A cybersecurity assessment in Canada should define systems, evidence, deliverables and exclusions before work starts. Request a findings register, a prioritized action list and a handover walkthrough; agree implementation separately. It is not automatically a penetration test, certification, insurance approval or ongoing monitoring.
A cybersecurity assessment in Canada should define systems, evidence, deliverables and exclusions before work starts. Request a findings register, a prioritized action list and a handover walkthrough; agree implementation separately. It is not automatically a penetration test, certification, insurance approval or ongoing monitoring.
This is a buying checklist, not an assessment of your environment, a service commitment or legal advice.
Stage | What you should agree |
|---|---|
Before the review | Agree systems, evidence and exclusions |
During the review | Record findings and prioritization |
At handover | Identify owners and separately scoped implementation |
A cybersecurity assessment is a scoped review of an organization's systems, controls and evidence that produces documented findings and recommended next actions; unlike a penetration test, it does not involve exploiting systems unless that is explicitly authorized in writing.
Before you ask anyone for a quote, write one sentence about the decision you need to make. Maybe leadership inherited systems nobody fully understands. Maybe you need to pick what to fix first. Maybe a client questionnaire is due and you don't know which evidence you're missing. That sentence tells you whether you need a broad posture review or a narrow look at identity or endpoints.
Amen's public Cybersecurity services page lists assessments, vulnerability analysis, access management, security monitoring and compliance support. It describes a risk snapshot that asks about admin rights, consistent MFA and Conditional Access, endpoint patching and restorable backups. Those are published focus areas. They are not a promise that one fixed-price package covers every possible test or a formal compliance opinion. Use the page to start the scope conversation, not end it.
Put the boundary on page one. The proposal should name the systems, sites, cloud tenants, data sources and interviews it covers. It should also say what's excluded, what the assessor can't reach, and how those gaps will show up in the report.
Be specific about methods. Is collection read-only? Are scans authorized? Is anything disruptive off the table? The word "assessment" is not permission to probe your systems.
This gets messy when several suppliers share the work. Your MSP may hold endpoint evidence but have nothing on a third-party application. A cloud administrator might hand over configuration exports without having authority to touch a firewall. Ask each bidder to spell out dependencies and name the approver on your side. Where the terms are binding, have the right advisers read them.
The deliverable we'd push for is a findings register. Each line ties an observation to its evidence, states any limitation, explains why it matters to the business and proposes a next action. It should make clear whether a control was tested and failed or simply wasn't tested. Those are very different results.
You also want an executive summary that makes sense to whoever paid for the work. A coloured score with no trail behind it is hard to turn into a plan anyone will own.
On prioritization, ask the assessor to show their assumptions instead of inventing precision. Which issue has observed exposure? Which fix depends on another one? What still needs validating? The report should separate urgent items from longer-term improvements and suggest owners, rather than quietly handing work to people who never agreed to it.
Cyber Centre advisories published on November 4, 2026 show why an inventory and an evidence trail matter. They cover WatchGuard AuthPoint Authentication Gateway before 7.6.0, Docker Buildx before 0.37.2 and Docker Desktop before 4.98.0, plus Android's November bulletin published on November 2. These are product advisories. They are not findings that your business runs the affected products or has been compromised.
Use them as a quick test. Ask a bidder: how would your assessment establish whether we run any of these, who owns them, and what evidence shows they're maintained? Don't expect anyone to certify you're safe just because they read a bulletin. The notices encourage reviewing the linked guidance and applying necessary updates; whether that applies to you depends on your environment. The advisories are Canadian. Applying the same inventory questions to US systems is a reasonable extension of the control, not a new US warning.
Ask for a walkthrough of the report, an agreed format for the action list and a way to log questions or factual corrections. Decide how sensitive evidence is transferred, kept and deleted. And check that your internal team, your current MSP or another supplier can actually use the recommendations.
Then keep the next purchase separate. Amen describes a progression from risk snapshot to quick wins to controls and monitoring, but the actual work still has to be scoped. Keep assessment, remediation and ongoing operations as distinct deliverables in the proposal.
Use these questions to compare written proposals side by side.
Area | Question | Evidence to request |
|---|---|---|
Scope | Systems, permissions, exclusions | Approved boundary before work |
Evidence | Source, observation, limitations | Traceable findings register |
Handover | Priorities, dependencies, owners | Usable action list and walkthrough |
Exclusions | Which methods, disruptive tests and implementation are outside scope? | Written permissions and separately approved work |
A cybersecurity assessment is a scoped review of an organization’s systems, controls and evidence that produces documented findings and recommended next actions. It does not involve exploiting systems unless that is explicitly authorized in writing.
No. Agree the permitted methods in writing; exploitation and disruptive testing require explicit scope and authorization.
Ask for a findings register that links each observation to evidence, limitations, business relevance and a proposed next action, plus an executive summary, a prioritized action list with suggested owners and a report walkthrough.
No. A procurement checklist and an assessment report do not establish certification, an audit opinion or an insurer’s acceptance.
Amen Security: Cybersecurity services
Canadian Centre for Cyber Security, WatchGuard security advisory AV26-1125
Canadian Centre for Cyber Security, Docker security advisory AV26-1123
Canadian Centre for Cyber Security, Android security advisory AV26-1128
Tell us which systems matter most, what's worrying you and what you need at the end. Contact Amen Security to scope a cybersecurity assessment. We'll confirm responsibilities, exclusions and next steps before any work is approved.
Your comment will be published after our team reviews it.
