# Cybersecurity Assessment in Canada: Evidence and Deliverables Checklist > Liam from Amen Security · 2026-11-07T00:46:55.076Z · cybersecurity · cybersecurity · assessment · evidence · canada A cybersecurity assessment in Canada should define systems, evidence, deliverables and exclusions before work starts. Request a findings register, a prioritized action list and a handover walkthrough; agree implementation separately. It is not automatically a penetration test, certification, insurance approval or ongoing monitoring. This is a buying checklist, not an assessment of your environment, a service commitment or legal advice. Scope at a glance Stage What you should agree Before the review Agree systems, evidence and exclusions During the review Record findings and prioritization At handover Identify owners and separately scoped implementation Scope summary by Amen Security. Not an assessment of your environment or a service guarantee.What is a cybersecurity assessment? A cybersecurity assessment is a scoped review of an organization's systems, controls and evidence that produces documented findings and recommended next actions; unlike a penetration test, it does not involve exploiting systems unless that is explicitly authorized in writing. Before you ask anyone for a quote, write one sentence about the decision you need to make. Maybe leadership inherited systems nobody fully understands. Maybe you need to pick what to fix first. Maybe a client questionnaire is due and you don't know which evidence you're missing. That sentence tells you whether you need a broad posture review or a narrow look at identity or endpoints. Amen's public [Cybersecurity services page](https://amensecurity.ca/en/services/cybersecurity) lists assessments, vulnerability analysis, access management, security monitoring and compliance support. It describes a risk snapshot that asks about admin rights, consistent MFA and Conditional Access, endpoint patching and restorable backups. Those are published focus areas. They are not a promise that one fixed-price package covers every possible test or a formal compliance opinion. Use the page to start the scope conversation, not end it. What should the scope of a cybersecurity assessment include? Put the boundary on page one. The proposal should name the systems, sites, cloud tenants, data sources and interviews it covers. It should also say what's excluded, what the assessor can't reach, and how those gaps will show up in the report. Be specific about methods. Is collection read-only? Are scans authorized? Is anything disruptive off the table? The word "assessment" is not permission to probe your systems. This gets messy when several suppliers share the work. Your [MSP](https://amensecurity.ca/en/glossary/msp) may hold endpoint evidence but have nothing on a third-party application. A cloud administrator might hand over configuration exports without having authority to touch a firewall. Ask each bidder to spell out dependencies and name the approver on your side. Where the terms are binding, have the right advisers read them. What deliverables should a cybersecurity assessment produce? The deliverable we'd push for is a findings register. Each line ties an observation to its evidence, states any limitation, explains why it matters to the business and proposes a next action. It should make clear whether a control was tested and failed or simply wasn't tested. Those are very different results. You also want an executive summary that makes sense to whoever paid for the work. A coloured score with no trail behind it is hard to turn into a plan anyone will own. On prioritization, ask the assessor to show their assumptions instead of inventing precision. Which issue has observed exposure? Which fix depends on another one? What still needs validating? The report should separate urgent items from longer-term improvements and suggest owners, rather than quietly handing work to people who never agreed to it. How can current advisories test whether your inventory is ready? Cyber Centre advisories published on November 4, 2026 show why an inventory and an evidence trail matter. They cover [WatchGuard AuthPoint Authentication Gateway before 7.6.0](https://www.cyber.gc.ca/en/alerts-advisories/watchguard-security-advisory-av26-1125), [Docker Buildx before 0.37.2](https://www.cyber.gc.ca/en/alerts-advisories/docker-security-advisory-av26-1123) and Docker Desktop before 4.98.0, plus [Android's November bulletin](https://www.cyber.gc.ca/en/alerts-advisories/android-security-advisory-november-2026-monthly-rollup-av26-1128) published on November 2. These are product advisories. They are not findings that your business runs the affected products or has been compromised. Use them as a quick test. Ask a bidder: how would your assessment establish whether we run any of these, who owns them, and what evidence shows they're maintained? Don't expect anyone to certify you're safe just because they read a bulletin. The notices encourage reviewing the linked guidance and applying necessary updates; whether that applies to you depends on your environment. The advisories are Canadian. Applying the same inventory questions to US systems is a reasonable extension of the control, not a new US warning. What should happen at handover, and what comes after? Ask for a walkthrough of the report, an agreed format for the action list and a way to log questions or factual corrections. Decide how sensitive evidence is transferred, kept and deleted. And check that your internal team, your current MSP or another supplier can actually use the recommendations. Then keep the next purchase separate. Amen describes a progression from risk snapshot to quick wins to controls and monitoring, but the actual work still has to be scoped. Keep assessment, remediation and ongoing operations as distinct deliverables in the proposal. Cybersecurity assessment deliverables checklist Use these questions to compare written proposals side by side. Assessment evidence and handover comparison Area Question Evidence to request Scope Systems, permissions, exclusions Approved boundary before work Evidence Source, observation, limitations Traceable findings register Handover Priorities, dependencies, owners Usable action list and walkthrough Exclusions Which methods, disruptive tests and implementation are outside scope? Written permissions and separately approved work Frequently asked questions What is a cybersecurity assessment? A cybersecurity assessment is a scoped review of an organization’s systems, controls and evidence that produces documented findings and recommended next actions. It does not involve exploiting systems unless that is explicitly authorized in writing. Is an assessment automatically a penetration test? No. Agree the permitted methods in writing; exploitation and disruptive testing require explicit scope and authorization. What deliverables should a cybersecurity assessment include? Ask for a findings register that links each observation to evidence, limitations, business relevance and a proposed next action, plus an executive summary, a prioritized action list with suggested owners and a report walkthrough. Does an assessment guarantee certification or insurance acceptance? No. A procurement checklist and an assessment report do not establish certification, an audit opinion or an insurer’s acceptance. Article sources [Amen Security: Cybersecurity services](https://amensecurity.ca/en/services/cybersecurity) [Canadian Centre for Cyber Security, WatchGuard security advisory AV26-1125](https://www.cyber.gc.ca/en/alerts-advisories/watchguard-security-advisory-av26-1125) [Canadian Centre for Cyber Security, Docker security advisory AV26-1123](https://www.cyber.gc.ca/en/alerts-advisories/docker-security-advisory-av26-1123) [Canadian Centre for Cyber Security, Android security advisory AV26-1128](https://www.cyber.gc.ca/en/alerts-advisories/android-security-advisory-november-2026-monthly-rollup-av26-1128) Want help writing the scope? Tell us which systems matter most, what's worrying you and what you need at the end. [Contact Amen Security to scope a cybersecurity assessment](https://amensecurity.ca/en/contact). We'll confirm responsibilities, exclusions and next steps before any work is approved. ## Topic: Cybersecurity & compliance - [Main guide](https://amensecurity.ca/en/services/cybersecurity.md) - [Managed IT vs Break-Fix: Side-by-Side Comparison](https://amensecurity.ca/en/guides/msp-vs-break-fix.md) --- Source page: https://amensecurity.ca/en/blog/cybersecurity-assessment-canada-evidence-deliverables-checklist Markdown version for AI agents · Amen Security Email: info@amensecurity.ca Phone: +1 (204) 514-3536