bcom ICT provides a free IT needs assessment for Gold Coast businesses — reviewing systems, security, backups and licensing, then providing a plain-English written report on what is at risk and what to fix first. The report is yours to keep whether or not you engage bcom ICT. Call 07 3041 8993.
Questions most businesses can't answer about themselves
"Are our backups working?"
Not whether backups run — whether a restore has been tested, and whether ransomware could reach the backup from inside your network. This is the question that most often has an uncomfortable answer.
"Who can get into what?"
Which accounts have multi-factor authentication and which don't. Who still has access who shouldn't. What a departed staff member can still reach.
"What's out of support?"
Operating systems no longer receiving security updates, expired warranties on equipment you can't trade without, and software the vendor stopped patching.
"What are we actually paying for?"
Licences and subscriptions nobody has reviewed. This one frequently pays for the work that follows.
What you get
- A written report in plain English — not a tool export with four hundred findings
- Every issue ranked by what it would actually cost you if it happened
- An inventory of devices, licences, warranties and suppliers, which most businesses have never had
- Where you sit against the ASD Essential Eight
- A prioritised plan: this month, this quarter, and what can genuinely wait
- Rough costs against each item so you can budget rather than guess
Why it's free
Because it is how we find out whether we are a fit, and how you find out the same thing. We would rather spend a few hours discovering that you do not need us monthly than sign you up and part company in eight months.
You keep the report either way. Take it to your existing provider, work through it yourself, or use it to compare quotes. It is written to be useful on its own.
What we need from you is access, whatever documentation exists, and about an hour of someone who knows how the business actually operates. The rest is our work.
What an assessment usually finds
Six situations that bring a business to an assessment, and what tends to be sitting underneath each.
“We don’t know what we’ve got”
Usually systems built up over a decade by several people, none of whom documented anything. Everything works and nobody can describe it.
What we do Document what exists before deciding what to change. Every recommendation we could make is worth less than an accurate picture of the starting point, which is why this comes first.
“We’re not sure if we’re exposed”
Usually genuine uncertainty. Most businesses have some things done well and some things not done at all, and without looking there is no way to know which is which.
What we do Assess against a recognised baseline rather than an opinion. We map findings to the ASD Essential Eight so the result is a position you can measure again later rather than a list of our preferences.
“Our provider says everything is fine”
Usually possibly true. It is also an assessment by the party responsible for the thing being assessed, which is worth noting regardless of how good they are.
What we do Get an independent look. If your provider is doing well, a review says so in writing and that is worth having. We have no interest in manufacturing problems to win work we would rather earn honestly.
“We’re about to spend a lot and want a second opinion”
Usually a sensible instinct before a server replacement, an office move or a major migration.
What we do Establish what the business actually needs before the money is committed. The cheapest moment to change a plan is before anyone has ordered anything.
“We’re growing and it’s starting to creak”
Usually arrangements that suited eight people being asked to carry twenty-five. Nothing has failed; everything has become slightly harder.
What we do Identify what breaks next at the size you are heading for. Growth exposes the weakest part of a setup, and it is considerably cheaper to find it deliberately.
“A client is asking questions we can’t answer”
Usually a security questionnaire, an insurer, or a tender requiring evidence of how information is protected.
What we do Establish your real position, then close the gaps. Answering accurately is not optional, and a review gives you something defensible to answer from.
What an assessment looks like in practice
Representative engagements, drawn from real work with identifying detail removed — we don’t name clients without written permission.
A review that told a business to keep its provider
The situation
A business of forty staff had been with the same IT provider for six years and had begun to wonder whether it was getting value. It commissioned an independent review with a half-expectation of being told to move.
What we found
The provider was doing a competent job. Patching was current, backups were tested, multi-factor authentication was enforced and documentation existed and was accurate — which is more than we find most of the time. Two genuine gaps existed: no formal restore testing schedule, and a firewall configuration carrying rules nobody could account for.
What we did
Reported exactly that, including the parts that reflected well on the incumbent, and set out the two gaps with what each would take to close. Provided the report to the business to hand to its provider.
The outcome
The business kept its provider, who closed both gaps within a month. We did not win the account and were not trying to — a review that always concludes the incumbent is failing is not a review, it is a sales process.
Finding what breaks at forty people
The situation
A business of eighteen staff was planning to roughly double over two years. Everything worked. The directors wanted to know what would stop working, and when, before it did.
What we found
Three things would not survive the growth. The server had capacity for perhaps a year of additional data. The internet connection had no failover and the business was moving more of its work into the cloud each quarter. And every administrative function — onboarding, access changes, password resets — depended on one person’s knowledge with nothing written down, which was already a single point of failure and would become a bottleneck.
What we did
Set out a staged plan with each item costed and sequenced against the growth rather than all at once, starting with documentation because it was the cheapest and the most urgent.
The outcome
The business grew into the plan rather than through a series of failures. Two of the three items were addressed well before they became urgent, which is the only time technology spending is comfortable.
The assessment that found nothing dramatic
The situation
A business commissioned a review largely because a director had read about a competitor being hit by ransomware. There was no specific concern — it was a general unease that something might be wrong.
What we found
Most things were in reasonable order. Backups ran and had been restored from within the year, multi-factor authentication was in place, and machines were patched. Three things were not: a former employee’s account was still active five months after departure, the wireless network had a single password shared with guests and staff alike, and nobody had ever confirmed whether the backup covered the accounting file, which sat on a workstation rather than the server.
What we did
Reported the three findings with the effort each required — two of them under an hour, one about half a day — and reported plainly that the rest was in good shape.
The outcome
All three were closed within a fortnight. The accounting file had genuinely never been backed up, which nobody had known and which would have been discovered at the worst possible time. An assessment that finds three things and says so is more useful than one that manufactures thirty.
Questions Gold Coast businesses ask us
Is the IT assessment really free?
Yes. bcom ICT provides the initial systems review at no charge, and you keep the written report whether or not you engage us. It's how both sides work out whether there's a fit — and sometimes the honest conclusion is that you don't need a monthly arrangement yet.
What do you need from us?
Access to the site and systems, whatever documentation already exists, and roughly an hour of someone who knows how the business actually works day to day. Everything else is our time.
Will it disrupt anything?
No. It's a review rather than a change — nothing is altered during the assessment. Any remediation is quoted and agreed separately afterwards.
How long does it take?
For a typical small business, a few days from access to report. Larger or completely undocumented environments take longer, mostly in discovery rather than analysis.
What if we don't want to use you afterwards?
That's a legitimate outcome and the report is still yours. Plenty of businesses take it to their existing provider — we'd rather it got acted on by someone else than not acted on at all.
Is this the same as a security health check?
No. The needs assessment is broader and free — systems, licensing, hardware and security at a high level. The security health check is a deeper, fixed-fee review focused specifically on your security position and Essential Eight maturity.
Book the free review
A few hours of our time, about an hour of yours, and a written report you keep regardless.