Published baseline · v1.2
The Standard: what every managed tenant runs.
This is the baseline I enforce on every managed client, published so you can check it. Each control is written two ways: what it stops, in plain terms, and what is actually configured. The table shows which plan enforces which control, and the boundaries below say what is quoted separately and who this is not a fit for.
Before and after
7 of 17 controls
A typical small-business setup, and the same business on the Standard. These seven controls are shown because they are the ones most often missing when I take a business on. The full list is below.
Typical small-business setup
MFA on every account
Passwords only. One phished login and someone is in the mailbox.
Email authentication at enforcement
SPF, DKIM and DMARC missing or left at monitor-only, so the domain can be spoofed.
Managed patching
Updates happen when someone remembers, or when a machine forces a restart.
Managed devices
Laptops are unmanaged. A lost one is a data leak with no way to lock or wipe it.
One support door
Requests arrive by text and phone call, so some are never recorded.
Documentation your business owns
How it all works lives in the provider's head, not in anything you hold.
Emergency admin access
One person holds the only admin login. If they are unavailable, so is your tenancy.
On the Standard
MFA on every account
A stolen password on its own does not get anyone into your email or files.
Email authentication at enforcement
Receiving mail servers reject email that pretends to be your business, and your real mail keeps landing.
Managed patching
Known holes in Windows and the apps you rely on are closed before they are used against you.
Managed devices
A lost or stolen laptop is locked or wiped rather than becoming a data leak.
One support door
Every request is recorded and prioritised, so nothing is lost in a text message.
Documentation your business owns
If I disappeared tomorrow, a competent stranger could pick up your IT from the notes.
Emergency admin access
Your business is never locked out of its own systems because one person is unavailable.
The controls
17 controls · 7 areas · 2 plans
- Includedenforced on that plan
- Partialread the control’s text for what is and is not included
- Not includednot included
Identity
3 controlsMFA on every account
A stolen password on its own does not get anyone into your email or files.
Multi-factor authentication enforced for all users and admins in Microsoft 365 (Entra ID) or Google Workspace. Refusing MFA makes a business unsuitable for a managed plan.
- Business+
- Included
- Secure+
- Included
Conditional access
Sign-ins from unexpected places or unmanaged devices are blocked or challenged, not waved through.
Conditional Access policies configured and kept in good shape alongside MFA (the security hardening included from Business+).
- Business+
- Included
- Secure+
- Included
Breach and dark-web monitoring
You find out when staff logins turn up in a known data breach, before someone else uses them.
Ongoing monitoring of staff logins against known breach data, with a clear alert and what to do about it.
- Business+
- Not included
- Secure+
- Included
Devices
2 controlsManaged devices
A lost or stolen laptop is locked or wiped rather than becoming a data leak.
Staff Windows devices enrolled in Microsoft Intune (or Google endpoint management), kept encrypted and compliant, with remote lock and wipe.
- Business+
- Included
- Secure+
- Included
Endpoint protection with alerts acted on
Malware on a machine is caught and dealt with rather than sitting there unnoticed.
Standard endpoint protection on every managed device, kept in place and patched, with alerts acted on and advanced security monitoring.
- Business+
- Included
- Secure+
- Included
Email authentication at enforcement
Receiving mail servers reject email that pretends to be your business, and your real mail keeps landing.
SPF, DKIM and DMARC configured and held at enforcement (p=reject), checked for drift.
- Business+
- Included
- Secure+
- Included
Patching
2 controlsManaged patching
Known holes in Windows and the apps you rely on are closed before they are used against you.
Operating systems and key applications patched on a managed schedule, with monitoring so failures are caught.
- Business+
- Included
- Secure+
- Included
Proactive monitoring
Most problems are caught before they interrupt your staff.
Monitoring of managed systems, with issues worked before they become tickets where practical.
- Business+
- Included
- Secure+
- Included
Support
3 controlsOne support door
Every request is recorded and prioritised, so nothing is lost in a text message.
