How an engagement starts
The first 90 days
Week by week, adjusted for estate size and compressed where the scope is fixed. By the end, your team holds the estate, with the runbooks and documentation to run it.
- 1
Weeks 1–2
Access and discovery
- Least-privilege access provisioned through your own access process
- Estate inventory: subscriptions, management groups, policy assignments, existing exemptions
- Read-only assessment against your current control set, if one exists
- Stakeholder map: who signs off changes, who gets told, who gets asked first
- 2
Weeks 3–4
Baseline and gap report
- Documented current state, including known issues and workarounds
- Gap analysis against the agreed target control set
- Risk-ranked remediation backlog with effort estimates
- Agreement on what your team owns, what we own for now, and what is still to be assigned
- 3
Weeks 5–8
Stabilise
- Remediation of the findings that carry real risk, in priority order
- Policy baseline assigned, with every existing exemption given an owner and an expiry
- Monitoring and alerting routed to people who can act
- Backup and recovery verified by running a restore
- 4
Weeks 9–12
Hand over
- Your team walked through every control we deployed and why it is set that way
- Runbooks for the things that recur, written for someone joining the team later
- Access review and exemption expiry cadence established, owned by a named person on your side
- A written view of what is still open, so the next decision is yours to make with full information
What we need from you
Three things: access, a named counterpart who can make decisions, and an open account of what has been deferred. The last one makes the most difference. Every estate has a backlog, and hearing about known problems in week one means they go straight into the plan, instead of turning up in week three during discovery.
Planning your first 90 days
The phases above flex around your estate. Anything that has been deferred is worth raising early, because it shapes the order of the first few weeks.