Free 15-minute Cyber Strategy Session with Tanner Book Your Free Cyber Strategy Session
Cyber Security Risk Assessment

Cyber Security Risk Assessment

Find out exactly where your business is exposed, what it would cost you, and what to fix first, in a written report you can hand to your insurer, your board or your IT provider. Headquartered in Billings, Montana. Serving businesses nationwide.

Book Your Free Cyber Strategy Session Call (406) 534-0911

Rated 5.0 on Google (9 reviews). Headquartered in Billings, Montana. Serving businesses nationwide.

Works with Microsoft 365, Google Workspace, and the software your industry runs on.

A cyber security risk assessment from Galactica CyberSecurity is a structured review of how your business could be breached and how badly it would hurt: email and logins, backups and recovery, every device, who has access to what, your network, your vendors, and the compliance rules your industry answers to. You get a plain-English report with findings ranked by risk, a prioritized fix list with costs, and the evidence auditors and cyber insurance carriers ask for. It is a paid engagement scoped on a free 15-minute Cyber Strategy Session, for businesses in Billings and nationwide.

How it runs

How the assessment runs

  1. Day 1. A 45-minute kickoff with the owner and whoever runs IT. We collect what exists today: devices, accounts, backups, policies, insurance questionnaire.
  2. Days 2 to 5. Technical review: vulnerability scan, Microsoft 365 or Google Workspace security review, endpoint and backup checks, access review, dark web check for your domain.
  3. Day 8. Findings meeting. We walk through the report in order of risk and answer every question.
  4. Day 9 onward. You decide what to fix and who fixes it. If it is us, the assessment price is credited toward the first month of a managed plan.
What we find

What the assessment usually finds

RISK.01

Email accounts without MFA

Or MFA that only some people turned on, which leaves the door open for everyone else.

RISK.02

Backups that have never been restored

Or backups that sit on the same network ransomware would encrypt.

RISK.03

Former employees with live logins

Shared passwords, and everyone running as administrator.

RISK.04

A compliance requirement nobody wrote down

HIPAA, FTC Safeguards, PCI-DSS or the cyber insurance questionnaire answered from memory.

What you receive

What you receive

CRA.01

Risk report

Written for an owner, not an engineer, with every finding rated and explained.

CRA.02

Prioritized fix list

Estimated effort and cost for each item, in the order that reduces risk fastest.

CRA.03

Compliance gap summary

Against the requirements that apply to you: HIPAA, FTC Safeguards, PCI-DSS, GLBA, cyber insurance.

CRA.04

Insurance-ready evidence

The controls you have, documented in the language carriers use.

CRA.05

A 30-60-90 day plan

One you can execute with us or with anyone else.

Related: Cybersecurity, Managed IT, Compliance Support.

Two different things

The free session and the assessment are different things

Free Cyber Strategy SessionCyber Security Risk Assessment
15 minutes with TannerOne to two weeks of structured review
A conversation about how you run and where you’re likely exposedTechnical testing, access review, policy review, vendor review
FreeFixed price, quoted on the free session
Ends with what we’d fix firstEnds with a written report, a ranked fix list and insurance-ready evidence
Scope

The ten areas we review

Each area is scored against what "good" looks like for a business your size, and every gap lands on the fix list with an owner, an effort estimate and a cost. The same ten areas apply whether you are a law firm, a medical practice, a bank or a contractor.

  • Identity and MFA. Every account has multi-factor authentication and nobody shares a login.
  • Email security. Phishing and fake-invoice messages are filtered before the inbox and sensitive mail is encrypted.
  • Endpoints and EDR. Every computer and server runs endpoint detection and response that someone watches.
  • Patching. Updates install automatically within days, on servers as well as laptops.
  • Backups and recovery. Offsite or immutable copies exist and a restore has been tested in the last 90 days.
  • Access control and offboarding. You can list who has access to what, and access ends the day someone leaves.
  • Network and firewall. A maintained firewall, segmented Wi-Fi and no forgotten open ports.
  • Vendors and cloud apps. You know which outside companies hold your data and what protects it.
  • Incident response readiness. A short written plan exists, everyone has read it, and it has been walked through.
  • Compliance and insurance requirements. The rules that apply to you are written down, and the carrier questionnaire could be answered truthfully today.
Who it is for

Who gets the most out of it

Businesses renewing cyber insurance, practices and firms with HIPAA or FTC Safeguards obligations, companies that just had a scare, owners who inherited an IT setup they don’t understand, and anyone comparing IT providers who wants an independent baseline first.

