Security
Identity, application access and recovery
Explore the technical questions below, inspect an example and choose the work to discuss. Scope and acceptance checks are agreed for the actual environment.
Where this is delivered
Email & Data Protection
We implement the agreed email and data protections, test them against real business use and document the resulting configuration.
See the engagementsRelated work
Choose the work and inspect its result
Illustrative sample · constructed example
Does the selected control have evidence from the intended users?
Constructed assessment row · access policy
- Observation
- A policy exists, but its pilot population and recent sign-in evidence have not been reconciled.
- Decision
- Record the control as requiring validation.
- Next action
- Review the policy and available evidence, then scope any production hardening separately.
Audit & Insurance
A board question, an audit, or a cyber-insurance renewal forces the issue. The evidence pack scores your Microsoft 365 posture and packages what the auditor or insurer is actually looking for.
Illustrative sample · constructed example
Does the pilot policy enforce the intended access condition?
Pilot policy · administrator access
- Observation
- Report-only observation identifies a sign-in outside the intended condition.
- Decision
- Review before enforcement
- Next action
- Correct the policy or document the exception and test emergency access.
Identity & Zero Trust
Close risky admins, legacy authentication, and Conditional Access gaps in Microsoft Entra ID, and make sure a lockout never locks you out.
Illustrative sample · constructed example
Who owns the grant, and does the application still need it?
Constructed consent row · reporting connector
- Observation
- A delegated grant permits data access; its business owner and recent use are unresolved.
- Decision
- Recommend investigation before changing the grant.
- Next action
- Record permission scope, consent type, evidence age and proposed action. Read-only review does not revoke access.
App & Data Exposure
Unknown OAuth apps quietly hold access to mail, files, and Microsoft Graph. The review surfaces every one, ranks the consent risk, and names what to revoke.
Illustrative sample · constructed example
Does the restored file satisfy the checks for this scenario?
SharePoint file · approved isolated restore target
- Observation
- Backup job reports success; no restore or access test has been observed.
- Decision
- Recovery remains unverified
- Next action
- Run the agreed safe restore and record start/end times and validation results.
Ransomware Resilience
Leadership thinks backups exist, but nobody knows what restores. A live restore test measures a realistic recovery time and maps the blast radius across identity and infrastructure.
Discuss the work and its next check.
Share the system involved, the change you need and any deadline. A defined implementation job can go straight to scoping.
Get a Fixed Price in Writing