The short answer
An assessment should show what could realistically go wrong, how likely and damaging each risk is, and what to fix in what order. Insist on:
- Scope agreed before work starts
- Evidence per finding: screenshot, export or scan
- Risk register by likelihood and impact
- Roadmap: quick wins, owners, effort
- Executive summary a board or insurer can read
- Walkthrough and follow-up check
If a proposal does not promise these, ask why.
Deliverable by deliverable
| Deliverable | What good looks like |
|---|---|
| Scope and authorisation | Systems, locations, cloud services and questions agreed; written authorisation for any scanning. No paying for unneeded work, no gaps you assumed were covered. |
| A recognised baseline | Something you can look up, such as the NIST Cybersecurity Framework or CISA ransomware guidance (widely used international good practice), so reports compare year to year. Banks, payment service providers and other CBN-regulated firms will also want mapping to the Central Bank of Nigeria's cybersecurity framework and guidelines; national guidance is available from ngCERT. |
| Coverage where attacks start | At minimum: identities and admin access, MFA, devices and patching, email and domain authentication, remote access and internet-facing systems, backups and restore tests, cloud configuration, third-party access, payment change verification, incident response. |
| A risk register, not a vulnerability count | Scanner items grouped, de-noised and ranked: missing MFA on an admin account above a low-severity printer finding. |
| A roadmap you can budget for | Quick wins in days, next-quarter projects, longer-term work; each with owner and effort, so you can plan spending in naira and see which items depend on dollar-priced licences. |
| Reports for two audiences | A plain-language executive summary and a technical report your IT team or provider can act on. |
Example: what a useful finding looks like
| Field | Example |
|---|---|
| Finding | Backups are stored on a network share that all staff accounts can reach |
| Evidence | Share permissions export, dated, attached as appendix B |
| Risk | Ransomware running as any user could encrypt or delete the backups |
| Likelihood / impact | Medium / High |
| Recommended fix | Move one copy offline or to immutable storage; restrict access to a dedicated backup account; test a full restore |
| Effort | Medium |
| Suggested owner | IT lead with the backup provider |
Red flags when comparing proposals
- A "score" with no evidence. A number out of 100 says little without the findings.
- Scan-only work sold as an assessment. Scans are one input; configuration review and talking to the people who run your systems find what scanners cannot.
- Promises of compliance or certification. An assessment shows risk and gaps. Compliance with the Nigeria Data Protection Act 2023 or a sector regulator's rules is a legal question, and certification, such as ISO/IEC 27001, comes from an independent accredited certification body.
- No plan for your data. Ask how access is granted, how sensitive configuration data is stored and when it is deleted.
- The assessment as a sales funnel. Findings that all point to one product deserve a second look.
Rather talk it through? Tell us what prompted the question, whether an insurer, a client or a near miss, and we will scope an assessment around it. Talk to a Promatics specialist
Common objections, answered honestly
Scope scales down for small organisations, an independent review backs your IT person rather than replacing them, AI cannot log in to your systems or own the findings, the work barely disrupts staff, and ranking means you fix first where risk drops most.
The five objections in full
| Objection | Honest answer |
|---|---|
| "We are too small to need this." | Smaller organisations are attacked through the same routes: stolen passwords, phishing, unpatched devices. Scope and effort scale down with your size. |
| "Our IT person already looks after security." | Often well. An independent review gives them evidence, priorities and support for budget requests, and catches what anyone misses in systems they built. |
| "We could ask an AI tool." | A useful starting point for questions. It cannot log in to your tenant, confirm which servers lack protection, interview your finance team about payment changes, or put its name to the findings. An assessment is accountable work on your actual systems. |
| "It will disrupt staff." | Mostly configuration review and short interviews; any scanning runs in agreed windows. |
| "We cannot afford to fix everything." | You do not have to: ranking means spending first where risk drops most. |
What working with Promatics looks like
- Scoping callSystems, sites, questions and scanning rules agreed in writing.
- CollectRead-only named accounts, approved scans, short interviews with IT, finance, operations.
- AnalyseCompare with a recognised baseline; rank by likelihood and impact.
- Report and walk throughExecutive summary, technical report and roadmap, reviewed together.
- Follow upAfter an agreed period, check fixes and update the register.
You can then fix the findings with your own team, another provider or us. Assessment data is deleted at the end as agreed.
Buyer's checklist
- Written scope and scanning authorisation
- Named baseline or framework
- Identity, devices, email, network, backups, cloud and process all covered
- Evidence attached to every finding
- Findings ranked by likelihood and impact
- Roadmap with owners and effort estimates
- Executive summary and technical report
- Walkthrough with leadership
- Follow-up check included or priced
- Clear handling and deletion of assessment data
When to bring in help
A very small environment on one cloud platform can self-assess against the NIST framework and CISA's ransomware guidance. Bring in a professional when an insurer, client or board wants evidence, systems grew through several people and providers, after a merger or cloud move, or after a near miss. Our security assessments are built around these deliverables, and remediation can follow as a project or as part of our cybersecurity services.
Limitations
This guide describes a general security assessment. It is not a penetration test specification, an audit standard or legal advice, and an assessment does not certify compliance.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Cybersecurity Framework, National Institute of Standards and Technology
- #StopRansomware, Cybersecurity and Infrastructure Security Agency
- ngCERT, Nigeria Computer Emergency Response Team
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.