What a network assessment should hand you
An organization pays for an assessment and receives an eighty-page document. It lists every device and every software version. It says some of the software is old. Nobody disagrees, nobody acts, and a year later the same document is commissioned again.
An assessment is worth its cost only if it changes what you do next. That depends less on how much was examined than on what is handed over at the end.
What you should receive
- Diagrams that match reality. How the network is connected today, not how it was designed. If the diagrams you already had were accurate, the assessment should say so.
- Findings ranked by consequence. Each one states what is wrong, what could happen because of it, and how likely that is. A finding with no consequence is an observation.
- Evidence. The configuration line, the measurement or the capture behind each finding, so your own engineers can check it.
- A recommended order of work. What to fix this month, this quarter, and when the budget allows, with a rough effort for each.
- What was not examined. Every assessment has limits. An honest one names them.
- A conversation. A session where the people who did the work walk your team through it and answer questions.
How to tell a finding from filler
- A finding is specific to you. "Software should be kept current" is true of every network. "These two core switches run a release with a known defect that affects the feature you depend on" is a finding.
- A finding can be acted on. It names the device, the setting and the change.
- A finding has a reason. If the only justification is that a best-practice guide says so, ask what happens if you leave it.
Questions to ask before it starts
- What decision is this assessment meant to support? An upgrade, a migration, a budget request and a security review each need different depth in different places.
- Which applications matter most? An assessment that never looks at how voice, video or the clinical system crosses the network will miss what users notice.
- Who will do the work, and will they present it?
- What access is needed, and how will collected data be handled and returned?
The test of an assessment is whether you can name the first three things you will change because of it.