Identity & access
Single sign-on and multi-factor authentication with Microsoft Entra ID, conditional access, privileged access review, and a joiner-mover-leaver process that actually removes accounts when people leave.
Services
Cybersecurity & Compliance
Identity, network, data and endpoint controls designed together, then mapped to the frameworks your customers and regulators actually audit — so a security questionnaire stops being a fire drill.
Capabilities
What our security practice covers
Security has run through our cloud and quality work since 2014 — identity design, segmentation, key management and audit logging are part of every platform we hand over. This page is that work offered on its own, for estates we did not build.
Zero trust architecture
Network segmentation, private endpoints, web application firewalls and device posture checks, so being inside the network stops being the same thing as being trusted.
Vulnerability management
Continuous scanning across cloud, servers and applications, a patch cadence agreed with the business, and a risk-ranked backlog rather than a thousand-page report nobody reads.
Data protection
Classification and labelling, encryption at rest and in transit, key custody, backup that has been restored under test, and loss prevention on the routes data actually leaves by.
Monitoring & response
Log collection and detection rules in Microsoft Sentinel or your existing platform, tuned to cut noise, plus an incident response plan that has been walked through before it is needed.
Compliance readiness
Gap assessment, a system security plan and plan of action, evidence collection and mock audit — getting you ready for the assessor instead of introducing you to them.
Frameworks
Built for the corridor we work in
We are in Hanover, Maryland, minutes from Fort Meade and BWI. A large share of the businesses around us either sell to the federal government or sell to someone who does, and the compliance bar has moved sharply for both.
- CMMC 2.0 for defence suppliers, where certification is now a condition of holding contracts that involve controlled unclassified information.
- NIST SP 800-171 and 800-53 as the underlying control sets, implemented rather than merely documented.
- SOC 2 readiness for software and services businesses whose customers ask for a report before signing.
- HIPAA safeguards for organisations handling protected health information, including business associate obligations.
- ISO 27001 and FedRAMP alignment where an international or federal customer base requires it.
Engagements
Three ways clients start
Security assessment
A fixed-scope review of identity, cloud configuration, endpoints and backup, ending in a risk-ranked plan with effort and cost against each item. The usual first step.
Remediation project
We implement the plan — ours or someone else’s — and hand back the configuration, the runbooks and the evidence pack, with your team trained on what changed.
Ongoing security operations
Monitoring, patching, review of alerts and quarterly posture reporting, delivered as part of a managed service with agreed response times.
Independent by design
We do not resell a security product and then find that you need it. Tooling is chosen against your estate and your budget.
Engineering-led
Findings come with the change that fixes them. The same people who write the assessment can implement it.
Evidence as you go
Every control is captured in a form an assessor will accept, at the time it is implemented rather than in the week before the audit.
Specialist partners
Penetration testing and formal certification assessment are brought in from accredited partners, coordinated by us.
Start with an honest picture of where you stand
Most organisations are further along than they fear on some controls and further behind than they think on others. An assessment tells you which is which before you spend anything.