How it works

Three steps from "we should look at this" to protected

01

Free Cyber Strategy Session.

Fifteen minutes with Tanner. You tell us how the business runs; we tell you where you’re exposed and what we’d fix first.

02

A plan with one number on it.

If an assessment is the right first step, we quote it on the call and start within a week. If a managed plan is the better fit, we scope it around your users, devices and requirements, and you see the full number before you sign anything.

03

Protection that keeps running.

24x7 monitoring and response, a help desk your team actually uses, and a quarterly review where we show you what we stopped and what to do next.

Open 24x7
Phone answered and systems watched around the clock
One flat monthly rate
No per-ticket fees, no surprise invoices
Onboarded in 30 days
Protected from day one
25+ years in Billings
A Montana company with a real office
Cyber Risk Scorecard

Want the two-minute version first? Score your business now.

Ten questions, no email needed to see your score. Scores are a planning estimate based on your answers, not an audit.

  1. 1/10 Is multi-factor authentication turned on for every email account in the business?
  2. 2/10 Do you have offline or immutable backups, and when was the last restore test?
  3. 3/10 What protects your computers?
  4. 4/10 How are updates and patches applied to computers and servers?
  5. 5/10 Do everyday users have administrator rights on their computers?
  6. 6/10 Has your team had phishing training in the last 12 months?
  7. 7/10 Do you know who has access to what, and does access end the same day someone leaves?
  8. 8/10 Do you have a written incident response plan, and has it been tested?
  9. 9/10 Does your industry have a compliance requirement (HIPAA, FTC Safeguards, PCI, CMMC), and do you have written policies for it?
  10. 10/10 Do you carry cyber insurance, and could you answer the carrier’s questionnaire truthfully today?
Trust and compliance

What we stand behind

Galactica CyberSecurity is a Montana company with a real office, a real phone that is answered 24x7, and a security operations center watching client systems around the clock. We help clients meet HIPAA, FTC Safeguards, PCI-DSS, GLBA and cyber insurance requirements by putting the safeguards in place and keeping the evidence current. We do not certify compliance, and we will tell you plainly when a requirement is outside what we do.

FAQ

Questions we get asked

Is the cyber security risk assessment free?

No. The free offer is the 15-minute Cyber Strategy Session, where we scope the assessment. The assessment itself is a paid, fixed-price engagement, and the price is credited toward your first month if you move to a managed plan with us.

How long does it take?

One to two weeks from kickoff to the findings meeting, depending on size.

Will it disrupt our business?

No. Scans run outside working hours, and the reviews are done with your team by appointment.

Is this a penetration test?

No. A risk assessment covers far more ground (policies, access, backups, insurance) and includes a vulnerability scan. A full penetration test is a separate project we can quote.

Can we use the report with another IT provider?

Yes. The report and fix list are yours.

Does it cover HIPAA or FTC Safeguards?

It identifies the gaps against the requirement that applies to you and what to do about them. It is not a certification, and we say so in the report.

What does it cost?

A fixed price quoted on the free session, based on headcount, locations and the requirements involved, and credited toward your first month if you move to a managed plan.

What happens after?

You get a 30-60-90 day plan. Execute it with us, with your own team, or with anyone you choose.

Related reading

Keep reading

2024-08-13

Why Your Business Needs a Cybersecurity Risk Assessment

What a cybersecurity risk assessment covers, what it finds in most small businesses, and how to use the results.

Read the post →
Publishing soon

What Cyber Insurance Carriers Require Now

Part of the Galactica CyberSecurity blog series on protecting small and mid-sized businesses.

Publishing soon

The HIPAA Safeguards Auditors Ask Small Practices About

Part of the Galactica CyberSecurity blog series on protecting small and mid-sized businesses.

Ready to stop worrying about IT and security?

Start with fifteen minutes. If an assessment is the right next step, Tanner will say so.

Book Your Free Cyber Strategy Session Call (406) 534-0911

(406) 534-0911, open 24x7