Healthy Business Security Reviews that show where you stand
Healthy Business security reviews from Granite Tech give business owners a clear, honest snapshot of their security every quarter: policies, inventories, people, vendors, and the roadmap, reviewed on a schedule and scored in plain words. Each review ends with a written 90-day action plan, so the gaps get closed instead of filed away.
A quarterly check-in that keeps security from drifting
Security drifts. People leave, vendors change, new software shows up, and the policies written two years ago stop describing how the business actually works. A Healthy Business security review is a structured, quarterly check-in that catches that drift before an attacker, an auditor, or an insurance carrier does.
The review is part of our cybersecurity services and grows out of the Healthy Business framework Granite Tech uses with every client: document the environment, identify the risks, build a roadmap, and review progress on a set schedule. A review needs time and discipline more than new tools, typically one focused meeting of two to four hours each quarter with your leadership team. Here is what each one produces.
A visual snapshot of where security stands across five areas, marked with status words like current, needs update, or review due, so an owner can read it in a minute.
What is working gets written down, and so does what creates exposure. Every risk is named, not just felt.
A short list of priorities for the next quarter, each with an owner and a measurable outcome, so annual goals move in 90-day steps.
Your written security program, policy library, and inventories get updated as part of the review, so the paper trail matches the business.
When a feeling of being secure is all you have
Most owners we meet are not ignoring security. They simply have no regular moment where someone looks at the whole picture. These are the situations that usually bring a business to a scheduled review.
The cyber insurance questionnaire asks about MFA, backups, and training, and nobody is sure how to answer.
An auditor, examiner, or large client asks for your written security program and policies, not a verbal assurance.
And you cannot say for certain that every account, shared password, and app login they had was closed.
You cannot name every vendor with remote access to your systems or a copy of your customer data.
They were written once, signed once, and have not been read since the business added remote work and new software.
Servers, firewalls, and laptops age out of support without warning, and the budget hit arrives as a surprise.
Not sure where you stand? Take the 10-point Healthy Business Scorecard
Five Healthy Business areas, one agenda
Every review walks the same five areas in the same order, so nothing depends on someone remembering to ask. Open an area to see the questions on the table and what you walk away with.
Each area ties back to a plain-language article in the Healthy Business Library, so your team can read the why behind every item before the meeting.
- Do the written policies match how you work today?
We compare the policy library against current practice for passwords and MFA, remote access, acceptable use, and data handling.
- Who has signed the current versions?
Annual policy attestation status by employee, so every acknowledgment is on file.
- Does the written information security program reflect this quarter?
New locations, systems, or services get added to the WISP instead of living in someone's memory.
- Which framework do you answer to?
For regulated businesses, the review maps your controls to HIPAA, GLBA, PCI DSS, or the framework your industry uses.
- Hardware reports
Workstations, servers, and laptops by age and warranty, flagging anything nearing the end of vendor support.
- Network gear
Firewalls, switches, and access points, with firmware status and who holds the admin credentials.
- License changes
Microsoft 365 and other subscriptions added or removed since the last review, and the cloud apps that now hold company data.
- Data and backups
Where sensitive data lives, whether backups are running, and whether a restore has actually been tested.
- Onboarding and offboarding
Every hire and departure this quarter checked against the checklist, with access granted and removed on the record.
- Access to sensitive data
Who holds admin rights and who can open financial, patient, or client records. Knowing this is a security win on its own.
- Training and phishing results
Completion of security awareness training and simulation results, so coaching goes where it is needed.
- Decision rights
Who approves new software, who owns security decisions, and who gets called when something goes wrong.
- New and departing vendors
Software providers, contractors, and service companies added or dropped since the last review.
- Remote access and data sharing
Which vendors can log in to your systems or keep a copy of your data, and whether that access is still needed.
- Vendor security posture
The documentation your most important vendors can show for how they protect your information.
- Open service tickets and feedback
Recurring tickets often point to a deeper problem worth fixing once instead of every week.
- Open and future projects
Status of work in progress and the projects coming up, checked for security impact before they start.
- The 12 to 18 month outlook
Hardware refresh and planned upgrades placed on a calendar, so replacements are budgeted instead of urgent.
- Scorecard and 90-day plan
Your top three risks, the wins worth keeping, and the priorities for next quarter, each with an owner.
One quarter, four steps
The meeting is the visible part. Most of the value comes from the preparation before it and the follow-through after it.
Prepare the data
Your Granite Tech account team pulls ticket history, hardware reports, license changes, and backup status, and updates the scorecard draft before anyone sits down.
