Scope

The service covers all network components between the carrier demarcation point and the access port or SSID. It includes firewalls, VPN gateways, SD-WAN edges, switches, wireless controllers and access points, together with the associated licences, firmware and configuration.

• Site-to-site VPN between offices, data centres and cloud virtual networks.
• Remote-access VPN and zero trust network access (ZTNA) for home and mobile workers.
• Next-generation firewall policy, intrusion prevention, web and DNS filtering, TLS inspection.
• SD-WAN overlay with application-aware path selection across multiple circuits.
• Wired LAN segmentation and enterprise Wi-Fi with certificate-based authentication.

Out of scope: carrier circuits and their SLAs (we manage the supplier on the client's behalf), structured cabling installation, and operational technology (OT) controllers on the production side of the plant firewall.

Supported platforms

Devices must be under an active vendor support contract and running a release within the vendor's supported firmware train. End-of-support hardware is flagged in the assessment and scheduled for replacement.

VPN architecture

Site-to-site

Tunnels are route-based IPsec with IKEv2. Dynamic routing (BGP, or OSPF where required) runs over the tunnel interface so that failover does not depend on static routes. Hub-and-spoke is the default topology; full or partial mesh is used where inter-branch latency matters. Connections to Azure use VPN Gateway in active-active mode or a network virtual appliance in the hub virtual network.

Remote access

Remote users connect with an always-on client using IPsec/IKEv2 or a ZTNA agent. Authentication is federated to Microsoft Entra ID through SAML, so MFA and Conditional Access apply to the VPN in the same way as to cloud applications. Device posture (managed, encrypted, EDR healthy, patched) is checked before a session is established. Access is granted per application group, not to the whole internal network. Legacy SSL-VPN portals are migrated to IPsec or ZTNA during onboarding.

Firewall policy baseline

• Default deny between all zones; rules reference address objects and application signatures, not any.
• Separate zones for users, servers, voice, guest, IoT/printers, management and, where present, production equipment.
• Intrusion prevention and anti-malware profiles on all inter-zone and outbound flows.
• DNS and web filtering with blocking of newly registered domains and known command-and-control categories.
• TLS inspection for user traffic, with documented exclusions for banking, healthcare and certificate-pinned services.
• Administrative access restricted to the management zone, with MFA and named accounts; no management interface on the WAN.
• Geo-restriction of inbound services and outbound administrative protocols.
• Logs forwarded to a central collector, retained for a minimum of 12 months.

Rule bases are reviewed every six months. Unused rules (zero hit count over 90 days), shadowed rules and temporary rules past their expiry date are removed through change control.

SD-WAN

Each site is provisioned with at least two diverse underlays, typically FTTP or leased line as primary and a second fibre circuit or 5G as secondary. The SD-WAN edge measures latency, jitter and packet loss per path with active probes and steers traffic by application class.

Wireless LAN

Wireless designs start with a predictive survey from floor plans and are validated on site after installation. Corporate SSIDs use WPA3-Enterprise with 802.1X and EAP-TLS; device certificates are issued through Intune so that no user enters a password to join the network. Guest access is isolated in its own VLAN with client isolation and a bandwidth limit. Access points are Wi-Fi 6 or 6E, with 20 or 40 MHz channels at 5 GHz in dense offices and minimum data rates raised to remove legacy 802.11b clients.

Operations and deliverables

• Monitoring of device health, interface state, tunnel status, circuit quality and licence expiry, polled at 60-second intervals.
• Nightly configuration backup with version history and diff on change.
• Firmware lifecycle: security releases assessed within 5 business days of publication; critical vulnerabilities on internet-facing devices patched within 72 hours.
• Deliverables at handover: layer 2 and layer 3 diagrams, IP address plan, VLAN and zone matrix, firewall rule export, wireless survey report.
• Monthly report: availability per site, circuit performance, blocked threats, changes implemented.

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. Hardware, vendor licences and carrier circuits are quoted separately at cost plus procurement handling. Minimum term 12 months.

Scope

The service covers the hypervisor layer, its shared storage and virtual networking, and the guest operating systems of Windows Server and mainstream Linux distributions. Line-of-business applications remain supported by their vendors; we manage the platform they run on and coordinate vendor access.

• Cluster design, build and hardening.
• Capacity and performance management.
• Operating system patching and lifecycle.
• Physical-to-virtual (P2V), virtual-to-virtual (V2V) and on-premises-to-cloud migration.
• Hardware lifecycle planning with the client's chosen server vendor.

Supported platforms

Reference architecture

The standard on-premises design for 10 to 60 virtual machines is a three-node cluster. Three nodes maintain quorum through a single node failure and allow rolling maintenance without a service outage.

