Updated: June 16, 2026

A few years back, a founder running a fast-growing fintech company in the Financial District, called me after sitting through a free IT assessment from another provider. The report he had been handed ran forty pages, flagged a dozen urgent vulnerabilities in alarming red type, and ended with a quote for a five-figure monthly contract he was told to sign by the end of the week. He was not calling to ask whether the findings were accurate. He was calling to ask whether he was being played.

I have been doing IT in San Francisco for more than twenty years, and I told him what I will tell you here: a free IT assessment is one of the most useful things a business owner can get their hands on, and it is also one of the easiest things for a provider to turn into a sales weapon. The difference comes down to who the assessment is actually serving. When we offer one at Jones IT, the honest reason is that it is how we earn a relationship, by showing you what we see before either of us has committed to anything. I will not pretend every provider runs it that way, and the fact that it costs you nothing is precisely why you should walk in with your eyes open.

So this post covers what a free IT assessment should give you, what you will need to bring to it, what actually happens while it is underway, and the specific signals that tell you a provider is sizing up your infrastructure rather than your wallet.

What A Free IT Assessment Is Actually For

A free IT assessment is an introductory evaluation of your IT infrastructure, security posture, and operational effectiveness, offered by a Managed IT Service Provider (MSP) at no cost and with no obligation to continue. The provider examines your systems, identifies gaps, and gives you a read on where your technology stands relative to where your business needs it to be.

From the provider's side, the motive is simple. We use it to demonstrate what we know and to start building trust. But the value flowing the other direction is the part worth dwelling on, because it is the reason you should bother.

You walk away with professional eyes on your environment without spending a dollar, and that alone is worth the afternoon. A good assessment confirms things you already suspected, and occasionally it surfaces something you had no idea about. We ran a free assessment for a SoMa startup last year that was confident its nightly backups were running fine. They had been failing silently for nine weeks. The automated success emails were still arriving, so nobody had reason to check, and one bad hardware failure would have cost them every file created since the day the backups quit. They found out from a free afternoon, not from a disaster. More than any single finding, though, the assessment gives you a way to evaluate the provider. How they look at your infrastructure, what they prioritize, and how they explain it tells you more about whether you want to work with them than any sales deck ever will.

One caveat worth saying plainly: a free assessment is a lighter version of a comprehensive paid audit. A full audit is detailed, sometimes time-consuming, and goes deep across every area. A free one trades some of that depth for speed. It will still return useful results, and the quality of those results depends heavily on what you put into it.

How To Tell An Honest Assessment From A Sales Pitch

The single most useful skill you can bring to a free IT assessment is the ability to read the provider's intent. The findings might be perfectly accurate, yet the recommendations still be shaped to push you toward the most expensive outcome. So before we get to logistics, here is what I tell people to watch for. Coming from someone who runs these assessments for a living, I would rather you spot a bad one early than learn the hard way.

Be wary if you see any of the following:

Generic, one-size-fits-all recommendations that could have been written for any company. A real assessment reflects your business, your industry, and your actual setup. If the advice would apply equally to a law firm and a biotech lab, it was not tailored to you.
Alarming language or fear tactics without evidence behind them. Red type and dire warnings are easy to generate. A trustworthy provider explains why something is a risk and how serious it actually is, rather than leaning on the fear alone.
An inflated scope of work that demands a large upfront investment with no alternatives offered. If the only path presented is the most expensive one, that is a choice the provider made, not a constraint your infrastructure imposed.
No clear picture of total cost. Ask about maintenance, subscriptions, and what scaling up will cost a year out. A quote that conveniently omits the recurring and future costs is not a real quote.
Vague reports with no actionable steps, no rough timelines, and no sense of what resources implementation requires. A finding you cannot act on is not worth much.
Heavy upselling that never justifies the added value. If the assessment functions mainly as a runway to a pitch, you learned something useful about the provider, just not what they intended.

None of this means you should walk in cynical. It means you should walk in informed. A provider operating in good faith will welcome these questions, because answering them is how they earn the work. The fintech founder I mentioned earlier ended up bringing us in for a second look. Most of the other provider's findings held up. The forty pages of urgency and the end-of-week deadline did not.

What You Will Need To Bring

A free IT assessment is only as good as the information behind it, so the more complete a picture you can hand over, the more it can actually tell you. You do not need to assemble all of this before deciding the assessment is worth your time. But knowing what a provider will ask for helps you judge whether they are looking at the right things.

