Cybersecurity Risk Assessment for Small Businesses on the Central Coast

What the assessment looks at

The assessment covers the areas where small businesses most often get hurt:

• Accounts and email: MFA coverage, administrator accounts, Microsoft 365 or Google Workspace security settings, suspicious mailbox forwarding rules, and SPF, DKIM and DMARC records that help stop spoofed email.
• External exposure review with written authorization from the owner: what anyone on the internet can see, including exposed remote desktop, admin login pages, outdated services, expired certificates and stale DNS records. Testing is designed to be non-destructive and is limited to systems listed in the signed authorization.
• Devices: update status, disk encryption, and who has local administrator rights.
• Network: firewall rules, remote access and segmentation.
• Backups and recovery: whether backups exist, whether one copy is protected from ransomware, and whether a restore actually works.
• People and process: how payment changes are verified, how vendors get access, and whether anyone knows what to do during an incident.

How findings are mapped: NIST CSF 2.0

Findings are mapped to the NIST Cybersecurity Framework 2.0, which organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. CSF 2.0 is free and published at csrc.nist.gov.

The mapping is useful beyond the report. It helps you answer cyber insurance questionnaires and customer security questionnaires. For defense suppliers, it is a starting point before a full NIST SP 800-171 readiness review.

Findings ranked by real risk

Automated scanners rank issues by generic severity. That is not the same as risk to your business. A missing MFA setting on the owner's email account or a remote desktop port open to the internet matters far more than a medium-severity encryption warning on an unused web page.

Each finding in the report includes:

• What was found and where
• Why it matters for your business specifically
• The evidence, so your IT person can verify it
• The recommended fix and rough effort level

What you receive

1. Executive summary: one to two pages for owners and managers, no jargon.
2. Ranked findings register: every issue, ordered by risk.
3. Framework mapping table: findings tied to NIST CSF 2.0 functions and categories.
4. External exposure summary: what is visible from the internet, with the signed authorization kept on file.
5. Written work plan: what to do in the first 30 days, the next 90 days, and later.
6. Readout call: a walk through the results with time for questions.

Who this is for

• Businesses that have never had an independent security review
• Offices facing a cyber insurance renewal or a customer security questionnaire
• Medical and dental practices preparing their HIPAA security risk analysis (see HHS guidance)
• Owners who had a close call, such as a phishing email that almost worked
• Businesses about to hire or change IT providers and wanting a baseline first

On the Central Coast that includes professional offices in Nipomo and Arroyo Grande, medical practices in Santa Barbara, and ag and food businesses in Santa Maria.

Good to know

This is a point-in-time review, not an audit or certification, and not a full penetration test. Any external check is non-destructive and done only with written authorization from the owner of each system. It helps you prepare for HIPAA and similar rules, but it isn't legal advice.

How an engagement works

1. Free consult of about 30 minutes, no obligation. See what to expect.
2. Written scope listing systems, domains and IP addresses in scope, plus the fee, before any work begins. You sign the testing authorization at this step.
3. Interviews and read-only access, on site in Santa Barbara County and southern San Luis Obispo County, or remotely.
4. External exposure review during an agreed window.
5. Report and readout.
6. Optional follow-on: help with fixes through network security or incident response readiness.

Book a free security consult or call (805) 800-8163.