Security and governance that hold up under questioning

We start with a fixed-scope review that produces a defensible picture of current exposure rather than a generic maturity chart. Every rating is tied to a specific piece of configuration evidence you can re-check yourself.

• Privileged access inventory. Every privileged role holder, service identity, guest account and long-lived credential across all tenants, subscriptions, accounts and organizational units.
• Essential Eight maturity rating. The environment assessed against the ASD Essential Eight maturity model and the control themes an ISO 27001 or SOC 2 assessor will raise, with the evidence behind each rating recorded so the gap list survives challenge.
• Exposure mapped from outside in. Internet-reachable endpoints, exposed management ports, anonymous sharing links and public object storage listed with what each one can reach behind it.
• Licence entitlement audit. Current entitlements and enabled service plans checked against the controls the design needs, so unused entitlement is separated from a genuine product gap before anyone proposes a purchase.
• Remediation backlog by effort. Findings ordered by exposure reduction per unit of effort, with dependencies, residual risk and a named owner recorded against each item.
• Measures agreed before delivery. The two or three numbers the programme will be judged on, chosen up front, for example critical findings open past 30 days or the count of standing privileged assignments.

Controls are implemented as code and reviewed like code, so any guardrail can be traced to a commit, explained to an assessor and rolled back if it breaks a workload.

• Boundaries that contain a compromise. Tenant, subscription, account and organizational unit structure designed so a compromised credential is contained by a boundary rather than by a naming convention someone has to maintain.
• Access policy in report-only first. The sign-in policy set run in report-only mode with documented break-glass accounts that are monitored and tested, then enforced in waves ordered by user population.
• Standing admin rights removed. Permanent administrative assignments replaced with time-bound, approval-gated elevation, and the request trail kept as evidence for later review.
• Guardrails deployed as policy code. Preventative policy promoted through the same pipeline as infrastructure, peer reviewed, versioned and tested in a non-production scope before it reaches anything that matters.
• Secrets out of repositories. Keys, certificates and application secrets centralised behind managed identities or roles, credentials stripped from pipeline variables, and rotation scheduled rather than aspirational.
• Logging designed to a cost ceiling. Named sources, retention tiers and a monthly ceiling agreed at design time, so the detection you want is still affordable to run 12 months later.

Governance earns its place when it makes decisions faster. We keep the artefacts small enough that people maintain them and specific enough that an external assessor can use them without a workshop. Data classification, cataloguing and loss prevention sit with our data governance and compliance work rather than here.

• Control library mapped to clauses. Each implemented control mapped to the framework clauses it supports, with a configuration reference an assessor can verify independently rather than take on trust.
• Exceptions with an owner and expiry. Every accepted risk carries an owner, an expiry date and a review trigger, because a temporary exception with no end date is how a control gets quietly switched off.
• Identity lifecycle as the control. Joiner, mover and leaver events drive entitlement, so access changes with employment status rather than with a service desk ticket somebody has to remember to raise.
• AI use register maintained. Which systems process which data classes, what a human must approve, and how prompts and responses are retained and reviewed.
• Alignment, never certification. We prepare the environment and the evidence for external assessment. Certification, attestation and audit opinions are issued by an independent party, not by us, and we hold none of them ourselves.
• One page to the executive monthly. Exposure trend, the top three risks, exceptions expiring, and the single decision the group actually needs to make.

A control that people route around has made things worse, not better. We sequence rollouts so users have a working path before the old one closes, and we measure the friction rather than assume it away.

• Piloted with one willing department. Each identity change trialled with a single team, the support tickets it generates counted, and the friction fixed before the organisation-wide wave.
• Service desk trained before users. Elevation, enrolment and access request flows walked through on the real screens rather than a slide deck, with a one-page decision guide left behind.
• Break-glass rehearsed with real people. Emergency access and a lost-device scenario tested with the staff who would genuinely be on the call, and the runbook updated from what the rehearsal exposed.
• A sanctioned AI path. A published position naming the data classes staff must not put into unsanctioned tools, paired with a governed tool that does the job well enough to be chosen.
• Findings handed to the owning team. Application owners given scoped access to their own posture findings with a short guide to which classes are mandatory, so remediation is not bottlenecked in one central team.
• Monthly forum with a fixed agenda. New exceptions, expiring exceptions, overdue findings and one decision that needs the group in the room. Anything else is a status update, not governance.

Security posture decays without maintenance, and the decay is invisible until something goes wrong. Our managed continuation keeps controls current, noise low and evidence collected, during agreed support hours and through an escalation path you have seen and approved in advance. We are not a round-the-clock monitoring service, and if that is what your risk profile requires we will say so.

• Posture drift reported monthly. What changed, what regressed and what remains open past its agreed age, reported to the same audience each month so the trend is visible.
• Alerts triaged to a named playbook. Triage against an agreed severity model, escalating through a playbook that names the person, the channel and the fallback contact.
• Quarterly access recertification. Assignments nobody re-justifies are removed rather than rolled over, and the removals are recorded for the next assurance cycle.
• Detection coverage reviewed quarterly. Coverage compared against the techniques relevant to your sector, then rules written or tuned to close the gaps we find.
• Policy and detections in version control. Policy code, detection content and runbooks held in a repository, with every change tested in a non-production scope before promotion.
• Log spend held to the ceiling. Ingestion and service cost reviewed monthly, with high-volume low-value sources re-tiered so spend stays inside the ceiling set at design time.