Tools and answers for smarter IT decisions.

What each resource is for

Each of these free IT and cybersecurity resources answers a different question, so the right one depends on what you need to know today.

A one-hour self-assessment for owners

If you own or run the business, you can get a realistic picture in an hour without anyone technical in the room. Where you don't know an answer, choose “not sure”. Not knowing is a finding in itself.

1. Minutes 0–10: score the basics

   Take the security health check. It only needs a couple of minutes, so use the rest to jot down why you answered “partly” anywhere.

2. Minutes 10–20: check insurance readiness

   Work through the cyber insurance readiness check and mark any control you couldn't prove with a screenshot, report or invoice.

3. Minutes 20–30: put a price on downtime

   Run the downtime cost calculator with real figures from payroll and sales. Remember that it leaves out recovery costs, overtime, penalties and lost customers.

4. Minutes 30–45: read one checklist

   Download the guide that matches your lowest-scoring area and work through its checklist. Tick what's done and circle what isn't.

5. Minutes 45–60: write three priorities

   List the three gaps that would hurt most, who owns each one and a date to check progress. That single page is the start of a plan.

Getting honest numbers from the tools

Self-checks are only as useful as the answers you give them. A few habits make the results far more reliable.

• Answer for the weakest case. If MFA is on for most people but not for the shared front-desk mailbox or one admin account, the honest answer is “partly”. Attackers look for the exception, not the average.
• Count proof, not intentions. On the insurance check, tick a control only if you could show evidence today, such as a policy screenshot, a training record or a restore report.
• Use the full cost of an hour. Payroll alone understates downtime. Include benefits in the hourly cost per employee, and for revenue at risk, count the sales you'd lose or have to delay while systems are down.
• Plan for bad timing. A dental office mid-morning, a warehouse at dispatch time or a law firm on a filing deadline loses more than an average hour suggests. Run the calculator twice: once for a typical outage and once for the worst-timed one.

A learning path for office managers

Office and practice managers often become the unofficial IT department: onboarding new hires, chasing vendors, filling in the insurance questionnaire. This path builds working knowledge over a month, one short session a week.

1. Week one: learn the vocabulary. Look up MFA, EDR, phishing, immutable backup, RTO and RPO in the IT and security glossary. These terms appear in nearly every proposal and questionnaire.
2. Week two: own the people side. Read the managed IT guide, then tighten onboarding and offboarding: accounts ready on day one, access removed the day someone leaves.
3. Week three: get the team phishing-ready. Read the email security guide, then show everyone how to report a suspicious message. Payment-change requests always deserve a call back to a known number.
4. Week four: know the recovery plan. Find out where backups live, when a full restore was last tested and who calls whom on a bad day. If nobody knows, that's the first item for your next IT meeting.

After that, keep the FAQ bookmarked. When a colleague asks whether you're covered for something, it often has a straight answer, or at least the right question to ask your provider.

Getting the most from the guide library

The free guide library holds 20 PDFs: a guide to every service we offer, plus one for each industry we specialize in. They share one structure, so after the first one the rest are quick to use.

• Plain-English sections on the topic and the decisions it involves
• A checklist of 20–30 items, grouped so a team can split the work
• Questions to put to any IT provider, including us
• A plan that runs to day 90, in three 30-day phases
• A short glossary for that topic

Not sure which to open first? Pick the guide for your lowest health check category, or your industry guide if you'd rather start broad.

Turning results into a plan

The point of free IT and cybersecurity resources is a better decision, not a better score. Start with the area that scored lowest and take the first move below.

Sort every gap into three buckets

• Fix this month. Gaps that are cheap to close and costly to leave open, such as missing MFA or a restore nobody has tested.
• Plan this quarter. Changes that need budget or scheduling, such as EDR on every device, an email migration or a network refresh.
• Review next quarter. Improvements that matter but aren't urgent, such as mapping your controls to NIST CSF or writing down policies you already follow.

Two local checks the tools can't run for you

The tools cover risks every business shares. Add two San Diego questions to your notes before you build a plan.

• Could the team work through a power shutoff? When Santa Ana winds push wildfire risk up, SDG&E may switch off power to parts of the county through a Public Safety Power Shutoff. List what stops if your building loses power for a day, and what keeps running from the cloud or from home.
• Does any data live in only one building? With the Rose Canyon Fault crossing the San Diego area, earthquake readiness is a local concern. If your files, accounting data or practice records exist only on equipment in your office, whether that's in Mission Valley or Escondido, an immutable off-site copy belongs at the top of your list.