Risk Assessment
A structured review of your cybersecurity posture, data handling practices, and vendor relationships — with findings in plain language.
The TechStep Clinic delivers structured, supervised cyber and data risk services to nonprofits, schools, and community organizations — at no cost to you. Our participants do real work, reviewed by real practitioners, resulting in deliverables your team can actually use.
Free Tool for Your Organization
Not sure where your organization stands on cybersecurity risk? Try our free AI-driven risk assessment — no signup required. It takes about 5 minutes and gives you an instant snapshot of your risk posture.
Take the Free Risk Assessment →A structured review of your cybersecurity posture, data handling practices, and vendor relationships — with findings in plain language.
Practical, right-sized policies your team can actually use: data classification, incident response, acceptable use, and more.
Evaluation of third-party tools and vendors you rely on, with prioritized recommendations and a usable inventory.
Guidance on responsible AI use, data governance frameworks, and managing third-party tools your staff has adopted.
Alignment guidance for HIPAA, FERPA, NIST CSF, and other frameworks relevant to your organization type.
Short educational sessions to help your team recognize and respond to common threats — tailored to your context.
Your deliverables
Your commitment
Every clinic engagement runs through our clinic workspace platform — intake, scoping, the supervised work itself, a practitioner review, delivery, and an optional 60-day check-in are all tracked there, so nothing reaches you unreviewed. Nate Butler, CISM, our Director of Security Services, serves as the practitioner anchor of the clinic model: he or a designated reviewing practitioner signs off on every deliverable before it is sent to your organization.
Your files and engagement records are visible only to your organization's point of contact and the assigned clinic team in that workspace. If you're a returning partner, you can log in directly: Partner Login →
What this is — and isn't: The clinic delivers a structured risk review and practical recommendations performed by supervised participants under practitioner oversight. It is a starting point for strengthening your organization's posture, not a certified compliance audit, a penetration test, or a legal determination of regulatory compliance. Where a certified or third-party audit is required, we'll tell you so directly.
Tell us about your organization. A member of our team will follow up within 5 business days.