How an engagement runs, from discovery to the day you leave
This page follows the agreement in order: the five onboarding steps, the monthly report in full, and the terms that decide what stays yours. Ask us about any line of it.
Five onboarding steps
The order is fixed. The pace depends on your firm.
Discovery
We inventory what exists: your identity tenant, laptops and servers, network equipment, backups, licenses and vendor contracts. Our access is read-only until the scope is signed.
Scope in writing
One document lists what is included and excluded, who does what, the rate for anything outside scope and the escalation contacts on both sides. Work starts after you sign it.
Tooling and baseline
We deploy the management agent, endpoint detection, the patch policy, the MFA baseline and backup verification. Each rollout is scheduled, announced to your staff and can be rolled back.
Remediation queue
Findings are ranked by how exploitable they are and how much effort they take, then worked in that order. Anything you decide to live with is recorded as accepted risk with your signature.
First review
A written report and a working session on what changed and what is still open, with the cost of the next stretch of work beside it.
The monthly report, in full
The document the agreement produces each month: five headings, a plain line under each, and a state. An insurer or a client reviewer can read it without calling anyone.
47 of 48 laptops and servers on the current patch ring. The one exception is named, with its ticket.
AttentionMFA on 61 of 61 user accounts. 2 shared mailboxes under review for retirement.
In placeOne mailbox and one file share restored to a test location. The time to the first usable file is logged with the result.
In place12 alerts handled: 11 closed by the engineer, 1 escalated to you with a written timeline.
In place2 accepted risks, each with a signature. 1 finding in remediation. The access review is due by the next review.
PendingThis shows the structure of the report. The figures are illustrative; yours come from your own environment.
The terms, before you sign
The commitments in the standard agreement, published so you can check them before a call.
- Requests and escalation
Email, phone and the portal all open the same ticket. Monitoring is continuous; staffing is not, and we say so. You can escalate to the engagement lead at any point.
- If there is an incident
Suspected or confirmed, in your environment or in ours: the engagement lead calls the person you have named, then confirms in writing, before any containment step is reversed.
- Credentials and documentation
Your tenants, domains, firewalls and backup consoles are registered to your company. We work from named accounts inside your directory, and you can export the documentation without asking us.
- Our own insurance
We carry cyber liability and technology errors-and-omissions insurance and send the certificate on request. Our liability under the agreement is capped, and the agreement says what falls outside the cap.
- People and reports
Our engineers are background-checked before they touch a client system. The security reports we hold are available on request.
- Out of scope, and leaving
Out-of-scope work waits for your written approval. Either side can end the agreement on written notice. At offboarding we export your documentation, rotate credentials, remove our accounts and hand over in writing.
The notice period, the liability cap, the insurance limits and the incident notice window are set in the agreement you sign.
Read the agreement before you decide
Ask on a call and the engineer sends the standard agreement: the scope, the exclusions, the exit terms and the price of each. The assessment fills it in for your environment.