The small business guide to cybersecurity assessments

Most owners do not go looking for a cybersecurity assessment. An assessment finds them. A renewal notice arrives from the insurance broker with four pages of questions attached. A customer's procurement department forwards a spreadsheet and asks for it back by Friday. Or a business in the same industry and of the same size, run by an owner you know, loses two weeks to a ransomware incident. The question of where your own business stands stops being theoretical.

Whatever prompted the search, the underlying question is the same, and it is a reasonable one. What is in place today, what is missing, and what should be done first. That is what a cybersecurity assessment is for. This guide explains what an assessment is, the two forms it takes, and what each costs. It also covers when to go straight to a formal assessment, and how to get value out of the exercise rather than a document that sits in a folder.

What a cybersecurity assessment is

A cybersecurity assessment is a structured review of how a business protects its information, measured against an agreed list of expectations. It is not a scan, a test, or an attempt to break in. It is an inventory of practice: what you do, how consistently you do it, and where the gaps sit.

The list of expectations is what gives an assessment its authority. Working from a published framework rather than an individual's personal checklist means the results carry a vocabulary that other organizations already recognize. That matters when the audience is an insurer, a customer, or a future advisor. For small businesses in the United States, a widely used starting point is the NIST Cybersecurity Framework, published by the National Institute of Standards and Technology. Its current version, CSF 2.0, describes what NIST calls "a taxonomy of high-level cybersecurity outcomes" (NIST CSWP 29, February 2024). Each outcome is a statement of what is true of an organization that manages its risk sensibly. The framework's 106 specific outcomes, which NIST calls Subcategories, are sorted into six broad Functions. This guide calls each of those outcomes a control, because each one is assessed separately. The guide to CSF 2.0 for a small business covers what the framework means for a business of this size.

Two things follow from that design, and both work in a small business's favor. The framework describes results rather than products, so it never obliges you to buy anything in particular. And NIST is explicit that the outcomes "are not a checklist of actions to perform." You are not being graded against a fixed standard. You are describing where you stand, in language an advisor will understand.

An assessment is also not a certification. NIST does not operate a certification or conformity assessment program for the CSF, and no assessment, self-guided or otherwise, makes a business compliant with anything. What it produces is an accurate picture and a plan. That is a smaller claim than the marketing around this subject usually makes, and it is the honest one.

Why this is worth doing now

Three circumstances usually prompt a small business to seek an assessment, and each is set out below.

The insurer. Insurers now expect specific answers rather than a general description of the business's practices. Applications and renewals ask verifiable questions about multi-factor authentication, backups, endpoint protection, patching, and incident response. Multi-factor authentication requires a second check at sign-in beyond the password, such as a code from a phone app. NIST's own small business guidance treats this as a governance question rather than a purchasing one. It lists "assess whether cybersecurity insurance is appropriate for your business" among its governance actions to consider (NIST SP 1300, February 2024). The companion guide on answering a cyber insurance questionnaire covers the specifics.

The customer. Larger organizations increasingly assess the security of their suppliers, and the mechanism is a questionnaire. The questionnaire is not arbitrary. Verizon's announcement of its 2026 Data Breach Investigations Report, published in May 2026, reports that 48 percent of breaches involved a third party, a share that rose 60 percent over the prior year. That trend gives larger customers good reason to question their suppliers more closely. The companion guide on a customer's security questionnaire covers how to handle one.

The quiet worry. No deadline, no external party, only an accumulating sense that the business has grown past its security arrangements. This is the best possible reason to run an assessment, because it is the only one of the three where you control the timetable.

Whether attackers target a business this size

That question deserves a direct answer rather than an alarm, and the honest answer is that targeting is largely the wrong frame. What the evidence supports is that attacks are opportunistic and indifferent to size.

Verizon's 2025 DBIR Small- and Medium-Sized Business Snapshot, which defines an SMB as an organization with fewer than 1,000 employees, examined breaches occurring between November 2023 and October 2024. In that dataset there were 3,049 SMB incidents with 2,842 confirmed data disclosures. Large organizations had 982 incidents and 751 confirmed disclosures. That is almost four times as many small-business victims. The report is candid that this partly reflects the larger number of small businesses, and partly its own mix of data contributors. That caveat is worth respecting.

The more telling figure is the type of breach a small business suffers. Ransomware is malicious software that locks a business out of its own files and systems and demands a payment to restore them. In that same 2025 dataset, ransomware was a component of 88 percent of SMB breaches, compared with 39 percent at large organizations. Verizon's reading is blunt. Ransomware groups, it says, appear indifferent to the size of the organization. Small businesses are also less likely than large ones to have current, readily available backups, which works in the attacker's favor. Small businesses are not singled out. Verizon finds that attackers use similar methods regardless of victim size. Verizon's 2026 Data Breach Investigations Report executive summary gives no small-business ransomware share, but it finds that small organizations are disproportionately affected by ransomware.