Most of it comes down to context and access. The provider needs to understand your business before judging your technology: your industry, your goals, and where you are headed. A Series B SaaS company scaling headcount has different priorities than a biotech firm carrying HIPAA obligations, and the assessment should reflect that distinction. From there, the questions get concrete. Here is what an MSP will typically want:

Your infrastructure. A list of hardware and software, your network topology, any cloud services, and the third-party tools in the mix. This is the map the provider works from.
Your security posture. Whatever you already run, such as firewalls, endpoint protection, and written security policies, plus any compliance requirements you fall under, whether HIPAA, PCI-DSS, or SOC 2. The provider needs to know the rules you are playing by before judging how well you are playing by them.
Your data and recovery setup. Where your data lives, on-premise, cloud, or hybrid, and the details of your backup and disaster recovery plan. This is the area where free assessments most often find something quietly broken, as the SoMa startup learned.
Your users and access. How many users and devices you have, how many people work remote or hybrid, and how access is controlled today. Access is where a surprising amount of risk hides.
Your current IT support. Whether IT is handled in-house, outsourced, or both, including who owns what and any service-level agreements (SLAs) in force.
Temporary system access. The provider may ask for limited, temporary access to read the real health of your infrastructure rather than relying on your description of it.

If you have results from a prior audit, hand those over too. They give the provider a fast baseline and save everyone time.

What Actually Happens During The Assessment

A free IT assessment runs in three stages: defining the scope, gathering data, and analyzing the gaps. Because the free version trades depth for speed, the work concentrates on getting you a clear and honest read in a limited window rather than exhausting every corner of your environment.

Defining the scope

The first move is deciding what gets looked at. Since there is only so much ground a free assessment can cover, the provider bounds it by depth, by breadth, or by both. Depth is how far they drill into a given area; breadth is how many areas they touch. A common scope might be a network and WiFi performance review, an IT risk assessment, a disaster recovery and business continuity check, or a review of the security standards and regulatory compliance that apply to you. Pinning this down early keeps the assessment honest about what it can and cannot deliver.

Gathering data

Next the provider collects information on your current setup. Depending on the scope and the access you granted, that means building an inventory and reading the real state of:

IT assets, plus how users, devices, and access are managed.
Network architecture, bandwidth, and performance.
Security policies, protocols, and measures.
Data storage and backup.
Adherence to any industry regulations you fall under.

Gap analysis and benchmarking

Finally the provider compares where your IT is against where your business needs it to be, and against the standards other organizations in your industry hold. Each gap gets weighed by its potential impact and prioritized accordingly. What you should walk away with is a clear read on where your infrastructure stands, where it needs to be, and a roadmap for closing the distance. If the report stops at a list of problems and never gets to that roadmap, the assessment did half its job.

What To Do With The Findings

Getting the assessment is the easy part. What you do next is where the value either materializes or evaporates. Here is the sequence I would follow.

1. Review the findings internally first. Read the report carefully and decide what you agree with. Sometimes it confirms what you already knew; sometimes it surfaces something new. Run it against the warning signs above before you accept any of it at face value. A finding you cannot verify or that arrives wrapped in urgency deserves a second look.

2. Decide how you want to engage. If you are happy with the findings and ready to act, the next question is what kind of relationship fits. There are three common engagement models, and they apply to different business situations.

The three engagement models are worth understanding before you talk dollars:

Fully managed IT services hand complete IT management to the provider. This fits organizations without an internal IT team who want the whole function covered.
Co-managed IT services pair your internal IT team with the provider, drawing on the strengths of both. This fits companies that have IT staff but need more capacity or specialized depth.
Short-term IT projects cover a specific piece of work without an ongoing commitment. This fits organizations that want help on a defined project and nothing more.

3. Get into a detailed consultation. Once you have engaged, dig into the findings properly. Clarify anything unclear, talk through proposed solutions and the alternatives to them, and run a real cost analysis covering both the short and long term. This is where you figure out what to do first.

4. Build a strategic IT roadmap. Turn the consultation into a plan with timelines, resources, and clear ownership, and set a budget the organization can actually support. A roadmap nobody is funded to execute is just a document.

5. Execute, then keep reviewing. Start with the most critical and highest-impact projects, since early wins keep your stakeholders behind the effort. Then revisit the strategy regularly so it keeps pace with how your business changes.

The Bottom Line

A free IT assessment should hand you transparency, advice shaped to your actual business, and a clear plan you can act on. To get that, you have to share a real picture of your business and infrastructure, and you have to read the provider's intent as carefully as you read their findings.

Do that, and you come out understanding your IT far better than you did going in. That is true whether or not you hire the provider who ran the assessment. The good ones are fine with that, because the relationship is the point. The SoMa startup with the dead backups is a client now. We did not win that by scaring them. We won it by showing them something true on an afternoon that cost them nothing.

If you are looking to improve your IT infrastructure and are not sure where to start, reach out to us. You will get an honest read from our team, and a clear sense of what working with Jones IT would actually look like.

Get Better IT Support

About The Author

Evan Jones
Founder and CEO of Jones IT

With over two decades of IT experience in San Francisco, Evan guides Jones IT's long-term strategy, finances, and culture, with a vision of building the city's highest-rated IT services firm. Outside of work, you'll find him on the golf course or running Bay Area Warriors, his non-profit connecting Bay Area kids to college through basketball.

Free Business IT Assessment: How to Avoid the Sales Trap