Network Audit & Documentation
Documentation ($1,250 per site) gives you the topology diagram, device inventory and port map; a Network Risk Assessment (from $3,500) adds a senior engineer’s review of configurations, segmentation (the separate lanes that keep one problem from reaching everything else), security posture and drift (settings that changed without anyone noticing), with findings ranked by risk and a 30/60/90-day plan. Either way the written report is yours to keep, independent of any vendor and of your existing IT provider (assessment pricing).
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Why Network Audits Matter
A network audit is an independent review of your firewall, switches, Wi-Fi and the links between offices that writes down what is installed, how it is set up and where the risks are. Mid-market networks grow organically over years — a switch added here, a firewall replaced there, a contractor who set up the VPN and left. The result: nobody can answer "what does our network actually look like today?" with confidence. The first step to fixing anything is documenting what’s there. Independent network audits do that — without sales pressure to spec a redesign you may not need.
We don’t make money on the audit by recommending hardware. We make money on the audit by delivering a clear, accurate picture of your current network — and you decide what (if anything) to do next. An audit can come back as "fix these three things, otherwise leave it alone." That’s a fine outcome, and you can do those fixes with us or without us.
The audit is performed by a senior, Cisco-certified, Fortinet-certified network engineer with 20+ years of practice — not a junior tech checking boxes. Findings say what a setting will cost you, not only that it is wrong: not "this is misconfigured" but "this is the setting that takes the office down the next time the primary line drops."
Cisco, Fortinet, Palo Alto, Juniper, Aruba, Meraki, SonicWall, WatchGuard — we audit what you have, regardless of vendor. If you run more than one brand, the audit covers all of it. You are not paying us to learn your gear from scratch.
On the Network Risk Assessment, findings can be mapped against HIPAA, PCI-DSS or SOC 2. The same finding (for example, "any device plugged into a wall jack lands on the clinical network") is written up both as a network risk and as a HIPAA Security Rule control gap. Mapping is a $2,500 add-on to the assessment, included at the Complex tier and above; the documentation tier has no findings and no mapping. Clinics: see HIPAA compliant network engineering for the full control map. For FortiGate estates, Tekmirio packages the config history and rule review into a signed evidence pack your auditor can verify offline.
What the Audit Includes
The audit covers the network surface that matters: configuration, segmentation, security posture, performance, and operational discipline. Output is a written report, not a slide deck.
Firewall rule base, switching configs, wireless settings, VPN configurations, NAT rules, IPS/IDS posture. We pull current configs (with your permission and credentials) and review them line by line. Findings include drift (settings that no longer match your standard), dead rules nobody uses, rules that let far more through than they should, and practices the vendor has retired.
Network topology diagrammed (or re-diagrammed if existing diagrams are stale). VLAN structure, broadcast domain design, redundancy paths, single points of failure.
Authentication mechanisms, identity provider integration, MFA enforcement, privileged-access controls, remote-access posture, certificate management, key rotation. A full security architecture review, done by an engineer with the time set aside for it.
Interface utilization patterns, latency baselines, link saturation analysis, capacity headroom across the fleet. Identifies sites about to outgrow their current circuits and devices approaching utilization-based replacement.
When mapping is in scope, findings are mapped to the framework you need: HIPAA Security Rule (technical safeguards), PCI-DSS (network requirements) or SOC 2 (logical access, monitoring), with an evidence-readiness assessment alongside the technical findings. Mapping is an add-on to the assessment, included at the Complex tier and above (see the cost question below); the documentation tier has no findings and no mapping.
With a Network Risk Assessment: a written report (typically 25–60 pages depending on environment), ranked findings, a prioritized remediation roadmap and an executive summary. The documentation-only engagement delivers the topology diagram, inventory with lifecycle dates, configuration export and port/VLAN map. Distributable to your team, your CFO, your auditor, your future MSP. See a sample report (PDF).
Audit Triggers We Hear
A network audit answers a specific business question. If you only need the map, network documentation on its own is $1,250 per site. These are triggers we see.
National scope. Audit work is primarily remote — we pull configs, traffic data, and topology information remotely with your authorization. On-site presence isn’t typically required. After the audit, managed plans are available from a Sacramento Fortinet MSP or a Fortinet MSP in San Francisco.
Our Approach
No mystery. No black box. Every step is documented, explained, and approved before execution.
A complete Network Risk Assessment of your current network, at a fixed price. Configurations reviewed, segmentation validated and gaps documented, in writing.
Address critical risks first, then build toward a standardized architecture. Every change documented, tested, and scheduled with a rollback plan. If the fix is a firewall replacement, it is a fixed fee: $2,500 for a like-for-like FortiGate swap, or a migration from $6,500 up to the 90-series class and from $8,900 for 100F–200F or an HA pair (two firewalls so one can fail).
