We are a small office with no IT person. Is a security review still worth it?

“Yes, and it is the most common case. The review is scoped to what you actually run — usually a handful of laptops, email, a website and one or two cloud services — and the report is written so that whoever manages the office can act on it without a technical background.”