Two-node clusters with an external witness are supported for small sites. Single-host deployments are accepted only with a documented recovery time and replicated backups.

Migration methodology

Discovery and dependency mapping

An agentless collector records CPU, memory, disk IOPS and network flows for a minimum of 14 days. Workloads are grouped into move groups by observed dependency so that a database and its application tier move together.

Disposition

Execution

• Tooling: Azure Migrate for moves to Azure; vendor converters and the Proxmox import wizard for hypervisor changes; block-level replication where a cutover window under one hour is required.
• Each move group has a runbook with pre-checks, cutover steps, validation tests agreed with the application owner, and rollback steps.
• Source machines are powered off but retained for 14 days after cutover, then decommissioned with certified media sanitisation.
• Cutovers are scheduled outside business hours, with hypercare cover on the following working day.

Operations

• Monitoring: host hardware health, datastore capacity and latency, cluster quorum, snapshot age, guest CPU ready time and memory ballooning.
• Guest patching: monthly cycle; critical and high-severity updates applied within 14 days of release; pilot ring before production.
• Hypervisor patching: quarterly, by rolling host evacuation; out-of-band for actively exploited vulnerabilities.
• Snapshot hygiene: snapshots older than 72 hours are alerted and removed after confirmation.
• Capacity review each quarter with a 12-month forecast of compute and storage headroom.
• Lifecycle register of operating system and hardware end-of-support dates, with replacement planned 12 months ahead.

Service levels

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. Hypervisor and operating system licences, hardware and cloud consumption are charged separately.

Scope

Microsoft 365 and Azure are the default platforms for the organisations we serve, and the service is built around them. We manage the tenant as a whole: identity, collaboration workloads, device management integration and the Azure subscriptions attached to it.

• Microsoft Entra ID: users, groups, licensing, Conditional Access, application registrations, guest access.
• Exchange Online, SharePoint Online, OneDrive and Teams, including Teams Phone.
• Azure: landing zone, virtual networks, virtual machines, Azure Virtual Desktop, storage, backup and site recovery.
• Cost management, licence optimisation and governance policy.
• AWS and Google Cloud: account baseline, identity federation, network connectivity and cost reporting for existing workloads.

Microsoft 365 tenant baseline

Every tenant is brought to the following baseline during onboarding. Deviations are recorded as accepted risks with a named client owner.

Azure landing zone

Azure environments follow a hub-and-spoke topology scaled for small and mid-sized estates. The structure separates shared connectivity from workloads so that additional services can be added without re-addressing.

Migration services

Email and files

Mailboxes are moved to Exchange Online by hybrid migration from Exchange Server, or by tenant-to-tenant and IMAP tooling from other platforms. File shares are assessed for path length, unsupported characters and permission complexity, then moved to SharePoint and OneDrive with the SharePoint Migration Tool. Permissions are rebuilt on groups, not copied from individual user entries.

Server workloads

Server moves to Azure follow the methodology in SVC-VRT-02. Virtual machines are right-sized from measured utilisation, not from existing allocation, which typically reduces the compute footprint by 30 to 40%.

Remote desktop

Remote Desktop Services farms are replaced with Azure Virtual Desktop using multi-session Windows 11, FSLogix profile containers and scaling plans that stop session hosts outside working hours.

Cost and licence management

• Monthly licence reconciliation against the joiner and leaver record; unassigned and duplicate licences removed.
• Licence tiering by role: for example Business Premium for standard users, with add-ons only where a feature is used.
• Azure reservations and savings plans applied to steady-state workloads after 60 days of usage data.
• Automatic shutdown schedules on non-production resources.
• Budget alerts at 80% and 100% of forecast, and anomaly alerts on daily spend.
• Monthly cost report by subscription, resource group and tag.

AWS and Google Cloud

We do not recommend a multi-cloud design for organisations of this size without a specific requirement. Where workloads already run in AWS or Google Cloud, the service provides a security baseline (root account protection, single sign-on federated to Entra ID, centralised logging, guardrail policies), site-to-cloud VPN connectivity, patching of virtual machines and consolidated cost reporting. Architecture changes to cloud-native applications are scoped as consulting work.

Service levels

Platform availability is governed by the provider's own service level agreement. We monitor service health and manage incidents with the provider on the client's behalf.

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. Microsoft licences and cloud consumption are billed at the provider's list price on the client's own agreement.

Scope

This service implements and operates the preventive controls that reduce the likelihood and impact of the incidents most common in small and mid-sized organisations: credential theft, business email compromise and ransomware. Continuous detection and response is specified separately in SVC-MDR-06.

