The assessment may review network infrastructure, computers, servers, cloud systems, remote access practices, user permissions, authentication controls, email security, data protection measures, backup procedures and existing cybersecurity tools. Policies, incident response procedures and employee security awareness may also be examined.