Supporting technical capability
Find the security gaps in your Microsoft 365 environment.
Review sign-in, administrator access, files, devices and email controls. Leadership receives the findings, evidence gaps and a prioritized plan for the agreed improvements.
Illustrative sample · supporting capability
Does the selected control have evidence from the intended users?
- Observation
- A policy exists, but its pilot population and recent sign-in evidence have not been reconciled.
- Decision
- Record the control as requiring validation.
- Next action
- Review the policy and available evidence, then scope any production hardening separately.
This capability can inform the next service. Its inclusion, price and calendar must be agreed in that service’s scope; following the link does not make it included.
Explore the relevant next serviceTechnical context
When this work applies
- A board question, a new CISO, an audit, or a security scare forces a posture review.
- You own Microsoft security tools but cannot say what is actually protected.
- A long control-by-control audit would not tell you what to fix first.
Possible outputs
Outputs to agree in scope
Executive Posture Scorecard
Your Microsoft 365 posture scored across identity, data, devices, and email, with the Secure Score gap.
Ranked findings
The control gaps that matter most, in priority order.
90-day roadmap
The order to fix things in, which leadership can approve and fund.
Commercial & delivery basis
The scope and conditions of the work.
Delivery window
This supporting capability has no separate confirmed delivery window. The proposal names its scope and calendar.
Capability scope to confirm
- Microsoft 365 Zero Trust posture review
- Secure Score analysis
- Executive scorecard
- 90-day roadmap
Scope assumptions
- One Microsoft 365 tenant
Exclusions
- Making the fixes, or the build itself, which are scoped separately
- Endpoint or network penetration testing
Required access
- Read-only security reader access to Microsoft 365, Entra ID, Defender, and Purview
- Secure Score and assessment exports
- A 30-minute kickoff with security or IT
Acceptance
The agreed completion standard.
The engagement is complete when the posture scorecard, ranked findings, and 90-day roadmap are delivered and walked through.
Discuss the work
Tell us what you need to change.
Share the systems involved, why the change is needed and your deadline. We clarify the work, responsibilities and information needed for a proposal.
Discuss this project