Hardening, patching and tested restores
We do the dull work that decides how bad a bad Tuesday gets.
We keep every device patched, read the security alerts, check who can reach what, and test that real files come back from backup.
Most security conversations start with one of these.
- Your insurer has sent a questionnaire you cannot honestly answer.
- A customer wants Cyber Essentials before they renew the contract.
- The backups show green every night, and nobody has ever restored one.
If one of these is yours, call us and we will tell you what it would take to fix.
Contact usWhat we take on.
What we report back
We report patch status for every device and every change to who has access.
We report each restore test, what came back and when it ran.
- We put multi-factor authentication on every account and turn off the older sign-in methods that get round it.
- We install endpoint protection and make sure a person reads its alerts.
- We find any machine that is not managed, then report patching for every device.
- We restore a real file and mailbox item on a schedule, and report the result.
- We review who has access to what, and record the date of every change.
- We set up phishing filters, block automatic forwarding to outside addresses, and publish the domain records that make your email harder to spoof.
- We work through the Cyber Essentials questions with you before an assessor does.
- We write an incident plan with you that says who does what and who gets called.
The five controls.
Cyber Essentials checks five controls, and an insurer's questionnaire usually asks about the same things. This is what each one means on a Microsoft estate.
The estate has to meet all five to pass.
Firewalls
How we put it in place
Every device has its firewall turned on by policy, and any firewall at the edge of an office network is configured too.
What you keep
You keep the policy and a report of which machines apply it.
Secure configuration
How we put it in place
Every device is set up from one baseline, with no unused accounts, no default passwords and only the software the business has approved.
What you keep
You keep the baseline, and can see any device that drifts from it.
Security update management
How we put it in place
Updates go out in stages to the operating system and everything else installed, and software its maker no longer supports is removed.
What you keep
You see the days since each device was last patched, against the fourteen days the scheme allows for critical fixes.
User access control
How we put it in place
Every account belongs to a named person, admin work is done from a separate account with no email, and cloud services ask for a second factor.
What you keep
You keep the list of admin accounts and when each was last reviewed.
Malware protection
How we put it in place
Protection runs on every device, and its alerts go to a console that a named person reads.
What you keep
You see the protection status of each device and the most recent alert that was acted on.
An independent certification body does the assessment. We get the estate ready for it.
Treating the backup as the recovery plan.
Once the backup job shows green every night, it is treated as finished.
A green result shows that the job ran, not that the data can be read back. It also says nothing about whether an attacker inside the network could delete the backups.
We restore from the backups on a schedule, and write down how long it took and whether what came back could be opened.
This is the document you hand an assessor or an insurer. Get in touch and we will take you through a real one.
Contact usQuestions we get asked.
Send it to us and we will go through it with you. Where the honest answer is no, we either fix it or tell you what fixing it would cost.
No law requires it. Many customers and insurers ask for it, and some government contracts require it.
Ring us rather than filling in the form. The first call is about stopping it from spreading.
It follows a plan we agree with you in writing before we start. The plan names which alerts are worth a call at that hour, and who takes it. Everything else is read first thing the next working day.
Where this page sits.
Our work sits in three layers, and each one depends on the one beneath it. The page you are reading is marked.
You are hereCyber Security & Resilience
Foundations
- Cloud Strategy & Design
- Migration & Modernisation
- Managed IT & Cloud Operations
- Cloud Cost Control
- Automation & Platform Engineering
- You are here Cyber Security & Resilience
- Microsoft 365 & Devices
Start with a restore test on your own backups.
The Fortnight includes one. You keep the write-up whether or not you work with us afterwards.
You get a written scope before you commit to anything.