IT ISSUE · PROJECTS AND CHANGE
Security uplift
The word suggests buying something. The first useful moves are almost always subtractions.The word suggests buying something. In a business of this size the first genuinely useful moves are almost always subtractions: access that outlived its reason, accounts nobody uses, permissions granted for one afternoon in 2021 and never withdrawn.
Usually worth doing before anything is purchased
- Remove access for people who have left.
- Check who holds administrator rights, and whether they need them.
- Confirm multi-factor authentication is registered rather than merely enabled.
- Find shared logins and give people their own.
- Check what has permission to send mail as your business.
- Confirm a restore has actually been tested.
Reduce what exists before adding to it
We look at identities, access, devices, mail and the controls already included in what you pay for, then prioritise by what reduces the most risk for the least disruption.
Most of that list costs nothing but attention, and a new product bought on top of an unreviewed environment mostly adds something else to administer. We aren't going to recommend a purchase while there are still accounts belonging to people who left, and if that means a shorter invoice this quarter, that is the correct outcome rather than a missed opportunity.