Multi-factor authentication and Conditional Access

MFA is enforced through Conditional Access for every user and every application. Per-user MFA settings and SMS are removed. The policy set below is deployed in report-only mode for 7 days, reviewed against sign-in logs, then enforced.

Device management with Intune

• Provisioning. Windows Autopilot with an enrolment status page; devices ship from the supplier to the user and build themselves on first sign-in.
• Compliance policy. Supported OS build, BitLocker or FileVault enabled, Secure Boot, firewall on, EDR sensor healthy. Non-compliant devices lose access through CA04 after a 24-hour grace period.
• Configuration. Security baselines for Windows and Edge, attack surface reduction rules in block mode, removal of local administrator rights, Windows LAPS for the built-in administrator.
• Patching. Windows Update for Business rings: pilot at day 0, broad at day 5, deadline at day 10. Third-party applications updated from a managed catalogue.
• Mobile. App protection policies on iOS and Android for personal phones (PIN, encryption, selective wipe) without full device enrolment.
• macOS. Automated Device Enrolment through Apple Business Manager, with the same compliance gates.

Backup and recovery

Backup design follows the 3-2-1-1-0 rule: three copies of data, on two media types, one off-site, one immutable or offline, and zero errors on verified restore.

• Backup repositories use separate credentials outside the production directory, with MFA on the console and immutability enforced at storage level.
• Every job is checked daily; a failed job is re-run or ticketed the same day.
• Automated boot verification weekly; a full restore test of one production system each quarter, with timings recorded against the RTO.
• An annual recovery exercise simulating loss of the primary site or tenant.

Endpoint detection and response

An EDR sensor is deployed to every workstation and server. The default platform is Microsoft Defender for Endpoint, or Defender for Business in organisations of up to 300 users; third-party agents already in place are supported where they expose an API for alert collection. Tamper protection is enabled, automated investigation and remediation is set to full for workstations and to semi-automated for servers, and device isolation is available to on-call engineers. Vulnerability management data from the sensor drives the monthly patch exception report.

Cyber Essentials readiness

Cyber Essentials is the UK government-backed baseline scheme. It is a requirement for many UK public-sector and supply-chain contracts, and applies to clients in any country that supply UK organisations. We prepare the organisation for assessment; certification itself is issued by an independent IASME-licensed certification body.

Deliverables: scope statement, asset inventory, gap report, remediation, completed self-assessment questionnaire for board sign-off, and for Cyber Essentials Plus a pre-audit vulnerability scan and device sample test. Typical elapsed time is 3 to 6 weeks.

ISO/IEC 27001 readiness

For organisations that need a certified information security management system (ISMS), we run the implementation project up to the certification audit, which is carried out by an accredited certification body chosen by the client.

Typical duration is 6 to 9 months for an organisation of 50 to 150 staff. After certification, the ISMS can be maintained under a retainer covering internal audits, risk reviews and surveillance audit preparation.

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. Certification body fees and software licences are not included.

Scope

Consulting engagements are available to any organisation and do not require a managed agreement. Findings and plans are written so that they can be executed by an internal team or another provider.

• Infrastructure audit.
• Migration planning.
• IT strategy and virtual CIO.
• Technical due diligence for mergers, acquisitions and office moves.

Infrastructure audit

The audit establishes what exists, how it is configured, and where it departs from good practice. Data is collected with read-only access; no change is made to production systems.

Findings format

Each finding records the observation, the evidence, the business impact, a risk rating on a 5×5 likelihood and impact matrix, a recommended action and an effort estimate. Findings are sorted into a 30, 90 and 365-day remediation plan.

Deliverables

• Executive summary of no more than two pages for the board or partners.
• Technical report with findings register.
• Asset register and current-state network diagram.
• Costed remediation plan.
• Presentation of findings in person or by video call.

Typical duration: 5 to 10 working days for a single site of up to 100 users.

Migration planning

A migration plan is produced before any project that changes where systems run: a hypervisor change, a move to Azure, a tenant consolidation after an acquisition, or an office relocation.

• Inventory and dependency map. Systems, data volumes, integrations, licence constraints and vendor support statements.
• Target architecture. Design with sizing, network connectivity, identity integration and security controls.
• Business case. Five-year total cost of ownership for at least two options, including licences, hardware refresh, consumption, migration effort and operating cost.
• Wave plan. Move groups in order, with a pilot wave of low-risk systems, cutover windows and freeze periods agreed against the client's calendar.
• Risk and rollback. Risk register, go/no-go criteria for each wave, rollback procedure and the point after which rollback is no longer available.
• Acceptance. Test scripts agreed with each application owner, and success criteria for performance and recovery.

