Step 01 · Assess
2A Cyber Check
A fixed-fee remote review of the ten areas where firearms businesses are most exposed. You get an executive report and a prioritized plan to fix what matters.
- Price$995 standard scope
- FormatRemote no site visit
- Areas10 reviewed
- PaymentInvoice after scope is confirmed
What you receive
A report your owner can read and your IT team can act on.
- Executive summary
- Risk severity for every finding
- Technical findings with evidence
- Prioritized remediation plan
- Recommended order of operations
- Readout call
- Critical
- 3
- High
- 7
- Medium
- 9
- Low
- 5
Administrator accounts do not require phishing-resistant MFA.
Secure privileged identities first.
Scope
Ten areas, reviewed against how attacks on small businesses actually happen.
A structured, remote, evidence-based assessment. We examine configuration in your admin portals, review evidence exports and documents you share, interview the people who run things, sample representative devices and accounts, and walk through the business workflows that matter.
- Inspected
- Checked directly, through read-only access or public records.
- Inspected + interview
- Inspected where a console exists; otherwise from interviews and documents.
- Interview
- Reviewed through interviews, the questionnaire and documents you share.
Identity and access
Most breaches of small businesses start with a stolen login.
- Microsoft 365 / Google Workspace Reviewed by: Inspected
Tenant configuration, sharing settings, mail-flow rules, admin roles, audit logging and legacy authentication.
- Multi-factor authentication Reviewed by: Inspected
Who has MFA, which methods, where it can be bypassed, and which accounts are exempt.
- Privileged accounts Reviewed by: Inspected
Admin accounts, shared logins, former employees, and service accounts with more access than they need.
Devices and recovery
Whether an infected computer becomes an outage or a closure.
- Endpoint security Reviewed by: Inspected + interview
Protection on every computer and server: coverage, configuration, update status, local admin rights.
- Backups and recovery Reviewed by: Inspected + interview
Whether backups exist, are isolated from ransomware, and have ever been restored successfully.
What the internet sees
Your website, domain and email, checked from the outside.
- Website security Reviewed by: Inspected
Platform and plugin currency, admin access, TLS, security headers and exposed services, checked from the outside without intrusive testing.
- DNS and email authentication Reviewed by: Inspected
SPF, DKIM, DMARC and registrar security: whether receiving mail servers are told to reject mail that spoofs your domain, and how hard your domain would be to hijack.
How the business runs
Payments, vendors and the plan for a bad day.
- Payment environment Reviewed by: Interview
How card data moves through POS and e-commerce, and how the payment environment is separated from everything else. This is not a PCI DSS assessment.
- Incident readiness Reviewed by: Interview
Who you call, what you do in the first hour, and whether the plan exists anywhere but in someone's head.
- Vendor access Reviewed by: Inspected + interview
Every third party with remote access or your data, and how that access is controlled and reviewed.
The Check is a remote cybersecurity assessment, not a physical-security inspection. If interviews surface a physical or operational concern, we note it in the report; assessing it properly needs a separate scope and usually a site visit.
Who the $995 Check is for
Designed for smaller firearms businesses.
The Check is built for smaller firearms businesses. The $995 fee covers the standard scope below. We confirm fit on the scoping call; larger or more complex businesses get a custom quote before any work starts.
Standard scope
- Employees
- Up to 25
- Locations
- Up to 2, sharing one IT environment
- Email and identity
- 1 Microsoft 365 or Google Workspace tenant
- Domain
- 1 primary domain
- Devices
- Up to 30 computers, servers and POS terminals
- Website
- 1 primary website or online store
- Industry systems
- A representative review of your principal workflow, such as POS or electronic A&D records
These limits set the size of a standard engagement. Within them we review configuration and representative samples; not every device or account is examined one by one.
Custom quote after scoping
- More staff, locations, devices or tenants than the standard scope
- Manufacturing or production networks
- Several domains, websites or separate IT environments
You see the custom price in writing before any work starts, and you can decline.