Federal reporting points the same direction. The FBI Internet Crime Complaint Center (IC3) received more than 1,400 ransomware complaints in 2025 from businesses and organizations outside the sixteen critical infrastructure sectors (2025 IC3 Annual Report). Critical infrastructure is the set of sectors, such as energy, water, and healthcare, that the federal government treats as vital to national security, the economy, or public health. The most affected industries were legal services at 18 percent and contracting services, such as electricians and general contractors, at 17 percent. Engineering and architectural services followed at 10 percent, and consulting services at 7 percent. Those are ordinary professional and trade businesses, not infrastructure.

Two honest qualifications belong alongside those numbers. First, all of this is reported data. The IC3 notes that its ransomware loss figures do not normally include lost business, wages, or remediation costs, and that some victims report no loss amount, so the published total understates the real cost. Second, none of it forecasts what will happen to any particular business. The useful conclusion is not that an incident is coming for you. It is that the same handful of measures prevents the common cases at any company size. Many small businesses have not yet put all of them in place.

The two kinds of assessment, and how they sequence

Almost everything sold as a cybersecurity assessment falls into one of two categories. They are not competitors. They belong at different stages.

A self-guided assessment

You answer structured questions about how your business operates, and the answers are mapped to a framework's controls. No assessor visits, nothing is inspected, and no evidence is collected. The output is a picture of your current position and a prioritized list of improvements.

The strength of this approach is that it removes the two barriers that keep small businesses from starting: cost and scheduling. The limitation is equally real. A self-guided assessment reflects what you report. If you believe backups are running and they are not, the assessment will record a working backup, because no assessor has checked it. It is a record of what the business reports, not an audit. It carries no independent opinion that a third party can rely on.

This is the right instrument when you know improvements are needed but not which ones come first. It also suits a business that wants to answer an insurer or a customer accurately rather than optimistically, or to arrive at a consultant-led engagement already informed. NIST's small business guidance describes its own audience in similar terms, as businesses "who have modest or no cybersecurity plans in place" (NIST SP 1300).

A full formal assessment

An assessor examines your environment, reviews evidence, interviews staff, and issues findings that carry their name and their independence. Configuration is inspected rather than described. The result is a document a third party can rely on as verified, which a self-assessment is not. Most businesses that need one commission a consultant-led assessment, because the assessor's independence is much of what the document is worth. A business with qualified staff can run a formal assessment internally, but a third party may give that result less weight.

This is the right instrument when a contract or regulator requires independent verification, or when the environment has grown complex enough that an outside view will see what an insider cannot. It also fits an event that demands a defensible record, such as an acquisition, a major client, or an incident.

When to go straight to a formal assessment

There are situations in which a self-guided assessment is the wrong purchase, and NISTnow would rather say so than sell into them.

A contract, regulator, or customer requires independent verification. If the obligation specifies an independent assessment, a self-assessment does not satisfy it, and buying one first only delays the engagement you need. Read the requirement carefully, then commission a formal assessment from a qualified assessor.

You are pursuing a certification. Certification schemes require accredited assessors working to defined procedures. Preparatory work of your own has value, but the assessment itself must come from an assessor accredited under the scheme. NIST itself offers no certification against the CSF.

You have had an incident, or suspect you have one now. An assessment is a planning instrument rather than an investigation. If something has happened, you need incident response support today, not a scoring exercise. Incident response support is specialist help to contain the attack and restore systems.

The environment has outgrown one person's knowledge. If neither the owner nor the IT provider can describe with confidence what systems exist, who administers them, or where data lives, a self-guided assessment will faithfully record that uncertainty. A consultant-led review that begins by mapping the systems and data is the better first purchase.

Your risk is high. If a compromise would be catastrophic to life, safety, or the survival of the business, bring in an outside assessor from the start. A self-guided assessment is not sized for that level of risk.

The sequence that works

Outside those situations, the two fit together in an obvious order. A self-guided assessment first, then the work of fixing the plain gaps, then a formal assessment when the business needs one. A formal assessment's fee is set largely by scope and evidence depth, not by how prepared the business is. What preparation changes is what you receive for it: the assessor spends the engagement on questions only an assessor can answer, rather than on discovering that multi-factor authentication was never enabled.

The reverse order tends to be expensive. A business with no security program commissions a formal assessment, receives a long and accurate list of deficiencies, and has neither the budget nor the internal capacity to work through it. The report is filed. Nothing changes. Two years later the same findings reappear.

What happens during an assessment

The shape is consistent across both kinds.

Scoping. Establishing what is being assessed and for whom. NIST describes this as documenting "the high-level facts and assumptions on which the Profile will be based." A Profile is NIST's term for a written description of an organization's cybersecurity position, current or intended. NIST also notes that an organization may hold as many Profiles as it needs, each with a different scope (NIST CSWP 29).

Gathering. Collecting what already exists: policies, contracts, the list of systems you depend on, whatever your IT provider maintains.

Working through the controls. The main body of the work, going control by control and recording your honest position. In a full formal assessment this happens through interviews and evidence review. In a self-guided assessment you answer the questions yourself, with guidance explaining what each control means and what each level of maturity looks like.

Gap analysis and a plan. Comparing where you are against where you need to be. In NIST's process, this step is to analyze the gaps and then "develop a prioritized action plan."