Support email or portal creates a ticket. Phone is for genuinely urgent incidents via the published urgent pathway. No support via personal SMS, WhatsApp or social media.
- Business+
- Included
- Secure+
- Included
Business-hours response target
You know how long you should wait before hearing back, and it is written down.
Four-business-hour response target on Business+ and above, during service hours. A response target is not a guaranteed resolution time.
- Business+
- Included
- Secure+
- Included
Starters and leavers
Ex-staff cannot keep reading your email or files after they leave.
Standard user onboarding and offboarding included; leaver access closed promptly on request.
- Business+
- Included
- Secure+
- Included
Documentation
4 controlsDocumentation your business owns
If I disappeared tomorrow, a competent stranger could pick up your IT from the notes.
Per-client handover pack: tenant, vendors, network and escalation contacts, kept current and owned by you, not held hostage.
- Business+
- Included
- Secure+
- Included
Plain-English reporting
You can see what was done and what is outstanding without needing an IT department to translate.
A written monthly report on Business+ and Secure+.
- Business+
- Included
- Secure+
- Included
Quarterly security review
Security gaps are reviewed on a schedule, not only after something goes wrong.
Quarterly security review of the controls above, with findings and decisions recorded.
- Business+
- Not included
- Secure+
- Included
Security awareness basics
Your staff know what a phishing email looks like and what to do with it.
Security awareness basics covered with staff as part of the managed relationship.
- Business+
- Included
- Secure+
- Included
Continuity
2 controlsEmergency admin access
Your business is never locked out of its own systems because one person is unavailable.
Documented emergency access procedure (break-glass account), not shared credentials. You hold the admin access to your own tenancy.
- Business+
- Included
- Secure+
- Included
Planned absences told in advance
You are never surprised to find nobody is answering.
Planned leave is communicated in advance and routine work is scheduled around it; monitoring and automated systems keep running.
- Business+
- Included
- Secure+
- Included
What’s not included
These sit outside the monthly fee and are always quoted first, so there are no surprises on an invoice:
- Projects: migrations, new sites, major tenant redesign, bulk device rollouts
- Remediation of pre-existing problems found at onboarding
- Unsupported or legacy applications, and app-specific consulting
- After-hours and urgent work (published urgent rates)
- Training sessions, cabling and electrical work
- Software licences and vendor costs (billed at cost)
- Data recovery beyond ordinary restores
Not a fit if
I would rather say this here than find out after onboarding:
- You do not want MFA, patching or endpoint protection on your accounts and devices. I can still do one-off consulting, but not a managed plan.
- You need a 24/7 guarantee. I do not offer one unless it is separately contracted, and I will not imply otherwise.
- You run legacy line-of-business systems that cannot be supported and there is no appetite to fix or replace them.
- You expect support by texting or messaging me personally. Support goes through one door so it is recorded and prioritised.
- You have fewer than 5 staff or well over 40. Below the minimum, ad-hoc support is the better fit; above it, you need a team, not one person.
Changelog
Current version v1.2
v1.2Current
Reworded the plain-English description of email authentication so it says what the control does (receiving servers reject spoofed mail) rather than an absolute. No control changed.
v1.1
The table and plan picker now show the two published plans, Business+ and Secure+. No control changed for either plan; the endpoint protection and reporting lines were reworded to describe those plans only.
v1.0
First published version. Independent Microsoft 365 / Google Workspace backup is planned as a control once the backup service passes pilot; until then it is not claimed.
Pick a plan and a headcount.
Every plan runs the controls marked for it in the table above. The figure is per user per month, straight from the pricing page, and it is what you will be quoted.
See where your domain sits against the email control.
The free scan checks the email authentication and website security parts of the Standard from your domain alone. No login or access is needed.
Want your business run on the Standard?
Book a free 15-minute chat and I will tell you which plan fits and what discovery would find first.