Ongoing monitoring, documented changes and, from Edge Secure up, scheduled reviews. Managed plans from $695 per site per month: automated monitoring, human response Mon–Fri, 8 AM–5 PM Pacific. The network does not just work today — it evolves with your operations.
Your Engineer
The senior engineer who documents your network stays your point of contact from assessment through remediation and ongoing operations, so a follow-up question from your auditor goes to someone who already knows your environment and compliance requirements. You are never passed between rotating technicians or dropped into a ticket queue.
Background: Founder, ex-Meta. Past engagements include Cisco, Wells Fargo, Fannie Mae, and other Fortune 500 networks — the same caliber of engineering, now applied to mid-market organizations.
We are a Fortinet Engage Advocate partner and supply FortiGate, FortiSwitch and FortiAP. We also monitor and manage the Cisco, Aruba, Arista and other enterprise gear you already run. You don’t have to rip anything out to work with us.
Best-Fit Audit Profiles
The audit is most valuable in environments where someone other than the team running the network needs to see the network’s real state.
Pre-acquisition: due diligence on the target’s network state to inform deal valuation. Post-acquisition: documented baseline of inherited environment so the integration team knows what they actually have. Both common in M&A activity.
SOC 2 / HIPAA / PCI-DSS audit cycles starting in 60–90 days, internal teams need to know where gaps are before the auditor arrives. Pre-audit network review identifies findings while there’s still time to remediate, rather than learning about them in the auditor’s report.
Switching MSPs — outgoing MSP’s documentation is incomplete or unreliable, incoming MSP needs accurate baseline. Independent audit by a third party provides the truth that neither MSP can produce credibly.
Cyber insurance underwriters increasingly want network architecture evidence and security posture documentation as part of underwriting. An independent audit produces the artifacts the underwriter asks for, in a form you can attach to the application.
After a security incident or major outage, leadership wants confidence that the rest of the environment doesn’t have similar problems. Post-incident audit provides systematic review of the broader network state alongside the specific incident analysis.
Considering a major refresh (firewall replacement, SD-WAN migration, ZTNA implementation) but unsure of the current baseline. Audit produces the documentation needed to scope the modernization project accurately.
FAQ
SOC 2 (and HIPAA, PCI-DSS) audits are performed by certified auditors and result in a formal opinion or attestation. Our network audit is technical assessment work that produces engineering-quality documentation of your network’s state. The two complement each other: we do the technical groundwork that makes the formal compliance audit straightforward. We don’t produce SOC 2 reports; SOC 2 firms generally don’t produce engineering-quality network documentation.
Read-only access to network devices (configs and operational state), monitoring tools (if you have them), and topology documentation. We don’t need write access; we don’t make changes during the audit. For air-gapped or sensitive environments, we’ve worked with screen-share-only sessions and supervised access with an internal engineer present. We’ll work within your security constraints.
It depends on the tier, and the largest of the five sizing axes (sites, firewalls, switch groups, connected devices, access points) sets the tier. From kickoff to written report: Small about 2 weeks, Mid-Market 2–4 weeks, Complex 3–5 weeks, Enterprise 4–8 weeks; tier limits are on the assessment pricing page. Most of the timeline is config review and report-writing, not data collection.
Yes. Findings are confidential under our agreement, and the report is yours once paid in full. We reuse only anonymized findings patterns and redacted examples (no customer name, IP space, staff names or identifiable business detail) for internal training, benchmarking and anonymized case studies.
Fixed fee, published. Network documentation is $1,250 per site: a topology diagram, a device inventory with lifecycle (end-of-support) dates, a configuration export and a port/VLAN map (which device plugs into which switch port, and which lane it sits in). No findings or roadmap at that tier. The Network Risk Assessment is $3,500 for a single small site: one firewall, up to three switch groups (a stack counts as one), 100 connected devices and 6 access points. It adds the findings, a risk ranking and a 30/60/90-day plan; larger networks are priced by size on our assessment pricing page. Compliance mapping is a $2,500 add-on; it is included at the Complex tier and above. Every engagement includes a debrief call to walk through the deliverables with your team.
Findings come in two kinds: quick wins you can fix in days, and larger projects that take weeks to months. The report ranks each by risk and effort so you can decide what to do in-house and what to hand off. You can keep the report and do the fixes yourself, do the critical fixes with us and nothing else, or hand us the roadmap as fixed-fee projects (firewall migration from $6,500) or a managed plan from $695 per site per month. All three are fine outcomes.
Start the Network Audit
The audit kickoff defines scope, access, and reporting format up front (how an engagement runs). Findings get delivered as a written report with prioritized recommendations and updated network diagrams. It is yours to keep whether or not you engage us for the fixes. Documentation is $1,250 per site. The Network Risk Assessment is $3,500 for a single small site; larger networks are priced on the assessment pricing page. See a sample report (PDF).
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
