Start with the business
The NCSC advises small businesses to identify critical systems and information and consider the consequences of losing them. This is also useful preparation for an external security assessment.
First, write down which activities would stop without IT: taking orders, booking appointments or sending invoices. Mark your most important workflows. This helps establish priorities later, even when a technical service appears unremarkable at first. [1]
The first fifteen minutes: list your services
NIST's small business guide recommends maintaining an inventory of hardware, software, systems and services. Its template also considers responsibility and business importance.
For this preparation, we suggest a simple table. Use existing contract records or ask your IT provider. Explicitly mark anything unknown; a preliminary list can have gaps. [2]
- Domains: list your main domain, other brand or shop domains and known older addresses.
- Providers: match your domain registrar, web host, email provider and IT support company to the relevant services.
- Business purpose: note which workflow each important service supports and what would be disrupted by an outage.
- Changes: add the dates of any planned website migration, provider change or new public services.
The next fifteen minutes: clarify responsibilities
A domain often involves several contacts. An agency maintains the website, a hosting company runs the server and someone in your business manages the customer account. Record who can answer technical questions and who can commission a change.
- Ownership and administration: record who the domain and service account are registered to and who can confirm those details.
- Assessment approval: establish who authorises the agreed scope; record any necessary arrangements with providers operating the services.
- Availability: name a responsible person and a deputy who can be reached for questions or an unexpected service disruption.
Prepare the written handover
For a remote assessment, the assessor needs a clear overview of the agreed external systems. Agree in writing what information is needed beforehand, who will receive the report and which secure channel will be used to deliver it. The preparation list does not itself authorise testing every system it contains.
Do not include passwords, recovery codes or customer data in the initial enquiry. Names and technical addresses are enough to begin defining the scope. Mark unconfirmed associations; a service with a similar name is not thereby one of your systems.
Three decisions to take from the results
A list of results becomes useful to a business owner when work can be assigned from it. Ask for a short written decision brief alongside the technical evidence. We suggest assigning each relevant point to one of these decisions.
- Act: what should your IT team or a named provider change, and why should it take priority?
- Clarify: which missing information or unconfirmed observation needs an answer first, and who will obtain it?
- Retest: after a change, what would establish that the specific finding has been resolved?
Review after changes
Update the overview after significant changes. A hosting migration, new domain or new shop is a useful reason to reassess the affected areas. A standing calendar appointment alone does not account for these changes.
An external assessment describes the agreed view at the time of testing. It does not validate all internal IT or automatically establish compliance with legal or contractual requirements. Keep the date, limitations and outstanding questions alongside the record of actions taken.
Related reading
Sources & further reading
Published:
Primary sources checked on 29.09.2026.
Sources and limitations are identified in the article.