A scored IT and security assessment for your business
For businesses of 1 to 20 people with no IT staff. You find out where you stand, in plain English, with the evidence behind it and a list of what to fix first. The price is $1,500 for up to 10 people and $2,500 for 11 to 20.
Sound familiar?
Most businesses that ask for an assessment have noticed at least one of these:
- Someone who left still knows the email password.
- The whole office shares one login for the important accounts.
- A customer received a fake invoice that looked like it came from you.
- A client or insurer sent a security questionnaire that nobody can answer.
- The shared drive has never been backed up, or nobody is sure.
- Nobody can update the website, because the person who built it is gone.
None of these mean you did something wrong. They are what happens when a business grows without anyone whose job is IT.
What gets checked
- Accounts and passwords
- Who has an account, who still has one after leaving, whether two-step sign-in is on, and whether passwords are shared.
- Whether someone else can send mail that looks like yours, and how a fake invoice or a phishing message would get through.
- Devices
- Whether laptops and phones are kept up to date, encrypted and locked, and what happens if one is lost.
- Backups
- What is backed up, where it goes, and whether anyone has ever tested getting it back.
- Website and domain
- Who owns the domain and the site, whether they are kept current, and who can change them.
- Who can get into what
- Shared drives, finance and payroll systems, and the other accounts the business runs on.
What you get
A written report, scored in MercScope, the assessment platform the practice built for its own work. It gives you:
- a score for each area, so you can see where you stand at a glance;
- the evidence behind every score, so nothing rests on opinion;
- a fix list in priority order, written for someone who isn't technical;
- ground rules for working together, if you go on to the next step.
How it works
- You email contact@mercitlabs.com. There are no forms.
- A scheduled 30-minute call to understand the business, its people and its accounts.
- The assessment, done remotely. It needs some of your time, mostly answering questions and giving access to look at your accounts. The first call sets out exactly what is needed and when.
- You get the written report, and a call to walk through it.
The assessment only looks. Nothing is changed without your written agreement.
Price
| Size of business | Price |
|---|---|
| Up to 10 people | $1,500 |
| 11 to 20 people | $2,500 |
The price is fixed and agreed in writing before any work starts.
Common questions
Do I need to understand IT?
No. The report is written for owners and office managers, and the walkthrough call covers anything that isn't clear.
Will it disrupt work?
No. All of it is done remotely, and nothing is changed during the assessment.
Is this an audit or a certification?
No. It is a practical check of how your business is set up, scored against recognised security controls. It doesn't certify anything.
What happens after?
The report and the fix list are yours to keep, whatever you decide. If you want help, the fixes can be done for you, starting with your website and email, and kept right afterwards by a part-time IT department. Anything beyond the assessment is quoted in writing first.
Getting started
Email contact@mercitlabs.com. It goes straight to the engineer who would do the work. Taking new clients starting March 2027.