Secure by configuration.
Audit-ready by default.
We harden identities and tenants, check Azure, AWS, and Google Cloud against benchmarks continuously, and run your compliance programme as an engineering discipline: controls implemented, evidence collected automatically, and a report you can hand to an auditor.
The cloud is secure. Your configuration of it may not be.
Microsoft, Amazon, and Google secure the platform; everything you can click is your responsibility: who holds Global Administrator, whether legacy authentication is still allowed, which storage bucket is public, whether audit logging was ever turned on. Most cloud breaches we investigate trace back to a setting, not a vulnerability.
Compliance has the same shape. Frameworks are lists of controls; auditors want evidence those controls operate continuously. We treat both as configuration management: define the baseline, enforce it, detect drift, and generate the evidence as a by-product of running the environment well.
The control layers
Identity first, then the tenant, then the cloud platforms, then the data, each layer feeding the SOC and the compliance evidence store.
Identity & access
- Entra ID hardening: phishing-resistant MFA for administrators, number-matching MFA for all users, legacy authentication blocked, security defaults replaced with Conditional Access.
- Conditional Access policy set: require a compliant device for corporate data, block high-risk sign-ins, restrict admin portals to managed devices and named locations, session controls for unmanaged devices.
- Privileged Identity Management: no standing Global Administrators; just-in-time, time-boxed, approval-gated role activation with alerts to the SOC.
- Lifecycle: joiner / mover / leaver automation, access reviews for privileged and guest accounts, service-principal and OAuth-app governance.
Tenant hardening
- Email authentication done properly: SPF, DKIM, and DMARC at p=reject with reporting; anti-spoofing and impersonation protection; Safe Links and Safe Attachments.
- Unified audit logging enabled and retained; mailbox auditing on; alerts on forwarding rules, mass downloads, and anomalous sharing.
- Intune / MDM device compliance (encryption, patch level, EDR present) as a gate for access; app-protection policies for personal devices.
- External sharing, guest access, and Teams / SharePoint governance set on purpose, not left at defaults.
Cloud posture
- Landing-zone foundations: management-group or organisation structure, separate production and non-production, centralised logging, budget guardrails.
- Continuous assessment against CIS Foundations benchmarks: public storage, open security groups, unencrypted volumes, over-privileged IAM, missing logging, each finding ticketed with an owner.
- Policy-as-code guardrails: Azure Policy, AWS SCPs and Config, Google Organization Policy, so non-compliant resources are blocked or auto-remediated.
- Control-plane and data-plane logs (Activity Log, CloudTrail, Audit Logs, flow logs) forwarded to the SOC pipeline.
Workload & data protection
- Vulnerability and patch management for cloud VMs and containers; image hardening; secrets moved out of code and into a vault (Key Vault, Secrets Manager).
- Encryption at rest with customer-managed keys where regulation demands; TLS everywhere; private endpoints instead of public exposure for platform services.
- Data classification and sensitivity labels; DLP for email, Teams, SharePoint, and endpoints; retention and legal hold aligned to your obligations.
Compliance operations
- Framework selected and scoped (SOC 2, ISO 27001, PCI DSS v4.0, HIPAA, PIPEDA / PIPA, NIST CSF), with one control set mapped across them to avoid duplicate work.
- Gap assessment, then a remediation roadmap with owners and dates, then a policy and procedure set that matches how you actually operate.
- Evidence collection automated where possible (configuration exports, access reviews, log-retention proofs, scan results) into an evidence library; manual evidence scheduled and tracked.
- Audit support: readiness review, auditor liaison, finding remediation. vCISO reporting to leadership and the board.
What we deliver
Security engineering and compliance management from the same team, so the controls you implement are the controls you can evidence.
Microsoft 365 security hardening
Full tenant baseline: identity, email, collaboration, devices, implemented against Microsoft and CIS recommendations, with Secure Score tracked monthly and regressions ticketed.
Conditional Access & PIM design
A documented policy set with break-glass accounts, report-only staging before enforcement, and just-in-time privileged access replacing standing admin rights.
Cloud security posture management
Continuous benchmark assessment of Azure, AWS, and Google Cloud, prioritised by exposure, with policy-as-code guardrails to stop recurrence.
Cloud architecture & migrations
Landing zones, network design, identity federation, and workload migration planned so security and logging are present on day one, not retrofitted.
Data protection & DLP
Classification, sensitivity labels, DLP, encryption and key management, and retention aligned to PIPEDA / PIPA, HIPAA, or PCI scope.
Compliance programme management
Gap assessment, remediation roadmap, policy set, automated evidence collection, continuous control monitoring, and audit support, delivered as an ongoing service, not a one-time project.
vCISO & governance
Fractional security leadership: risk register, security roadmap, vendor risk management, incident and breach-notification governance, board reporting.
SaaS security
Discovery of sanctioned and shadow SaaS, OAuth-app governance, SSO enforcement, and audit-log monitoring for the applications that hold your data.
Penetration testing & validation
Cloud- and identity-focused testing (Conditional Access bypass attempts, privilege-escalation paths, exposed storage), scheduled annually and after major changes.
How the programme runs
Assess once, harden in stages, automate the evidence, then keep it that way.
- Identity and tenant configuration review
- Cloud benchmark scan and architecture review
- Compliance gap assessment against the chosen framework
- Conditional Access and PIM rolled out report-only, then enforced
- Tenant and cloud baselines applied; guardrails deployed
- Policies and procedures written to match reality
- Automated evidence collection wired to the evidence library
- Access reviews, scans, and log-retention proofs scheduled
- Readiness review and mock audit
- Drift detection and ticketing
- Monthly posture and compliance status report
- Audit liaison, annual framework refresh, vCISO cadence
Platforms and frameworks
Microsoft Solutions Partner for security; hands-on across the three major clouds.
Baselines and reporting
The non-negotiables we apply to every tenant and account, scoped to your framework during assessment.
| Area | Standard | Evidence you receive |
|---|---|---|
| Administrator access | No standing Global Admin / Owner roles; just-in-time activation with MFA and approval; break-glass accounts monitored | PIM activation log, monthly access review |
| User authentication | MFA for all users with number matching; legacy authentication blocked; risky sign-ins blocked or stepped up | Conditional Access policy export, sign-in risk report |
| Email authentication | SPF, DKIM, and DMARC at p=reject with aggregate reporting | DMARC reports and configuration proof |
| Cloud posture | CIS Foundations benchmark assessed continuously; high findings ticketed within 1 business day | Monthly posture score and finding trend |
| Logging | Audit logs enabled on every tenant and account, forwarded to the SOC, retained ≥ 12 months | Log-source inventory and retention proof |
| Compliance status | Control operating-effectiveness checked on schedule; exceptions tracked with owner and date | Quarterly compliance report; evidence library |
Standards are tuned to your framework scope and risk appetite during the assessment phase, and documented as your baseline.
Frameworks we map to
One control set, mapped once, evidenced for every framework you need.