Expect the honest answer to many questions to be some version of "partly" or "I would have to check." That is normal, and noting it is more valuable than guessing.

What a good report gives you

A report worth having answers four questions.

Where do we stand. A picture across all six Functions of the framework, in terms an owner can act on rather than a technical score.

What is strong. Useful, and frequently omitted. Many small businesses are doing more than they realize, and knowing which practices already hold up prevents you from paying to rebuild something that works.

What should be done first. Not an undifferentiated list of everything imperfect, but a short sequence: what to do now, what comes next, what to plan for later. Prioritization is the part that turns a report into progress.

How to do it. Steps specific enough to act on, sized to a business with your resources, and phrased so that the person who has to carry them out understands what "done" looks like.

A useful test: after reading the executive summary, could you tell your accountant in two minutes where the business stands and what the next three actions are? If not, the report has not done its job.

What it costs

Pricing in this field is opaque. Consulting engagements are scoped individually, published rates are rare, and many of the figures published online come from firms that sell the service.

The price of a formal assessment

A formal assessment brought in from outside is a professional services engagement, priced like an audit or a legal review rather than a product. NISTnow's own estimate, not a market benchmark, is that a formal assessment for a small business is commonly quoted at $10,000 to $15,000. Two businesses of similar size can receive quotes that differ substantially, and both can be reasonable, because the work behind them differs. Treat that estimate as a rough guide and get more than one quote. These are the factors that move the price, and the questions to ask about any proposal.

Scope. How much of the business is being assessed. A review confined to one system costs a fraction of one covering every location, subsidiary, and supplier relationship. Narrowing scope is one of the most direct ways to reduce the price.

Size and complexity. Headcount, number of sites, whether you run your own servers or rely on cloud services, and how many distinct systems hold sensitive data. Complexity tends to cost more than headcount.

The framework applied. A CSF-based review, a review against a sector standard, and a readiness assessment for a certification are different quantities of work.

Evidence depth. Often the largest and least visible driver. An assessor who inspects configuration, samples records, and interviews staff to corroborate what they were told is doing more work than one who takes your description. That corroboration is what makes a formal assessment independently credible, and it is where the hours go.

Who performs it, and what follows. Seniority and credentials move the rate, and so does whether the firm's name carries weight with your customers or regulators. Many proposals also bundle remediation support, policy drafting, or a follow-up review, so read carefully for where the assessment ends and the project begins.

A firm that answers these questions clearly is simpler to work with than one quoting a low headline figure with the evidence depth left vague.

The price of a self-guided assessment

Self-guided assessments are priced as a product, which makes them straightforward to compare. NISTnow's current public prices are $250 for NISTquick and $500 for an organization's first full assessment, with $750 for each full assessment after that. NISTquick is a focused scope of 44 controls drawn from all six Functions. A full assessment covers all 106 controls. Each price is a single payment with no subscription, and a free preview of your results is available before you decide to unlock the report.

Each price covers a guided walk through the controls with an explanation of each and guidance for every maturity level. The report adds an executive summary written for an owner or a board, and strengths and priorities for each of the six Functions. It also carries a prioritized roadmap of what to do now, next, and later, tool suggestions matched to the platforms you already run, and a handoff section for your next formal assessment.

How to prepare

An hour of preparation materially improves the result.

Assemble a list of the systems the business depends on: email, accounting, banking, payroll, the industry application the business could not operate without, and wherever customer data lives. NIST's small business guide suggests recording, for each asset, who administers it, what sensitive data it reaches, and whether multi-factor authentication is required to access it (NIST SP 1300).

Establish who administers your IT, whether that is an outside provider, a member of staff who inherited the role, or you. Locate any existing insurance policy, customer security clauses, or regulatory obligations. Then confirm two facts rather than assuming them: whether backups are currently running, and whether multi-factor authentication is enforced on email and banking.

Finally, choose the honest respondent. The person who knows how the business operates, including the workarounds, will produce a more useful assessment than the person who knows how it is supposed to operate.

What to do afterward

The assessment is the inexpensive part. The value is in what follows.

Take the first three items and give each one an owner and a date. Limit this to the first three, not the whole roadmap. A short list that moves achieves more than a long list that waits.

Start where the evidence points. Across the sources cited in this guide, the same four measures recur. The first is multi-factor authentication on the accounts that reach email, money, and administrative rights. The second is backups that run automatically, sit out of an attacker's reach, and are restored in a test. The third is prompt patching of anything reachable from the internet, and the fourth is knowing in advance who to call. Two of those have their own guides, rolling out multi-factor authentication and backups that survive ransomware.

Keep the report, so that the next questionnaire is answered from a document rather than from memory. And reassess when something changes materially, or annually. A single assessment is a snapshot. Two assessments show a direction, which an insurer, a customer, or a board will usually want to see.

Where to start

If a formal assessment is clearly required of you, commission one from a qualified assessor and skip the intermediate step. If instead you do not yet know where your business stands, that is the gap worth closing first, and it does not require a large budget or a long engagement to close it. A self-guided assessment will give you an honest picture and a short list of sensible next steps, and it will leave you better prepared for the formal assessment you may eventually need.