Hold the review
Two to four focused hours with your leadership team, walking the five areas in order. Questions get answered in plain language.
Write the plan
The scorecard, the recorded wins and risks, and a 90-day action plan with owners and measurable outcomes, delivered in writing.
Follow through
Granite Tech handles the technical items, your team handles the business items, and next quarter starts by checking what got done.
Scheduled business reviews are the Customer Care step of our 10-step process, and they continue for as long as we work together.
A management habit, backed by the team that runs your IT
A Healthy Business Review is a business management practice first. On its own it surfaces security concerns, but it does not fix them. That is why the review works best paired with qualified IT support that can act on what it finds.
With Granite Tech, the people who prepare your scorecard are the same people who support your network, servers, and workstations day to day through managed IT services. When the review flags an unpatched firewall or an account that should have been closed, the fix goes straight onto the plan instead of into a separate vendor's queue.
These seven standing topics anchor every quarterly review, alongside the five security areas.
- Open service tickets and feedback
- Open projects
- License changes
- Hardware reports and the 12 to 18 month roadmap
- Future projects
- Security concerns with data, backups, software, and hardware
- The scorecard: success areas and improvements
From first baseline to a program that matures every year
Healthy Business security reviews build on each other. The first one sets the baseline, the quarterly reviews keep it current, and the annual cycle rolls everything into next year's plan.
The baseline assessment
A risk assessment and gap analysis of endpoints, email, network, vendors, access controls, and the documentation you already have. It becomes the starting point for your written information security program and your first scorecard.
The quarterly review
The five-area agenda, the seven standing topics, an updated scorecard, and a fresh 90-day plan. Small corrections every quarter keep the program from needing a rebuild every few years.
The annual cycle
Policies are re-read and re-signed through annual policy attestation, the framework mapping is rechecked, and the year's findings roll into next year's roadmap and budget.
Cost, people, and what you keep
The practical questions owners ask before committing to a quarterly review schedule.
What decides the cost
Pricing follows the size and shape of your business, not a fixed package. The main factors:
- Number of users, devices, and locations
- The compliance framework you answer to, if any
- How much documentation already exists
- Whether Granite Tech already supports your IT day to day
Ongoing services run on a standard agreement, and you see scope, pricing, and timelines in a written proposal before you commit.
Who should be in the room
The owner or general manager, whoever runs operations or the office, and the person who handles finance. In regulated businesses, add your compliance or privacy lead. On our side, your account team leads the review.
Keep the group small enough to make decisions. The review exists to assign owners, and that only works when the people who can say yes are present.
What you keep after each review
A dated scorecard, the written 90-day plan, and updated inventories and policies. Over a year those records show steady progress, which is exactly what an insurer, examiner, or board wants to see.
The documentation belongs to your business. It stays useful even if your team changes.
Regulated work in Montana
Clinics, banks, law and accounting firms, and public agencies across Montana carry rules that change what a review has to check. We map each review to the framework your industry answers to, such as HIPAA for healthcare or GLBA for financial services.
Reviews can happen at your office or remotely, with local teams in Missoula, Bozeman, and Kalispell.
A partner who listens first
The Healthy Business Library
Short owner overviews of every policy and practice the review touches, written for business owners rather than IT staff.
Security review questions owners ask
It is a structured, quarterly check-in that gives you an honest snapshot of your security across policies, inventories, people, vendors, and your technology roadmap. Each review produces a scorecard, a record of wins and risks, and a 90-day action plan with owners. It is how Granite Tech applies its Healthy Business framework on a regular schedule.
Quarterly. A 90-day rhythm is short enough to catch staff changes, new vendors, and aging equipment before they turn into problems, and long enough to finish the action items from the last review. Some items, such as policy attestation and the roadmap refresh, run on an annual cycle inside that schedule.
No. Healthy Business security reviews do not replace your auditor or examiner. They keep your written security program, policies, and inventories current between audits, so when an auditor, insurer, or client asks for documentation, it already exists and matches how the business runs.
Very little. Our team prepares the technical data, from tickets and hardware reports to license changes and backup status. Your side brings the business context: staff changes, new vendors, upcoming projects, and anything an insurer or client has asked about. Block two to four hours with the people who can make decisions.
Yes. Granite Tech has offices in Missoula, Bozeman, and Kalispell and supports businesses throughout Montana. Healthy Business security reviews can be held at your office or remotely, and your account team is a phone call away at 406-505-5061.
Find out where your security stands this quarter
Request a short call to talk through your business, what your insurer or auditor is asking for, and whether a quarterly review schedule fits. If you don’t need it, we’ll tell you.
Or email CustomerCare@granite.tech