odd sign-in. If something is actively wrong, call your IT provider and your insurer first, then read about incident response readiness.
• A network full of smart stuff. Printers, thermostats, smart TVs, point-of-sale terminals, cameras and door controllers often share one network with payroll. That is a connected device network security question.

How the two work together

1. Free consult. A call or video chat of about 30 minutes. If an assessment fits, the scope and fee are written down before any work.
2. Information gathering. With your permission, Jacob asks your IT provider for documentation or read-only access to network gear and admin consoles.
3. Review and report. You get prioritized findings and written requirements your IT provider can act on, without guessing what "fix the network" means.
4. Fixes. Your IT provider or staff carries out the changes. Network-side hardening of your existing network gear can be included if it is in the written scope.
5. Follow-up review. An optional check that the important items were actually closed.

Done this way, the assessment gives your IT provider a clear task list and gives you something concrete to hold everyone, including yourself, accountable to.

Where Keith Systems fits

Keith Systems does assessments and project work, not monthly managed IT or a help desk, so it works alongside your IT provider. It doesn't sell equipment, and it isn't a CMMC assessor.

A quick way to decide

Picture a six-person office in Lompoc with an outside IT person who comes in when called. If nobody owns updates and backups, start with IT support. If someone does, but you have never seen a written list of your security gaps, an assessment is the next step. Most businesses move between the two over the years.

Not sure which you need? Book a free security consult or call (805) 800-8163. See what the consult covers.