Home / How it works
What happens between the first call and the first monthly report, what we commit to when something breaks, and what you receive every month, quarter and year.
Twenty minutes on what you run, what hurts and what your auditor, insurer or biggest client is asking for. You get a plan recommendation and a price the same day.
With your permission we inventory devices, review the Microsoft 365 or Google tenant, scan the network and read the last insurance application. Five business days; the report is yours whether or not you sign.
A one-page order, the terms on this site and the containment playbook: what we may do without asking, who to call at 2 a.m., in what order.
Weeks one to three: device management, endpoint detection, MFA and conditional access, email security, backup. Changes are scheduled around your hours and announced to your staff by us.
Day 30: the first monthly report, with the gap list from the assessment marked done or scheduled, and the 12-month roadmap with a budget.
Every quarter: what happened, what changed, what is coming, and the budget for it. The roadmap is the agenda.
Tickets are triaged into four priorities when they arrive. The targets below are in every order form and measured in every monthly report.
| Priority | Examples | First response | Updates | Resolution target |
|---|---|---|---|---|
| P1 | Business down, security incident, ransomware suspected, office offline | 30 minutes, 24×7 | Every hour | 4 hours or a workaround |
| P2 | Many users or a core application degraded, a server or a site down with a backup path | 1 business hour | Every 4 hours | 1 business day |
| P3 | One person cannot work; a device, printer or application fault | 4 business hours | Daily | 3 business days |
| P4 | Requests and changes: new user, software, access, question | Next business day | On change | Scheduled, within 5 business days |
Tickets opened and closed with response times against the targets, patch compliance by device, endpoint detection coverage, backup success and the last restore, phishing simulation results, open vulnerabilities, license count and spend. Two pages, in the portal on the third business day.
Forty-five minutes with the principal: the quarter's numbers, changes made, the risk register, the roadmap for the next twelve months and the budget for it, equipment reaching end of life, and anything your auditor or insurer will ask next.
The evidence for the year in one binder: policies, assessment, training completion, restore tests, incident log. Built to answer a cyber insurance application, a HIPAA audit or a client's vendor questionnaire without a scramble.
Signed at onboarding and changeable in writing at any time, the playbook says what the security operations team may do without asking (isolate a laptop, revoke a session, block a sender), what needs a named person's approval (disable an executive's account, take a server offline), who is called at 2 a.m. and in what order, and what we tell your staff. It is one page, and it is the reason a 2 a.m. alert does not become a 9 a.m. incident.
A plan recommendation and a written price the same day; the assessment report is yours either way.