Our Free IT Health Check: What It Covers, How Long It Takes and What You Get

Most of the businesses we speak to have IT that works, more or less. Email arrives, laptops turn on, files are somewhere. What they rarely have is a clear picture of where the gaps are: the admin password only one person knows, the backup nobody has tested, the leaver who still has access.

The IT Health Check is how we find those gaps. It is a set of plain-English questions about how your business uses and looks after its technology, grouped into twelve areas. Your answers are scored, the risks are ranked, and we turn the result into a written report you can act on, whether or not you work with us afterwards.

It is free and there is no commitment. It runs on our own IT Health Check site.

There are two ways to take the check.

With one of our engineers (recommended). You book a slot and an engineer goes through it with you on a Teams call. It takes between 30 and 60 minutes, depending on the size of the business and how much there is to talk about. The engineer explains why each question matters, helps with the ones that need a technical answer, and notes anything worth a closer look. If you do not know an answer, that is useful information in itself, and we will say so.

On your own. You can also work through it online at your own pace, which usually takes 15 to 20 minutes. It suits people who know their setup well. If you get stuck on a question, you can stop and book an engineer instead.

Most people choose the guided session. Questions like "are admin accounts separate from everyday accounts?" are easy to answer with someone who can explain what that means and why it matters.

The questions are grouped into twelve areas. Questions that do not apply to you are skipped: a single-site business is not asked how its offices connect to each other, and a business with no servers skips the server questions.

A few questions ask for approximate figures, such as what you spend on IT, connectivity or phones. Rough numbers are fine. They help us spot where you may be paying for something twice or not getting value from it.

We also run a check on your domain's email security records (SPF, DKIM and DMARC), which show whether someone could send email that looks like it came from you. You can run the same check yourself on our free domain security check.

1. Book a time. Pick a slot on the booking page. You get a Teams invitation by email.
2. Confirm your details. At the start you enter your name, company and email address, and we email you a code to confirm it is you. This is how your answers are saved securely against your business.
3. Work through the areas. The engineer takes you through each area in turn. You answer from what you know; they explain anything unclear and skip what does not apply.
4. See the headline results. When the last question is answered, you see a summary straight away: an overall IT maturity score, the number of risks found and how many are critical, and an email security score for your domain.

It helps to have the person who knows your setup best on the call, and to have a rough idea of staff numbers, devices, and who supplies your internet, phones and backup. If your cyber insurance policy is to hand, that helps too. None of it is essential.

The summary on screen is the headline. The detail is in a full written report, which explains each finding in plain words and what we would fix first. It includes:

• A priority risk summary: the issues that matter most, ranked, so you know where to start.
• A section-by-section breakdown of all twelve areas, showing where you are strong and where you are not.
• The things to do now: the short list of fixes worth doing whatever else you decide.
• A roadmap: what to tackle next, in a sensible order.
• How your answers line up with Cyber Essentials: useful if a customer, a tender or your insurer is asking for it.
• A board governance view: where the business stands against the five principles of the Cyber Governance Code of Practice.

We go through the report with you on a free 30-minute review call, then send it to you to keep. The review call is where the findings turn into decisions: what is urgent, what can wait, and what you are happy to accept.

The report is based on what you tell us, so findings say what may be the case and what could follow. Where something needs confirming inside your systems, we say so.

The questions are simple, but what sits behind them is not. Every finding in the report is assessed against UK law, regulator guidance and recognised security standards, all published by the relevant authority so anything we say can be checked independently:

• The law: UK GDPR and the Data Protection Act 2018 (security of processing and breach notification), the Companies Act 2006 sections 172 and 174 (directors' duties), the Computer Misuse Act 1990 and the Privacy and Electronic Communications Regulations.
• The regulator: the ICO's guidance on security, its 72-hour breach reporting duty and its published enforcement action.
• Standards and national guidance: Cyber Essentials and its five technical controls, ISO/IEC 27001, the NCSC's 10 Steps to Cyber Security, and NCSC guidance on email security and backups.
• Evidence: the government's Cyber Security Breaches Survey and the NCSC Annual Review.

The governance part of the report is structured around the UK Cyber Governance Code of Practice from DSIT and the NCSC, using the NCSC Cyber Security Board Toolkit. It shows how the business measures up against the code's five principles, which is useful for directors who want to know where they stand.

We have boiled all of that down for businesses. You do not need to read any of it: the report tells you in plain English what your risks are and what to do about them. To be clear about what it is, it is an indicative self-assessment drawn from your answers, not a certification or a formal governance audit.

The check is built for small and medium-sized UK businesses in any sector, and it works whether your IT is looked after by a provider, by someone in-house, or by whoever knows the most about computers. It is most useful when:

• you have never had an independent look at your setup;
• your insurer, a customer or a tender is asking about security controls;
• you are preparing for Cyber Essentials;
• you are unhappy with your current support and want facts before you decide anything;
• the business has grown and the IT has grown with it, one fix at a time.

If you work with another IT provider, there is no need to tell them, and nothing in the check touches your systems. Plenty of businesses use the report to have a better-informed conversation with the provider they already have.

We also offer a free Microsoft 365 security review. They answer different questions.

• The IT Health Check looks across the whole business, from phones and backup to suppliers and training, and is based on your answers. It is the right first step if you want the full picture.
• The Microsoft 365 security review looks inside your Microsoft 365 tenant, read-only, and reports on how it is actually configured. It is the right step when you already know Microsoft 365 is where your questions are.

If you are not sure, start with the health check. If the findings point at Microsoft 365, the review is the natural next step.