CLOUD SECURITY
A read only review of one platform, against a written baseline.
The Platform Review reads one cloud or identity platform. No production change is made. No outage window, no change board: the shortest engagement in this practice, and the easiest to approve.
When it fits.
- One tenant holds most of what matters and nobody has read it since it was built.
- An administrator or provider changed, and you want an independent read of who holds what.
Six areas, in the order they are read.
| Area | What is read |
|---|---|
| Identity and administrative access | Who holds admin rights, how granted and taken back, who escapes the login rule |
| Tenant configuration | What a user can do unasked, including defaults nobody chose |
| External sharing | What can leave, by whom, for how long, unreviewed since |
| Mail rules and forwarding | Forwarding, delegates and rules, where a compromise persists and first shows |
| Logging and retention | What is recorded, how long, and whether a later investigation could use it |
| Trust and integration design | Which applications hold grants, who consented, what they reach without new approval |
A baseline is the floor. The design review is the value: a tenant can pass every item and still be badly built, so the memo separates settings from design.
Two artifacts.
- Platform Findings MemoEach finding with evidence and what it affects, then fixes ordered by cost and what each removes. The baseline is attached: what was checked and what was not.
- Leadership SummaryOne page for whoever approves the work: what was reviewed and not, what matters most, the one thing asked for.
Four steps, read only throughout.
- Platform named, with its administrator and any managed provider, who may grant access and own findings. We say before you commit whether we review it.
- Access granted by you: a read only role, described in writing, that sees configuration and audit records.
- Configuration, then design, against the baseline, with evidence.
- Memo delivered, access removed, with a written removal list. The retest reads changed settings again.
Access, and getting it back
- We state in writing the access we need and why, at the lowest level that will answer the question.
- You grant it, decide what it is scoped to, and can revoke it at any moment without asking us.
- At closure we list in writing what to remove, item by item, and ask you to confirm it is removed.
The commitment in full is on Trust and Assurance.
One platform, and where it stops.
| Subject | Included | Not included |
|---|---|---|
| Platform | One, usually Microsoft 365, Azure or AWS | More than one: Security Assessment |
| Changes | None; the memo says what to change | A remediation project |
| Method | Configuration as it stands on the days read | Continuous Offensive Security Testing (COST), continuous monitoring |
| AI features, on by default | What is enabled, what tenant data it reaches, who consented | What the vendor does with it: AI Vendor and Third Party Review |
No report from this firm is represented as proof that a tenant is secure or compliant.
What a rule requires of your tenant.
FTC Safeguards Rule, 16 CFR Part 314
Its tenant paragraph, 314.4(c): access controls, encryption at rest and in transit, and multifactor authentication, at any size.
- Reaches
- Nonbank financial institutions under FTC jurisdiction.
- Not
- Banks, savings associations, federally insured credit unions.
- Exempt
- Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size.
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
Since 1 November 2025: multifactor authentication for user access and written asset inventory procedures.
- Reaches
- Holders of a DFS license, registration, charter or similar authorization.
- Not
- A firm whose only link is a New York customer.
- Exempt
- Any one of three 500.19(a) tests, set out on Mortgage, removes the universal multifactor duty; 500.12(a) still requires it for remote access, remote access to third party applications from which nonpublic information is accessible, and privileged accounts other than service accounts that prohibit interactive login; never the 72 hour or 24 hour notices in 500.17.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| Retest | One round of verification of remediated findings is included in the fee as standard. Further rounds are quoted, and the proposal states the window. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
| Will you change anything in our tenant? | No. Access is read only: no argument about who touched what. |
A Platform Review ends. What follows is your call, from an afternoon of settings to the vulnerability program.
Start with one tenant and its administrator.
Name the platform and what prompted the question. The platform decides the fee.
- Unit
- One cloud or identity platform
- Fee
- Fixed against this scope, in writing, in the first conversation, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.