Do you really know what is sitting inside your IT environment?
Most 20 to 200 staff NZ businesses are running on a technology stack that has grown by accident. Tools were added during COVID, staff left with admin credentials still active, a previous IT provider set things up that no one has reviewed since. The Microsoft 365 tenant has licence waste. The firewall is five years old. Backups run, but no one has tested a restore.
When something goes wrong, the owner is the one who has to answer for it. A Technical Business Review takes that fog off the table. You get a clear, independent picture of what you have, what you are paying for, where the exposure sits and what to fix first.
What does a Technical Business Review actually cover?
A Technical Business Review is a structured audit of your IT environment, delivered by a senior OxygenIT engineer. It looks across infrastructure, security, backup and recovery, Microsoft 365, networking, vendor contracts and documentation. The output is a written report, an executive summary for your leadership team and a prioritised remediation list.
Every OxygenIT Technical Business Review delivers the following:
- A full inventory of hardware, software, cloud services and vendor contracts.
- A security posture snapshot measured against the NCSC Critical Controls and SMB1001:2026.
- A Microsoft 365 licensing and configuration review.
- A backup, disaster recovery and business continuity readiness check.
- A network, connectivity and Wi-Fi review.
- A prioritised remediation plan with estimated effort and business impact.
A TBR is not a sales pitch disguised as an audit. You keep the report whether you engage OxygenIT for remediation or not.
When does a Christchurch or New Zealand business need a Technical Business Review?
Most owners know the moment they need one. Here are the five clearest triggers:
- You are changing IT providers and want an independent baseline before handing over.
- Your cyber insurer is asking questions about controls, backups and access management that you cannot answer with confidence.
- You have inherited a business or merged with one, and you need to understand what you have actually bought.
- Staff keep reporting the same problems and no one has a clear picture of why.
- You are preparing to sell the business or raise capital, and buyers or investors will want a clean view of IT risk and cost.
If two or more of these sound familiar, you need a Technical Business Review.
What is included in OxygenIT’s Technical Business Review?
Our Technical Business Review is delivered in six workstreams, packaged into a single written report and a 60-minute leadership presentation.
Infrastructure and cloud inventory
A full inventory of servers, endpoints, cloud tenants, network devices and SaaS subscriptions. We find the shadow IT, the orphaned accounts and the licences you are paying for but no one is using.
Security posture assessment
Your current security controls measured against the NCSC Critical Controls, NZISM and SMB1001:2026. We highlight where you meet the bar, where you fall short and what to fix first.
Microsoft 365 configuration review
A deep look at your Microsoft 365 tenant: licensing mix, conditional access, MFA coverage, guest access, data loss prevention and compliance configuration. Most reviews find 15 to 30 percent licence waste.
Backup and disaster recovery check
We verify backups actually run, verify restores actually work, and measure your recovery time and recovery point objectives against a realistic disaster scenario.
Network and connectivity review
Firewall configuration, Wi-Fi coverage, switch health, internet connectivity and VPN setup. We identify single points of failure and where capacity will run out in the next 12 months.
Prioritised remediation roadmap
Every finding ranked by business impact, effort and cost. You leave with a clear 30, 60 and 90-day action plan, whether you deliver it with OxygenIT or in-house.
How the OxygenIT Technical Business Review works: your first 30 days
Days 1 to 7: scoping and access
Scoping call with your leadership team. Read-only access to your IT environment. Vendor contract collection. We agree the scope, the people we need to talk to and the confidentiality terms up front.
Days 7 to 21: assessment and evidence gathering
Our senior engineer conducts the technical assessment, interviews key staff and reviews documentation. We collect evidence, not opinions. Nothing in the final report is unsupported.
Days 21 to 30: report delivery and presentation
We deliver a written report, an executive summary and a prioritised remediation roadmap. A 60-minute presentation to your leadership team walks through findings and answers questions. You keep the report regardless of next steps.
Why Christchurch businesses choose OxygenIT for a Technical Business Review
Independent, not a sales pitch
You keep the report whether you engage us for remediation or not. Our reviewers are salaried engineers, not commissioned sales. Every finding is evidenced.
Certified where it matters
Independently certified to ISO 27001 for information security and ISO 42001 for AI management. SMB1001:2026 assessor capability. We apply the same standards internally that we audit on externally.
20 years on the ground in Canterbury
Founded in Christchurch in 2005. Our Horner Street team knows the local sector mix, the local talent pool and the local vendor landscape. We are not a remote agency.
