The review covers each area: identity and access (MFA, shared and privileged accounts, former employees' accounts), endpoints (disk encryption, patch level, EDR or antivirus, local admin rights), the mail domain (SPF, DKIM, DMARC, forwarding rules), the network (internet-exposed services such as RDP, firmware, segmentation) and backup (3-2-1-1-0, RPO and RTO, restore test). The result is a written report with findings ranked by risk and an order of fixes.

No. The check maps your exposure and configuration without actively exploiting vulnerabilities, which is the right first step for most small businesses. If a client, partner or insurer requires a pentest, I help define the scope and make sure the findings are interpreted and fixed properly.

With a combination of controls: DMARC raised gradually to a quarantine or reject policy, MFA on every account, no automatic forwarding outside the domain, and alerts on new mailbox rules and suspicious sign-ins. Technology doesn't replace process, so every change to a supplier's bank details is also confirmed by calling a known number, and payments need two approvals.

Isolation first: the infected device is disconnected from the network but not shut down, so memory and traces are preserved. Then logs are secured, the initial attack vector is identified, the attacker's access is removed and the system is restored from a verified clean backup. At the end you get a report on what happened and what changes so it doesn't happen again. The approach is based on hands-on SOC team experience.

It depends on what the company already has. Where Microsoft 365 is in place, I rely on Microsoft Defender and its built-in alerts. For more demanding environments I also work with the Palo Alto Cortex platform. The goal is alerts that mean something: suspicious sign-ins, a failed backup, protection switched off on a device.

The provider protects its own infrastructure; the configuration is your responsibility. That means: mandatory MFA, legacy authentication blocked, no more than two admin accounts, a review of apps with OAuth access, public sharing links switched off and a separate backup, because the recycle bin and version history are not a backup.

I cover the technical measures the law assumes: access control, encryption, logging and a notification plan in case of a breach. The legal assessment of obligations, deadlines and processor agreements should be done with a lawyer. Technical measures are a prerequisite, but they don't replace that assessment.

The disk is first cloned sector by sector to a healthy drive, and recovery is done only on the copy, never on the original. Every extra spin-up of a damaged disk lowers the chance of recovery. With an SSD that has a failed controller, I tell you honestly what to expect before you decide.

Formatting is not erasing. SSDs get a secure erase or cryptographic erase, hard drives get a full overwrite, and faulty drives are physically destroyed. For companies, a record is kept of which device was wiped and how.

Only on request, in a session you approve, through a tool with two-factor sign-in. No ports permanently open to the internet and no standing access without your knowledge.

Yes, on request. Any data I come across during the work stays with your company and is never used for anything else.

Yes. Checks, training and support also work online, and on-site visits are by arrangement.