A checkup is 60 to 90 minutes on site. It is a walk through of what you run, with you or your staff present, and nothing is changed while we are there.
What exists, how old it is, what it is used for, and whether it is still receiving updates. Machines that hold the accounting file get read first.
Who can sign in, who is an administrator, which accounts are shared, and which systems allow multi factor authentication. Legacy accounts are listed with what they can reach.
Mail, file sharing and the settings that decide who can share what with whom. External sharing and forwarding rules are checked, because they are common ways for a business to leak data without meaning to.
What is backed up, where it goes, who can reach it, and whether a restore has ever been tried. An untested backup is a hope, not a backup.
The router, the Wi Fi, guest access, and how the network is separated from the machines that hold business data.