Cyber security
Security work, written in order
A staged review for small and mid-sized organisations in Cornwall: access, mail, devices and the practical consequences of a loss. The output is a list you can act on, with interruption named before a change is made.
What the review covers
A security review looks at the controls an office of your size actually depends on. Typical ground is which accounts have administrator rights, how mail is filtered, how devices are updated, how a lost laptop would be traced or locked, and whether backups are separate from the live system.
The review is of the organisation's arrangements. It is not a certification, and this site does not claim a certification or a partnership for the practice. We will not write that you hold a scheme you have not been assessed for.
The order of work
Work proceeds in stages that are visible to you. First we record what is in place, from what you show us and from the systems you agree we may look at. Then we write a short list in priority order: what to change, why it is first, and what the change would interrupt.
Changes are made only for items you accept, and they are made in a window the office can absorb. Each completed item is noted, including anything deliberately left as it was. Items that need ongoing watching can move into managed support. They do not have to.
Tests
We do not run surprise attacks against live systems. If a test is useful, it is agreed, timed, and limited to systems you name. You are told what the test will try to do, and what it will not touch.
Staff are not tricked as a demonstration. If the question is whether people report a suspicious message, that exercise is explained to the person accountable before it happens, and the findings are about the process, not about naming individuals in a circulated list.
Data during the review
A review often involves account lists, mail rules and configuration. Those exports are used for the review and then handled as the agreement states: returned, or deleted once you have the written findings. They are not kept as examples and they are not discussed with another client.
Personal mailboxes are not read as a matter of course. If a specific message has to be inspected, the reason is stated first. Administrator access used for the review is removed when the review ends, unless an ongoing agreement says otherwise.