Access and confidentiality
How we protect your business during the Cyber Check.
You are letting an outsider look at your admin consoles. Here is how we keep that access narrow and your information protected.
Authorized in writing first
We confirm scope and get your explicit authorization before we access any system.
Never your passwords
We never ask for shared or personal passwords. You create a named account for us, with MFA wherever the platform supports it.
Least access, read-only
We ask for read-only roles wherever possible. When an evidence export or a supervised screen-share is enough, we use that instead.
Designed not to disrupt
No production setting changes, no agents installed and no intrusive scans in the standard Check. Inspection is primarily read-only to keep disruption to a minimum.
Access removed when we finish
We list every account and role we used, and make sure it is removed promptly after the engagement.
Evidence kept tight
Evidence is encrypted in transit and at rest and limited to the people working on your Check. We prefer redacted exports and configuration summaries.
We avoid regulated records
We do not need copies of Form 4473 records, NICS information, card data or your customers' personal information, and we avoid collecting them.
Confidential by default
Nothing about your business goes to a third party, or into our marketing, without your written permission. Mutual NDA on request.
You own the report
Share it with your IT provider, your insurer or anyone else. You are under no obligation to hire us for the fixes.
Process
Four steps, most of them on our side.
- Scoping call. We learn how your business runs, which systems are in play, and confirm the Check fits the standard scope.
- Access and questionnaire. Read-only access to admin consoles, plus a short questionnaire for what cannot be inspected.
- Review. We examine configuration, exposure and process across all ten areas.
- Readout. Executive report, remediation plan and a walkthrough call. The report is yours to keep.
- Price
- $995 for the standard scope. Larger or more complex businesses are quoted in writing before any work starts.
- Format
- Fully remote. No site visit required.
- You receive
- Executive report, technical findings, prioritized remediation plan, readout call.
- What happens next
- Nothing, unless you want it. Fix it yourself, hand the plan to your IT provider, or ask us to quote 2A Cyber Harden.
- Not included
- Penetration testing or exploitation, physical site inspection, endpoint-by-endpoint auditing, forensic investigation, compliance certification (including ATF and PCI DSS), production configuration changes, remediation and emergency incident response. More in the FAQ.
Common questions
What happens during a Cyber Check?
A short scoping call, read-only access to your admin consoles, a brief questionnaire for what cannot be inspected, our review across ten areas, then a written report and a readout call.
Is it fully remote?
Yes. The Check is a remote cybersecurity assessment and needs no site visit. It is not a physical-security inspection. If interviews surface a physical or operational concern, we note it in the report. Schubring Global Solutions also does physical security work, scoped separately.
Will this interrupt employees?
Rarely. The Check is primarily read-only and we do not change production settings, so it is designed to keep disruption to a minimum. Your team spends time on a scoping call, a short questionnaire and the readout.
Is the $995 price fixed?
Yes, for the standard scope: up to 25 employees, up to 2 locations sharing one IT environment, one Microsoft 365 or Google Workspace tenant, one primary domain, up to 30 devices and one primary website or online store. Larger or more complex businesses get a custom quote after the scoping call, before any work starts. Remediation is always quoted separately.
What is not included in the standard Check?
Penetration testing or exploitation, physical site inspections, endpoint-by-endpoint auditing, forensic investigation, compliance certification, production configuration changes, remediation, and emergency incident response. We will tell you if you need any of them.
Does a Check make us ATF compliant?
No. We assess the cybersecurity of the systems behind your records and operations, such as electronic A&D records and eForm 4473 workflows where you use them. We do not make regulatory compliance determinations, give legal advice or issue certifications.
Is this appropriate for a small FFL?
Yes. Small shops often have the biggest gaps relative to effort, and the fixes are usually quick. The standard Check was designed with a business your size in mind.
Start your Check
Start with the basics. We handle the rest.
We reply by email to confirm the Check fits the standard scope, then agree access and a delivery date. Payment comes after that, by invoice.
Request received. We will confirm scope and schedule by email before any payment.
Your reference: