We set your environment up against a published security benchmark and hand you the paperwork. We do not certify your environment, we claim no certification we do not hold, and we do not chase checkboxes that change nothing about real risk.
Two postures. Only one holds up.
Compliance comes after a correct setup, not before it. It is easy to get that order backwards.
Compliance as a checklist
A tool, a template, and a report that says compliant while the environment underneath stays the same. The paperwork moves and the risk does not.
Result · Checkbox security.
What we do
We build to a published standard, look after it while we run it for you, and write down what is in place. When an auditor or your insurer asks, the record is already there.
Result · A position you can show.
How we decide what goes in.
Three questions we hold every setting up against.
Built to a standard
We set things up against a published security benchmark rather than however the last person did it, scoped to the size and risk of your business.
Holds up in real use
A rule only counts if it is switched on, watched, and still there next year. We favor controls that survive contact with a busy office over ones that only look good on paper.
Evidence you can hand over
When an auditor, an insurer or a customer asks, we help you put the record together: what is in place, when it was set, and how it was checked.
What we can show you, against your login setup.
Our own assessment reads how your Microsoft 365 login and identity setup, called Entra, is configured, and maps what it finds to four frameworks people ask about. For each one it shows which technical controls are met, partly met or missing, and it says plainly which questions a configuration read cannot answer. Today this covers the login and identity layer only.
SOC 2
SOC 2 is the audit report customers ask service companies to show. We map your login setup to its security criteria, the 2017 Trust Services Criteria, and show which technical controls are met, partly met or missing.
NIST Cybersecurity Framework 2.0
The United States government’s general framework, in its 2024 edition. We map to the parts a configuration read can speak to, Protect and Detect, and say plainly which parts it cannot.
ISO 27001
The international information security standard, 2022 edition. We map your login setup to the technical controls in it.
CIS Microsoft 365 Foundations Benchmark
The published standard we build to, version 7. We show your setup against it, recommendation by recommendation.
Cyber insurance requirements
A second check at sign in, protection on your devices, backups that cannot be rewritten, and a plan for a bad day. These are the things underwriters now ask about, and we set them up and write them down so you can answer those questions.
The mapping relates your setup to each framework’s criteria. It does not establish compliance, and it is not an audit. We do not provide formal compliance certification. We position your environment for audit readiness.
What we will put in writing, and what we will not.
We will say
- We set your environment up to widely accepted practice and look after it while we run it for you.
- We build baselines that hold up under real, day to day use.
- We help you prepare for the conversation with an auditor, an insurer or a customer.
- We write down what is in place, so your position can be shown rather than described.
We will not claim
- We do not certify your environment on any framework.
- We do not promise the outcome of any audit.
- We do not chase checkboxes that change nothing about real risk.
- We do not sell compliance as a product separate from the foundation.
Readiness follows a correct foundation.
Not sure where you stand today? That is the normal starting point. We look first, tell you what we found, and write you a plan with a fixed scope.