How an engagement starts
The first 90 days
Roughly this, adjusted for estate size. It ends with your team holding the estate rather than with us permanently in the middle of it.
Weeks 1–2
Access and discovery
- Least-privilege access provisioned through your process, not a global admin account
- Estate inventory: subscriptions, management groups, policy assignments, existing exemptions
- Read-only assessment against your current control set, if one exists
- Stakeholder map: who signs off changes, who gets told, who gets asked first
Weeks 3–4
Baseline and gap report
- Documented current state, including the parts nobody wanted to write down
- Gap analysis against the agreed target control set
- Risk-ranked remediation backlog with effort estimates
- Agreement on what your team owns, what we own for now, and what is explicitly nobody's yet
Weeks 5–8
Stabilise
- Remediation of the findings that carry real risk, in priority order
- Policy baseline assigned, with every existing exemption given an owner and an expiry
- Monitoring and alerting routed to people who can act
- Backup and recovery verified by running a restore
Weeks 9–12
Hand over
- Your team walked through every control we deployed and why it is set that way
- Runbooks for the things that recur, written to be used by someone who was not here
- Access review and exemption expiry cadence established, owned by a named person on your side
- A written view of what is still open, so the next decision is yours to make with full information
What we need from you
Access, a named counterpart who can make decisions, and a realistic answer about what has been deferred. The last one matters most: onboarding goes badly when a known problem is discovered by us in week three rather than mentioned in week one. Nobody is judged for a backlog. Everyone has one.
What has been deferred on your estate?
Every estate has something. Naming it in week one instead of week three is the difference between a plan and a surprise, and it is a good first conversation.