HIXOR
Security Health Check
How the Health Check Is Performed
What the Security Health Check actually reviews, and how. We publish the method because visible work is the basis of trust.
How it proceeds
- Interview — We ask about your business, the services and devices you use, and your current measures (email / chat).
- Current-state review — We review settings in ways that are practical for you, such as shared settings screens. We never receive passwords or other secrets.
- Report — Your current position and a prioritized improvement list, delivered as a report.
- Declaration support — Support for the SECURITY ACTION self-declaration procedure (the declaration itself is free and is made by your business).
What is reviewed
- Accounts and authentication — inventory of key accounts, MFA status, leftover accounts of former staff
- Password management — reuse and sharing, adoption of a password manager
- Backups — whether backups run, where they are kept, whether restores have been tested
- Updates — OS and key software update status, end-of-support software
- Sharing and permissions — file-sharing scope, unnecessary external sharing or excessive permissions
- Policy and operations — whether a basic security policy exists and how responsibilities and procedures are set (informed by IPA's 25-item self-diagnosis)
How priorities are set
Improvement items are ordered by both impact and likelihood. The report shows what to start with, and why. You can check the format in the sample report (a fictional business).
What this assessment does not do
- Penetration testing or offensive vulnerability exploitation
- 24/7 monitoring or incident response
- Granting official certifications (SECURITY ACTION is a self-declaration, not a certification)
- Guaranteeing outcomes or subsidy approval