A cybersecurity assessment is an expert-led review of how your organization handles security across 22 areas, from endpoint protection and password management to backups and incident response. Cyber Unit runs these assessments remotely over Zoom or Teams for businesses in Hamilton, Burlington, and across Canada and the United States. No on-site visit is required. You receive a written report documenting observations and recommendations across each area, followed by a walkthrough with our analysts.

This post answers the most common questions business owners ask before booking an assessment: what it actually covers, how long it takes, how it differs from a penetration test, which regulations apply in Ontario, and whether there is a free option to start with.

What does a cybersecurity assessment cover?

Cyber Unit's assessment covers 22 security areas, according to the service description on cyberunit.com/security-assessment/. These include computer security, device encryption, mobile security, email security, network security, password management, multifactor authentication, backups, onboarding and offboarding, security awareness training, incident response planning, AI usage and governance, and more. Each area is evaluated through a combination of structured interviews with your team and a hands-on review of your systems and configurations.

The output is a formal written report that pairs observations with recommendations, category by category. The report is built for leadership, boards, or cyber insurers, not just your IT team. A findings walkthrough session is included so you can ask questions and align on priorities.

How long does a cybersecurity assessment take?

Most assessments are completed within a couple of weeks from kickoff to final report, according to the FAQ on Cyber Unit's assessment page. The exact timeline depends on the size of your organization and how quickly your team can schedule the interview sessions.

Because everything is conducted remotely, there is no travel coordination. Businesses in Hamilton or Burlington work with the same analysts and the same process as clients in Toronto, Vancouver, or anywhere else in Canada and the US.

How is a cybersecurity assessment different from a penetration test?

A cybersecurity assessment evaluates your people, processes, and technology through interviews and configuration reviews. A penetration test actively attempts to exploit vulnerabilities in your systems. The two serve different purposes. The Canadian Centre for Cyber Security designed its baseline controls for small and medium organizations as a starting point, and points organizations that want to go further to more comprehensive security measures.

Most businesses benefit from an assessment first. It identifies gaps in fundamental controls (password policies, patching, backups, access reviews) that a penetration test would simply confirm as exploitable. Once those gaps are closed, a penetration test can validate that the defences hold up against a skilled attacker.

Which privacy and security regulations apply to Ontario businesses?

Ontario does not have a general private-sector privacy law. Private-sector businesses conducting commercial activities in Ontario are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA), according to the Office of the Privacy Commissioner of Canada. Under PIPEDA, organizations must report breaches of security safeguards to the OPC when there is a real risk of significant harm to an individual, notify affected individuals, and keep records of all breaches.

Healthcare organizations in Ontario handling personal health information are also subject to the Personal Health Information Protection Act (PHIPA), which the OPC lists as substantially similar to PIPEDA for health information. Federally regulated businesses (banks, telecoms, airlines) are always subject to PIPEDA, and it also covers their employees' personal information.

A cybersecurity assessment does not certify compliance, but it does identify control gaps that could become regulatory findings. Many businesses use the assessment report to support cyber insurance applications or to prepare for audits.

What baseline controls should a small business prioritize?

The Canadian Centre for Cyber Security publishes Baseline Cyber Security Controls for Small and Medium Organizations. The document outlines 13 control areas: incident response planning, automatic patching, security software, secure device configuration, strong user authentication, employee awareness training, backup and encryption, secure mobility, perimeter defences, cloud and outsourced IT security, website security, access control and authorization, and portable media security.

CCCS says the controls apply the 80/20 rule: "achieve 80% of the benefit from 20% of the effort." Many of them overlap with Cyber Unit's 22 assessment areas, including incident response planning, updates and patching, multifactor authentication, backups, and security awareness training. The assessment also covers areas the baseline does not name, such as AI usage and governance, token and session security, and cyber liability insurance.

Is there a free cybersecurity assessment option?

Yes. Cyber Unit offers a free 22-area cybersecurity self-check you can complete in under 5 minutes. It runs entirely in your browser with no signup required. You receive an instant score, a breakdown by category, and recommendations for your weakest areas. It is a useful starting point, but it relies on self-reported answers and cannot verify anything.

Canadian businesses looking for a framework-aligned free tool can also use the free CCCS baseline assessment from Cybersecurity Canada, which evaluates your organization against the Canadian Centre for Cyber Security's 13 baseline controls. It has 50 questions, takes under 30 minutes, and gives recommendations for every control area with links to official Canadian government guidance.

The professional assessment goes further: an analyst conducts structured interviews with your team, reviews your environment firsthand, and delivers a formal written report with prioritized recommendations specific to your business. Pricing depends on the size and complexity of your environment; Cyber Unit provides a custom quote after an initial conversation.

What should I ask my IT provider about our security posture?

Before or after an assessment, these questions help you understand where you stand:

  • How many of the 22 security areas (or the 13 CCCS baseline controls) do we have documented controls for?
  • When was our incident response plan last updated, and have we tested it?
  • What is our patch timeline for critical vulnerabilities (operating systems, browsers, business applications)?
  • Do we have a process for offboarding departing employees within 24 hours, including revoking access to cloud apps?
  • Are backups tested regularly, and could we restore operations after a ransomware attack?
  • Is multifactor authentication enforced on all accounts, or only some?

If the answers are unclear, an assessment will surface the gaps and give you a prioritized list of what to fix first.

Next step

If you want to know where your business stands before talking to a provider, start with the free 22-area cybersecurity self-check. It takes under 5 minutes and gives you an instant score with category-by-category recommendations. From there, you can decide whether a professional assessment makes sense for your organization.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. References to PIPEDA, the Office of the Privacy Commissioner of Canada, and the Canadian Centre for Cyber Security baseline controls summarize publicly available information as of the date of publication. Organizations should consult qualified cybersecurity and legal professionals before relying on this article to make compliance or operational decisions.