Sample IT & Security Health Check

Illustrative sample

This page is a composite created to show the shape and judgment of a typical Health Check. It is not the record of any client, and the business, evidence, findings, and timing are illustrative. A real Health Check is based on your environment and ends with a written report plus a live walkthrough.

The engagement, at a glance

The question it answers: Where do we actually stand, and what is worth fixing first?
Illustrative business: An 18-person professional office with one location, Microsoft 365, a cloud line-of-business application, laptops, shared files, and several outside technology providers.
Format: Fixed fee. Fixed scope. Days, not weeks.
Deliverable: A plain-language report, a prioritized action plan, and a live walkthrough with the people who will own the next steps.

Executive view

The environment is functional and does not need to be replaced wholesale. The immediate exposure is narrower: the business cannot demonstrate that its backup will restore, two administrative paths are less protected than ordinary employee accounts, and no one holds a current record of the network and provider responsibilities.

Those issues deserve action now. Several other items do not. The Wi-Fi is older but stable, the firewall remains supported, and a proposed office-wide computer replacement would spend money before the actual constraints require it.

The useful outcome is not a long list of everything that could be improved. It is agreement on the few things that should move, who owns them, and what can safely wait.

Findings and priorities

Illustrative Health Check findings, evidence, priority, and ownership
Area	What the evidence showed	Decision	Owner and timing
Backup and recovery	Nightly jobs report success, but no complete file or system restore has been documented in the last year. Recovery time and acceptable data loss have never been agreed.	Now — prove the restore	Current provider, witnessed by an owner, within 14 days
Administrative access	A shared vendor account and one Microsoft 365 administrative path do not receive the same MFA protection as employee accounts.	Now — close the gap	Microsoft 365 provider within 14 days
Documentation and ownership	The business does not hold a current network diagram, provider list, domain record, or clear account of who controls each administrative credential.	Next — make it portable	Office manager and providers within 30 days
Recurring security tools	Endpoint and email protection overlap across two vendor agreements. The added coverage is unclear and the renewals occur three months apart.	Next renewal — consolidate	Owner with an independent review before renewal
Staff AI use	Employees use public AI tools informally, but no rule distinguishes public information from customer or confidential material.	Next — set a usable rule	Owner and staff lead within 30 days
Wi-Fi and firewall	Both are supported, stable, and adequate for current demand. A replacement proposal does not identify a present performance or lifecycle problem.	Later — do not replace now	Revisit at support end or when the business changes

The last row is part of the deliverable, not an afterthought. A useful assessment records what does not need attention so a future sales proposal does not quietly become the plan.

The first 30 days

Witness a restore. Recover a representative file set and one complete protected system into an isolated location. Record the steps, elapsed time, missing dependencies, and who can authorize recovery.
Remove the weaker administrative paths. Give each administrator an individual account, require phishing-resistant MFA where the platform supports it, and retain a controlled recovery path.
Collect the record the business should own. Provider contacts, tenant and domain ownership, administrative-account custody, network diagram, backup locations, renewal dates, and the current support boundaries.
Issue a one-page AI-use rule. Name the approved tools, prohibit customer and confidential material in public accounts, and give staff a person to ask when the boundary is unclear.

These are deliberately small actions. They reduce the largest uncertainties without waiting for a broad replacement project.

The following 60 days

Resolve overlapping tools: Map what each recurring security product actually provides, keep the stronger necessary coverage, and plan any cancellation around renewal dates rather than paying twice indefinitely.
Set recovery expectations: Agree how much data the business can afford to lose and how long it can operate without each critical system. Make the backup design answer those expectations.
Clarify provider boundaries: Record who handles Microsoft 365, the network, endpoints, the line-of-business application, security incidents, and after-hours problems — including the gaps between those contracts.
Decide on internet resilience: Compare the cost of a practical secondary connection with the business impact of a full-day outage. Buy it only if the consequence justifies it.

What can wait

A complete Wi-Fi replacement while coverage and capacity remain adequate
Replacing every computer on one schedule instead of using age, support status, and actual workload
Adding another security platform before the overlapping products are understood
Building a private-AI environment before the business has an approved use case that requires one

Deferring work is a decision, not neglect. Each deferred item receives a trigger for reconsideration so “later” does not mean “forgotten.”

What you leave with

The real report contains the evidence behind each finding, the current-state record, named owners, and the sequence discussed in the walkthrough. You own it whether the work is carried out by Herzog Enclave, your current providers, or your own team.

That independence is the point. The Health Check should make the next decision easier even when the right next decision is to buy nothing.

Start with a Health Check See how the engagement works