Question 1

What if I'm the only person at my firm?

Accepted Answer

You still hold your clients' trust and their data, and that's what matters. Running a small firm doesn't change the basics you need to have in place. The good news is that for a one- or two-person office, covering those basics is faster and cheaper than most people expect. We'll show you exactly what to do and in what order, and the first steps can usually be done in a week or two.

Question 2

Is a cyber risk assessment actually required?

Accepted Answer

In regulated industries, including financial services, most regulators expect an up-to-date cyber risk assessment to be on file. If you're an RIA, broker-dealer, or insurance firm, there's a good chance your regulator expects this. Having it done means you're ready before an exam notice arrives or a cyber-insurance application asks for it.

Question 3

How long does the assessment take?

Accepted Answer

With our expert full-service option, it's generally two one-hour calls. A cyber practitioner walks you through each control during the first call, scoring as you go. The assessment is typically complete by the end of that session, and we do a follow-up to close it out. No upcharge if you need a little longer.

Prefer to go at your own pace? The self-service wizard lets you work through the assessment privately, a section at a time, whenever it's convenient.

Question 4

Do I need to be technical?

Accepted Answer

No. Every control is written in plain English, and a real person is available if you get stuck. If you can read your own credit report, you can read your H2Cyber grade. That's the standard we write to.

Question 5

What are the 56 controls?

Accepted Answer

The H2Cyber assessment covers 56 cybersecurity controls, grouped into owner-friendly categories that reflect how a small firm operates. You don't need to know the underlying frameworks. We handle that mapping on the back end. What you see is plain English, your score, and your next steps.

Question 6

What is the letter grade?

Accepted Answer

After completing the assessment, your firm receives a letter grade from A to F. It's backed by a percentage score, but the letter is what you see first. "We're a C, and here's what gets us to a B" is something you can act on. "We scored 67 percent" is harder to use.

Question 7

What is the H2Cyber Level seal, and what are the Levels?

Accepted Answer

A plain seal records the Level earned by a self-assessment without the Validated band. A Validated seal additionally records H2Cyber review and explicit approval for that report.

There are three Levels (Level 1, Level 2, Level 3). Each one corresponds to a higher score threshold. Level 1 is 70% overall, Level 2 is 80%, and Level 3 is 90%. See /levels for the full explainer.

For affiliations or MSPs who use our platform, the seal can be issued under your own brand, powered by H2Cyber. The same plain-versus-Validated distinction still applies.

Question 8

What does the assessment cost?

Accepted Answer

You can start the assessment free, with no card. Workspace (Self-Service) is $14.99 per month. Concierge (Full Service) is $24.99 per month. Includes $100 one-time onboarding. Both are month to month, and you can cancel at any time.

See /pricing

Question 9

Are managed services included in the assessment cost?

Accepted Answer

No. The assessment and managed services are priced separately. Managed services are an optional add-on for firms that want ongoing device monitoring, email security, or Microsoft tenant management after they've completed the assessment.

Question 10

What are the prerequisites for managed services?

Accepted Answer

For device monitoring: we support Microsoft, Apple, and Linux machines running a currently supported operating system.

For email security: your email must be hosted on Microsoft 365, and you need full control over your M365 tenant. If you purchased your Microsoft 365 licenses through GoDaddy, you'll need to transfer tenant control away from them first. It's a straightforward process and GoDaddy has a walkthrough for it. You'll also need Microsoft Graph Data Connect enabled on your tenant. We can help you with that step. It's quick.

Question 11

Does device monitoring cover mobile phones or tablets?

Accepted Answer

No. We support Windows and Mac laptops, desktops, and servers. Corporate data on a personal phone or tablet is best managed through application protection policies tied to user identities in M365 rather than device monitoring.

Question 12

How do I sign up for managed services?

Accepted Answer

Contact us at sales@h2cyber.com or call 469-715-5255 and let us know which service you need and how many devices or users. We'll send you an invoice and a link to schedule setup.

Question 13

Why did my computer ask me to reboot twice?

Accepted Answer

If your computer prompted you to restart twice in a row, it needed more than one update. Some updates require a reboot before the next one can install. Here is a simple example: your device scans and finds three patches (A, B, and C). Patches A and C each need a reboot to finish, and Patch C can't start until Patch A is done. So you get one restart for Patch A, then almost immediately another for Patch C. Once both are done, no more prompts. This is normal behavior and means your device is staying current.

Question 14

How is H2Cyber different from my IT provider?

Accepted Answer

Think about how medicine works. Your family doctor handles general care. When you need a neurosurgeon or a cardiologist, your doctor refers you out because those are specialties that require different training.

The IT world often doesn't work that way. IT providers tend to keep everything in-house, including cybersecurity, even when cyber is not their primary specialty. That is not a criticism. That is how the market developed. Cybersecurity is a distinct specialty with its own certifications, methodologies, and failure modes.

H2Cyber is the cyber specialist. We're not a replacement for your IT team. We cover the specific ground they may not be trained to cover, and we help you understand exactly where your firm stands.

Question 15

Is my data safe with H2Cyber?

Accepted Answer

Yes. See h2cyber.com/security for a full explanation of how we protect the information you share during the assessment. The short version: we are a cybersecurity company. Keeping your data safe is what we do for a living.

Take Charge of Your Cybersecurity

About the assessment

The Level seal

Pricing and plans

Managed services

How is H2Cyber different from my IT provider?

Still have questions?