The situation
[Client name] had [X] weeks to answer a major client's security questionnaire. Their previous provider had told them everything was fine.
The uncomfortable truth
Our audit found [X] accounts belonging to people who had left, default settings across Microsoft 365, and backups that had never been tested.
"It wasn't what we wanted to hear. It was what we needed to hear."
What we did
- Ranked every risk by business impact.
- Fixed the top [X] first and documented the evidence.
- Ran staff training and phishing tests.
- Put 24/7 monitoring in place.
The result
[Client name] submitted on time, with evidence, and passed with no findings. [Add the commercial outcome.]