IT strategy and virtual CIO

The virtual CIO service gives leadership a named senior consultant who owns the technology plan, in organisations that do not need a full-time IT director.

Technical due diligence

For acquisitions and mergers we assess the target's IT estate for undisclosed risk and integration cost: unsupported systems, licence shortfalls, security incidents, key-person dependency and contractual commitments. The report gives a red, amber or green rating per domain and an estimate of the cost to bring the estate to the acquirer's baseline. Typical turnaround is 10 working days from data room access.

Engagement terms

• A statement of work defines objectives, deliverables, assumptions and client responsibilities before work starts.
• Access is read-only unless a change is explicitly authorised. Credentials are issued to named consultants and revoked on completion.
• All material is confidential. A non-disclosure agreement is signed before data is shared.
• Reports are the property of the client on payment.

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. Engagements are delivered remotely by default; on-site work and travel are charged at cost.

Scope

The service is designed for organisations of 50 to 500 users that hold sensitive data but cannot staff a security team around the clock. It detects active threats, investigates them and takes pre-authorised containment action. It complements, and requires, the preventive controls in SVC-SEC-04.

• Collection and correlation of security telemetry.
• Alert triage and investigation by analysts.
• Containment within agreed rules of engagement.
• Incident coordination, reporting and post-incident review.
• Detection engineering and proactive threat hunting.

Out of scope: forensic evidence handling to a legal standard, ransom negotiation, and regulatory notification. We supply the technical facts and timeline that the client and its advisers need for a notification to a data protection authority, professional regulator or insurer.

Telemetry sources

Telemetry is held in a SIEM workspace in the region agreed with the client, such as the EU, the UK or Brazil. Microsoft Sentinel in the client's own Azure subscription is the default, which leaves the data under client ownership if the service ends. Retention is 90 days searchable and 12 months archived, extendable on request.

Detection

• Coverage model. Detection rules are mapped to MITRE ATT&CK techniques. Coverage per tactic is reported quarterly, with gaps prioritised by the techniques seen in incidents affecting comparable organisations.
• Rule types. Vendor analytics, scheduled correlation queries, behavioural baselines (for example impossible travel, first-time administrative tool use, mass file modification) and threat intelligence matches.
• Priority use cases. Token theft and adversary-in-the-middle phishing, malicious inbox rules and payment-diversion patterns, credential dumping, lateral movement over RDP and SMB, remote management tool abuse, shadow copy deletion and other ransomware precursors.
• Tuning. A 30-day baseline period after onboarding. Suppressions are specific, time-limited and reviewed; no rule is disabled to reduce volume.
• Threat hunting. A hypothesis-led hunt each month across all client telemetry, plus retrospective searches when new indicators are published.

Triage and response targets

Times are measured from alert creation in the SIEM. Attainment against each target is published in the monthly report.

Containment actions

Rules of engagement are agreed during onboarding and define which actions analysts may take without prior approval. The standard position is below.

Every action is recorded with the analyst's name, time, justification and the method of reversal.

Incident handling

Confirmed incidents follow a five-stage process aligned with NIST SP 800-61: identification, containment, eradication, recovery and review. A named incident lead coordinates analysts, the client's contact, the managed service team and any third parties such as insurers or incident response retainers.

• Situation updates at intervals agreed at declaration, by default every 60 minutes for Critical incidents.
• Out-of-band communication channel established if email or Teams is believed compromised.
• Preliminary report within 24 hours: what is known, what has been contained, what remains uncertain.
• Final report within 5 business days: timeline, root cause, scope of access and data exposure, actions taken, recommendations.
• Review meeting, with recommendations tracked to closure.

Onboarding and reporting

The monthly report contains alert and incident volumes by severity, mean time to triage and to contain, sensor coverage, top targeted users, ATT&CK coverage changes and outstanding recommendations. A quarterly review covers trends and the threat landscape for the client's sector.

Prerequisites

• EDR sensor on at least 95% of in-scope devices, maintained throughout the term.
• Microsoft 365 licensing that exposes sign-in and audit logs through the API (Business Premium, E3 or higher).
• Two named client contacts reachable by telephone at any hour for Critical escalation.
• Verified backups, since containment may include isolation of production systems.

Pricing

Prices are indicative, in pounds sterling and exclusive of VAT and local taxes; quotations are also issued in euros and US dollars. EDR licences and SIEM data ingestion are charged at the vendor's rate on the client's own subscription. Minimum term 12 months.