Cybersecurity

The controls we deploy, and how we keep them working

Security for a 10 to 50 person office is a finite, specific set of controls — not a threat forecast. Below is the baseline we put in place, who operates each piece day to day, how often it gets checked, and what evidence comes out the other end.

(256) 957-7988

We'll review what you have in place today.

01 The baseline

Six domains. Every managed office gets all six.

We don't sell security by the tier. The same baseline goes into every engagement, because a control that only some clients have is a control we can't operate consistently. What varies is the work required to get there, and what your industry adds on top.

Identity Multi-factor authentication, conditional access, admin rights separated from daily accounts

Endpoint Managed detection and response, disk encryption recorded, patching on a set cadence

Email Filtering and attachment handling, SPF, DKIM and DMARC published, forwarding rules alerted on

Network Managed firewall on current firmware, guest Wi-Fi separated, configuration changes logged

Data Servers, workstations, and Microsoft 365 backed up offsite, with restores tested rather than assumed

People Recurring training with simulated phishing, documented joiner and leaver process, a written incident plan

Every domain, and exactly what goes in place

Domain	What goes in place
Identity	Multi-factor authentication on email and remote access, legacy sign-in disabled, conditional access policies, administrator rights separated from daily accounts
Endpoint	Managed detection and response on every workstation and server, disk encryption enabled and recorded, operating system and third-party patching on a set cadence
Email	Filtering and attachment handling, SPF, DKIM and DMARC published, external sender marking, mailbox forwarding rules alerted on
Network	Managed firewall with current firmware, guest Wi-Fi separated from business traffic, remote access through controlled paths only, configuration changes logged
Data	Backups of servers, workstations, and Microsoft 365 with an offsite copy, retention set deliberately, restores tested rather than assumed
People	Recurring short training with simulated phishing, documented joiner and leaver process, a written incident response plan naming who calls whom

02 How the layers fit

Six controls, working as one.

Each control on its own closes a single gap. The value is in the overlap: what catches the thing that gets past the first layer, and how anyone can tell each one is still running.

03 What each control does in practice

Endpoint detection and response Monitored protection on every workstation and server, with alerts that reach a human who acts on them.

Multi-factor authentication Rolled out across email and remote access, configured so it can't be bypassed by legacy sign-in methods.

Email and phishing defense Filtering plus the sending records (SPF, DKIM, DMARC) that stop your domain being used against your clients.

Least-privilege access Administrator rights removed from daily accounts, shared logins replaced, departures handled the day they happen.

Employee training Short, recurring training and simulated phishing, reported so you can see who needs a follow-up conversation.

Incident response plan Written before you need it: who to call, what gets isolated, how you communicate, and what your recovery time is.

04 How it's operated

Installed is not the same as working.

Most security failures we find in second opinions are not missing tools. They are tools that were deployed once and never checked: MFA enabled for some users, backups failing quietly for months, a firewall three firmware versions behind. This is the schedule that prevents that.

Activity	Cadence	What you see
Security alert triage and response	Continuous, business hours with after-hours escalation	Notification when something required action
Patch deployment and failure follow-up	Monthly, with out-of-band for critical items	Coverage summary by device
Backup restore test	Monthly	Result and measured recovery time
Microsoft 365 configuration and MFA coverage review	Quarterly	Baseline review with exceptions listed
Administrator and user access review	Quarterly	Account list for you to confirm
Firewall configuration and firmware review	Quarterly	Change log and version status
Phishing simulation and training completion	Ongoing, reported quarterly	Completion and click rates by person
Incident response plan walkthrough	Annually	Updated written plan

05 Compliance support

Evidence, in the format whoever's asking expects.

We aren't attorneys or auditors, and we don't sell certifications. What we do is implement the technical controls and produce the documentation that gets requested — so the questionnaire on your desk is a filing exercise, not a fire drill.

When you're asked by	What we provide
A cyber insurance application or renewal	Control attestations: MFA, EDR, backup, training, access management
A HIPAA risk assessment	Technical safeguards documentation and remediation tracking
A client's vendor security review	Written summary of your security posture and current runbook
An incident or near miss	Timeline, scope, actions taken, and what changed afterward

Industry specifics: Healthcare and HIPAA · Law firms

06 The newest path out

The baseline above doesn't cover what employees type into AI.

Every control on this page assumes information leaves your office through email, a file transfer, or a device. An AI prompt is a fourth path, and it looks like normal work. An employee pastes a client record into a chatbot to save twenty minutes and none of the six domains above sees it happen.

Which tools are approved Approved AI services stay available by role and department; unreviewed ones are blocked, and the ones already in use get identified.

What can go into them Sensitive information is recognized and stopped at the point of paste or upload rather than after it has reached the service.

What you can show A record of the services in use and the policies enforced — increasingly the next question on an insurance or client review.

This is a policy decision first and a technical one second, so it runs as its own engagement on top of the baseline. How AI governance works

Where this lives

Inside managed IT

This baseline is part of every managed engagement rather than an add-on — see how the managed relationship works. If you have a provider already and only want the controls reviewed, we do that as a one-time assessment. What drives the cost