Security orbits / ink, lime and indigo

A cybersecurity assessment proposal for a professional services firm that needs evidence for its cyber insurance renewal and a client’s security questionnaire. It covers what the scoping call found, the five areas tested, what is included and excluded, a five-week timeline, a similar client’s results and three one-time options.

Cybersecurity Assessment Proposal

Overview

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Thank you for the call</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">You want evidence that your firm is secure before your cyber insurance renews on 1 February.</p>

Introduction

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">What we heard on the scoping call</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">120 staff in two offices, 134 computers and Microsoft 365, looked after by an outside IT provider.</p>

Laptops and desktops by patch status

<p>Your insurer asks for multi-factor sign-in everywhere and an assessment from the last twelve months.</p>

Insurance renews on 1 February

<p>Your largest client sent 140 questions. 38 need evidence your team does not have today.</p>

A client questionnaire

<p>Four people share three Microsoft 365 administrator logins, so nobody can tell who changed what.</p>

Shared admin accounts

<p>Backups run every night, but nobody has tried to restore a whole server from them.</p>

Backups never restored

Your situation

<h2 style="font-family:var(--proposal-font-accent);font-weight:500;line-height:1.14"><span style="font-size:clamp(30px,4.2cqw,52px)">We recommend a full assessment of five areas, with every finding ranked by risk and by the effort to fix it.</span></h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">You see the few changes that matter most first, so your IT provider can start on them before the report is final.</p>

<p>A scan of your public addresses, website and remote access, looking for open services and missing updates.</p>

Internet

<ul><li>Sign-in settings and multi-factor coverage</li><li>Administrator accounts and who has them</li><li>Email protection against spoofing and phishing</li><li>Sharing settings for OneDrive and Teams</li></ul>

Microsoft 365

<p>A configuration check of 20 sample laptops and both file servers: updates, disk encryption, antivirus and local administrator rights.</p>

Computers

<p>A restore test of one server with your IT provider, timed from start to finish, and a review of what is backed up and where.</p>

Backups

<p>A phishing test for all staff and a review of your security policies against what your insurer and client ask for.</p>

People

Our recommendation

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">What is included</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">Everything in the recommended option, Full assessment.</p>

External scan of your internet-facing systems

Review of your Microsoft 365 security settings

Configuration check of 20 laptops and both servers

A timed restore test with your IT provider

Phishing test for all 120 staff

Report with fixes ranked by risk and effort

Drafted answers for your client questionnaire

Fixing the issues we find

A penetration test, unless you choose that option

Certification such as ISO 27001 or SOC 2

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Five weeks from kickoff</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">Work starts on {{START_DATE}}. Testing happens only in the windows you approve.</p>

<p>We agree the testing windows, and your IT provider gives us read-only access.</p>

Kickoff and access

<p>Scans, configuration checks, the restore test and the phishing test.</p>

Testing

<p>We rank every finding and draft the report and questionnaire answers.</p>

Analysis

<p>A 90-minute session with you and your IT provider to agree who fixes what.</p>

Readout

What is included

<p><strong style="font-size:1.15em">{{SELLER_NAME}}</strong><br>Security lead, {{SELLER_COMPANY}}</p>
<p>Seventy assessments for law, accounting and engineering firms since 2017. CISSP and OSCP certified. You will also work with:</p>
<ul><li>A penetration tester for the external scan and the computer checks</li><li>A Microsoft 365 specialist for the settings review</li><li>{{SELLER_NAME}} for the report, the readout and your questionnaire</li></ul>

Who you will work with

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Results for a similar client</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">A law firm that needed evidence for its insurer, and what happened next.</p>

Results for a similar client

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Options and fees</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">Three options. We recommend Full assessment.</p>

The two areas your insurer asks about most.

Essentials

Full assessment

Plus a tester trying to get in from outside and from a staff laptop.

Assessment and penetration test

<p>Fees are in USD and exclude tax. This proposal is valid until {{VALID_UNTIL}}.</p>

Options and fees

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Common questions</h2>

<p>No. Scans run in the windows you approve, usually evenings, and we stop at once if anything slows down.</p>

Will testing interrupt our work?

<p>Insurers we work with accept it. We include a one-page summary written for them, signed by our security lead.</p>

Will our insurer accept the report?

<p>Not in this project. Your IT provider usually fixes them, and we check the fixes if you add a retest.</p>

Do you fix the problems too?

<p>Read-only access to Microsoft 365, a list of your public addresses, and an hour with your IT provider each week.</p>

What access do you need?

<p>Only the people you name. Reports are encrypted, and we delete our working data 90 days after the readout.</p>

Who sees the findings?

<p>We call you and your IT provider the same day and do not wait for the report.</p>

What if you find something urgent?

Questions

<h2 style="font-family:var(--proposal-font-heading);font-size:clamp(28px,4.2cqw,44px);line-height:1.14;font-weight:700">Next steps</h2><p style="font-size:clamp(20px,2.1cqw,23px);line-height:1.5">How we start.</p>

Cybersecurity Assessment Proposal - Preview