Plain-English reporting for owners and boards
Executive summary written for non-technical readers. Technical detail in appendices for your incoming IT team. Every finding ranked by business impact, not just technical severity.
Vendor neutral
We do not resell hardware. We are not locked to a single firewall, backup or RMM vendor. Our findings recommend what is right for your business, not what pays us the most.
How much does a Technical Business Review cost in New Zealand?
A Technical Business Review at OxygenIT is delivered as a fixed-fee project, scaled to the size and complexity of your IT environment. We do not publish hourly rates because every review is scoped to outcomes. Ask for indicative pricing for your business size and industry.
Essential Review
For 20 to 50 staff firms with a single office and a standard Microsoft 365 footprint. Core security, M365 and backup review. Fixed-fee project.
Standard Review
For 50 to 100 staff firms with multiple sites, mixed cloud and on-premise, or compliance obligations. Full six-workstream review with executive presentation. Fixed-fee project.
Comprehensive Review
For 100 to 200 staff firms, regulated industries or multi-entity groups. Extended assessment, deeper compliance mapping, and 12-month roadmap alignment. Fixed-fee project.
How a Technical Business Review supports your cyber insurance and compliance position
Cyber insurers in NZ are now asking detailed technical questions: MFA coverage, privileged access management, backup immutability, patch status, incident response plans. Answering with a guess is how renewals get declined or priced up.
A Technical Business Review gives you evidenced answers. The report maps your current state to the NCSC Critical Controls, Privacy Act 2020 obligations and SMB1001:2026 requirements. You walk into your insurance renewal or compliance audit with facts, not assumptions.
Frequently asked questions about Technical Business Reviews
01. What is a Technical Business Review?
A Technical Business Review (TBR) is an independent, evidence-based assessment of your IT environment across security, infrastructure, cloud, backup, network and vendor contracts. It produces a written report with a prioritised remediation roadmap. It is the right service when you need a trusted baseline of where you really stand, before you make a big IT decision or change providers.
02. How long does a Technical Business Review take?
Most OxygenIT Technical Business Reviews are delivered inside 30 days from kick-off. The first week is scoping and access. Weeks two and three are assessment and evidence gathering. The final week is report delivery and a leadership presentation. Comprehensive reviews for multi-site or regulated firms may extend to 45 days.
03. Do I need to change IT provider to get a Technical Business Review from OxygenIT?
No. Our Technical Business Reviews are delivered independently of any managed IT engagement. You keep the report whether you engage OxygenIT for remediation work or not. Many clients use the TBR to benchmark their current provider or to support a change of provider decision.
04. Will you share findings with my current IT provider?
nly with your permission. The report is your property. Some clients prefer to share it with their incumbent provider as a constructive conversation starter. Others prefer to keep it confidential until they have decided next steps. You choose.
05. How much does a Technical Business Review cost in NZ?
Technical Business Reviews at OxygenIT are delivered as a fixed-fee project, scaled to the size and complexity of your IT environment. We offer three tiers (Essential, Standard, Comprehensive) sized for 20 to 200 staff firms. We do not publish hourly rates because every review is scoped to outcomes. Ask for indicative pricing for your business size.
06. Will the review disrupt my business?
No. The assessment is conducted with read-only access to your systems. We do not make changes. Most of our work is done in the background. Staff interviews are scheduled to minimise disruption, typically 30 to 45 minutes each, and focus on a small number of key people.
07. What happens after the Technical Business Review is delivered?
You get a written report, an executive summary for your leadership team and a prioritised remediation roadmap. From there, you have three paths: deliver the remediation in-house, engage your existing provider to deliver it, or engage OxygenIT to deliver it. There is no bundling and no pressure.
08. Does the Technical Business Review cover cyber insurance readiness?
Yes. The security posture workstream maps your current controls against the questions asked by NZ cyber insurers: MFA, privileged access, backup immutability, patch status, incident response and business continuity. You walk into your renewal conversation with evidenced answers.
09. Is the Technical Business Review the same as an ISO 27001 or SMB1001 audit?
No. A TBR is a broader commercial and technical review, not a formal certification audit. Findings are mapped to frameworks like SMB1001:2026, NCSC Critical Controls and NZISM so that you understand your gap to certification. If you want a formal certification pathway, we offer that as a separate service.
10. Do you only serve Christchurch, or all of New Zealand?
OxygenIT is based in Christchurch but delivers Technical Business Reviews across New Zealand. On-site assessment work is delivered in person where practical and remotely where efficient. Our Canterbury presence matters because it puts a local team behind you, not because it limits who we work with.
