| Deeper protectionMicrosoft’s security and compliance suites, set up and run by your team. |
|---|
| Sign-ins | Multifactor sign-in, with rules by device and location | Plus risky sign-ins stopped or challenged, even with the right password: a leaked password, an anonymous network, a guessing attack |
|---|
| Admin rights | Kept to the people who need them | Given only when needed, for a set time, and taken away after |
|---|
| Sensitive information | Labels your people apply; email with sensitive details encrypted or stopped | Found and labeled automatically, and stopped from leaving by a Teams chat, a USB drive or an upload |
|---|
| Someone quietly taking data | – | An early warning, and tighter controls for that person |
|---|
| An investigation months later | What the security center needs to act today | Six months of every computer’s history, searchable |
|---|
| Email attacks | A bad email pulled from every mailbox at once | Plus a campaign seen as one attack, traced and cleaned up across every mailbox |
|---|
| Microsoft reaching your data | Microsoft’s standard controls | Only with your approval |
|---|
| The proof, kept currentWhat an auditor, an insurer or a partner asks for, already on file. |
|---|
| Who did what in Microsoft 365 | Kept 180 days | Kept one year |
|---|
| Records | Email archived and kept | Email, files and chats kept as long as your rule says, locked when they must not change, then deleted after a review |
|---|
| Legal hold | Email | Email, files and chats, with a case and a review |
|---|
| Your rule’s checklist | – | Kept for you, scored, with the evidence in one place |
|---|
| An evidence report | – | For any audit period, when you or your auditor asks: training finished, practice phishing, policies signed, sign-ins |
|---|
| Your program, kept upThe work people do, so the rules never pile up. |
|---|
| Policies | – | A policy set from our templates, fitted to your business, reviewed with you every year, and signed by your people |
|---|
| Who can reach what | Changed when people join and leave | Plus accounts and settings reviewed as Microsoft changes its systems, and you kept current on what changed and why it matters |
|---|
| Training | Short, regular security training with practice phishing | Plus your rule assigned to your training: the courses, the practice phishing and the policy sign-offs mapped to it, and the evidence built as your people finish |
|---|
| When a rule changes | – | We tell you what changed and what it means for you, and what we changed |
|---|
| Once a year | Planning for next year | Plus a compliance review: what your rule asks, what we run, and what is still yours to do |
|---|
| When someone asks, or something goes wrong |
|---|
| Your insurance application | True answers about the controls we run | Plus the underwriter’s calls, the extra forms, and the evidence if you ever file a claim |
|---|
| An auditor, a regulator or a partner | – | We answer the technical questions with you, from the records and timelines in our systems |
|---|
| A security incident | You hear from us fast, and it is fixed | Plus your insurer’s claims line called first, the logs pulled, the timeline built with you, and the decision you make about who must be told recorded. That decision stays yours, with your attorney |
|---|
