Identity & access
MFA, privileged access, account lifecycle, password practices and access review.
WHAT THIS HELPS SOLVE
Focus the review on decisions that matter.
Unclear priorities
Security issues can accumulate faster than teams can resolve them. We help identify which gaps deserve attention first.
Cloud and identity exposure
Review access, MFA, administration, email and cloud configuration where they are central to business risk.
Resilience gaps
Understand whether backups, incident readiness, suppliers and staff practices support recovery when something goes wrong.
WHAT WE REVIEW
Scope shaped around your organisation.
Devices, email & cloud
Endpoint security, patching, Microsoft 365 or cloud controls, email protection and administration.
Resilience & suppliers
Backups, recovery, incident readiness, third-party risk and continuity considerations.
People & process
Awareness, ownership, security procedures and the way controls operate in day-to-day work.
Security roadmap
Existing actions, open risks, dependencies and realistic improvement sequencing.
AI touchpoints
Where AI adoption introduces additional data, identity, supplier or governance considerations.
WHAT YOU RECEIVE
Useful outputs for management and delivery teams.
✓
Executive risk summary
A concise view of the material security themes management should understand.
✓
Prioritised findings
Clear findings with practical context rather than an undifferentiated technical list.
✓
Improvement roadmap
Recommended actions ordered by risk, effort and dependency where appropriate.
✓
Findings walkthrough
A discussion of the results, trade-offs and sensible next steps.
PROCESS
Simple, transparent engagement.
01
Scope
Understand the business context and agree what the engagement should cover.
02
Review
Assess the agreed controls, practices, evidence and relevant technology.
03
Prioritise
Separate material issues from lower-value improvement opportunities.
04
Act
Use the roadmap internally or ask ISTA to support the improvement work.
FAQ
Common questions
Is this a penetration test?
Not by default. A risk review and security assessment are different from penetration testing. If technical testing is required, it should be scoped separately.
Can ISTA support Microsoft 365 security?
Yes, Microsoft 365 identity, access, email and security configuration can form part of the agreed scope.
Can you help us prepare for Cyber Essentials?
ISTA can help you understand relevant controls and improvement actions. Certification itself must be obtained through an authorised certification route.
NEXT STEP
Discuss the right scope for your business.
Tell us what is driving the review and we will discuss a sensible starting point.