Straight answers.

A short scoping call, read-only access to your admin consoles, a brief questionnaire for what cannot be inspected, our review across ten areas, then a written report and a readout call.

Most of the work happens on our side. When we confirm scope, we give you a delivery date in writing. Your team typically spends a scoping call, the questionnaire and the readout.

Yes. The Check is a remote cybersecurity assessment and needs no site visit. It is not a physical-security inspection. If interviews surface a physical or operational concern, we note it in the report. Schubring Global Solutions also does physical security work, scoped separately.

Rarely. The Check is primarily read-only and we do not change production settings, so it is designed to keep disruption to a minimum. Your team spends time on a scoping call, a short questionnaire and the readout.

A named, read-only account in your email and identity platform (Microsoft 365 or Google Workspace), plus answers about your devices, backups, website, payment setup and vendors. We never ask for passwords, and we tell you exactly what to grant before we start.

No. The Check is an independent assessment. Your IT provider can fix the findings, we can, or both teams can work together.

Yes, for the standard scope: up to 25 employees, up to 2 locations sharing one IT environment, one Microsoft 365 or Google Workspace tenant, one primary domain, up to 30 devices and one primary website or online store. Larger or more complex businesses get a custom quote after the scoping call, before any work starts. Remediation is always quoted separately.

Penetration testing or exploitation, physical site inspections, endpoint-by-endpoint auditing, forensic investigation, compliance certification, production configuration changes, remediation, and emergency incident response. We will tell you if you need any of them.

No. We assess the cybersecurity of the systems behind your records and operations, such as electronic A&D records and eForm 4473 workflows where you use them. We do not make regulatory compliance determinations, give legal advice or issue certifications.

An executive summary, technical findings with evidence, a severity rating for each finding, a prioritized remediation plan in recommended order, and a readout call. See the sample report.

Yes. Findings are written so any competent IT team can act on them. Many clients hand the plan straight to their provider.

Yes. Small shops often have the biggest gaps relative to effort, and the fixes are usually quick. The standard Check was designed with a business your size in mind.

Yes. We work across the industry: FFLs, ranges and clubs, manufacturers, distributors, gunsmiths, trainers, online retailers and associations.

Read-only access wherever the platform allows it, no configuration changes, scope agreed in writing first, and your findings are never published. See how we protect your business on the Cyber Check page.

For Guard customers, enrolled systems are monitored around the clock by our Security Operations Center, and serious threats follow their documented escalation process. If you are not a Guard customer, our contact form and inbox are not an emergency line. Call your bank first if money may have moved, then your cyber insurer's claims line and your IT provider. Hands-on incident response and forensics are scoped separately.

Managed detection and response backed by a 24/7 Security Operations Center: analyst-led investigation, supported containment actions you have authorized, and a documented escalation process so critical alerts reach the right people. Identity threat detection and other services are included where your plan says so.

You keep the report. Fix things yourself, hand the plan to your IT provider, or ask us to quote 2A Cyber Harden. Ongoing protection through 2A Cyber Guard is optional.