Microsoft 365 Security Assessment

Microsoft 365 is designed to be an open, collaborative platform that, although great for productivity, can cause security concerns. Assessing your environment will provide recommendations to ensure you remain secure. Our security assessment has been developed to audit your Microsoft 365 and Office 365 environments against Microsoft & FITTS security and compliance best practices which are in line with CIS Microsoft 365 Security Benchmark.

The Microsoft 365 Security Assessment consists of three stages which are designed to identify gaps in your business's current security controls, identify and assess the key risks and propose effective mitigation measures. This will involve the rapid capture of relevant information using a variety of sources and result in a consolidated view of the client’s current security posture.

By partnering with FITTS - you gain access to FITTS unique proprietary tooling and automation which enables us to provide you with a faster assessment at a lower cost. This means clients are able to yield faster results with a less of your time required.

Step 1: Information Gathering Run the tailored script to gain an overview of the client's security posture. Meet with the relevant stakeholders if additional information is required to gain validation of findings. Consolidate results to verify results found in the initial script execution.

Step 2: Present findings Provide the associated stakeholders with the report findings on current security controls, identify key risks, and clarify any discrepancies in the form of detailed findings report that outlines the checks performed.

Step 3: Best practice recommendations & roadmap Initiate a step-by-step plan to mitigate any findings that pose to be a threat to the client's security posture. If required, a future roadmap can be tailored to provide a future state remediation plan.

Deliverables:

1. Executive Summary: The assessment provides an executive summary that highlights the key findings of the assessment and the recommended next steps. This summary should be easily digestible for non-technical stakeholders and provide an overview of the assessment's impact on the organisation.

2. Comprehensive Security and Compliance Report: The assessment provides a detailed report that outlines the results of the assessment, including identified security and compliance risks, vulnerabilities, non-compliance issues and possible misconfigurations. This report also includes results against security & compliance management tools, depending on the Microsoft 365 plan the client is on, that they can leverage to improve their control and posture. If the organisation is subject to industry-specific regulations, the assessment will provide a compliance report that evaluates the organisation's compliance with relevant regulations, such as Kenya Data Protection Act, HIPAA, GDPR, and others. This report also includes a risk assessment summary that identifies the likelihood and impact of identified security and compliance risks. This will help your organisation prioritise remediation efforts and allocate resources effectively.

3. Gap Analysis and Remediation Recommendations: The assessment provides a gap analysis that compares your current security and compliance posture to industry best practices and standards. This identifies areas for improvement and align the organisation’s security and compliance efforts with industry standards and best practices. The report includes recommendations for remediation, including technical controls and policy changes.