Protection for data, devices and accounts
Many attacks on small and midsize businesses start with a fake email, a weak password or a security gap that an available update would have closed. We close these entry points one by one and make sure you can get back to work quickly after an incident.
IT security keeps outsiders from reaching your data, encrypting your systems or sending invoices and payment requests in your name. If an attack still gets through, your preparation decides whether you lose one day or several weeks.
This rarely takes expensive specialty products. What matters more is that the basics are fully in place and checked regularly: a properly configured firewall, sign-in with a second factor, current systems, a backup you can actually restore, and employees who recognize a suspicious email. That is where we start.
An attacker has to get past every layer to reach your data. We secure them from the outside in.
The firewall at your internet connection only lets through the connections your business really needs. Inside the network we separate areas such as office, production, servers and guest Wi-Fi, so an attacker cannot move from one device to everything else. We connect locations and remote staff through secured VPN. We work with firewalls from Sophos, Fortinet (FortiGate) and Securepoint.
Spoofed senders, malicious attachments and links to fake sign-in pages are filtered out before they reach the inbox.
Many attacks target the people in your company. Using everyday examples, we show your team how to spot fraud attempts and what to do when something looks wrong.
Every sign-in to Microsoft 365 and your systems uses MFA. With Conditional Access we define which devices and locations are allowed, so a stolen password alone is not enough.
Operating systems and applications get their security updates promptly and in an orderly way. We monitor which devices fall behind and bring them up to date before a known gap is exploited.
We manage laptops and smartphones centrally through Intune and protect them with Microsoft Defender. If a device is lost, it can be locked remotely and your company data stays protected.
We back up your data and run test restores on a regular schedule. The results are documented, so before an emergency you know that recovery works and how long it takes.
Every measure starts with an assessment, so you invest first where the risk is highest.
In 20 minutes over Teams or by phone, we find out where you stand and which review fits your size.
The security check takes 2 to 3 days and ends with a written report. Larger environments get the security assessment, which adds an access analysis and a gap analysis against the rules that apply to you, such as HIPAA, the FTC Safeguards Rule, SOC 2 or CMMC. Medical and dental practices with up to 15 staff at one location can start with our HIPAA readiness check.
We rank the findings by risk and effort and tell you what implementation will cost.
We carry out the measures as a project or as part of your managed IT plan and check regularly that they still work.
Who in your company can access what is one of the most important security questions there is. In environments that have grown over time, former employees often still have access, and new hires inherit the rights of their predecessor along with everything that came with them.
That is why we have a separate service for it: Identity & Access Management. We analyze permissions, build a role model and set up defined processes for hiring and departures.
An incident response plan sets out who decides in an emergency, whom you call and which systems must come back first. We build it with you and practice it, so it is more than a file on a server. Notification duties can start the clock quickly. Every US state has a breach notification law for certain personal information, with different triggers and deadlines. HIPAA covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Non-bank financial institutions under the FTC Safeguards Rule must notify the FTC within 30 days of discovering an incident that affects the unencrypted information of at least 500 consumers. Public companies have separate SEC disclosure duties for material incidents. Your legal counsel decides which rules apply. We make sure the facts and logs they need are available.
| Security check | $2,950 |
| Security assessment | from $7,900 |
| HIPAA readiness check for practices (up to 15 staff, one location) | $3,500 |
| Identity & Access and IT security | $225 per hour |
| Standard managed IT plan with MFA, Conditional Access and Defender | $149 per user / month |
The cost of the security assessment is credited to a follow-up project. Prices are fixed in US dollars, plus sales tax where it applies.
We took over the complete IT of a small research company with international operations, rebuilt it and keep developing it in close coordination with management.
Result: A fully automated IT environment designed for strict EU security requirements, with separate admin and user accounts and secured VPN between locations.
We merged two companies onto shared IT without interrupting daily work: Microsoft 365 fully in the cloud, sign-in with MFA and Conditional Access, device management through Intune and Autopilot.
Result: New employees are now ready to work in less than a day instead of three to four days. A new device is ready in two hours, and it is clear which software runs and which licenses are paid for.
FAQ
With an assessment, because without one it is easy to invest in the wrong place. Our security check costs $2,950 and gives you a written report that shows which measures should come first. Medical and dental practices with up to 15 staff at one location can start with the HIPAA readiness check for $3,500.
No, they cover only part of it. Many attacks use stolen credentials or fake emails, so MFA, email protection, current updates and a tested backup belong in the picture as well.
Yes. We set up the firewall, VPN and network segmentation, maintain rules and updates, and check regularly which services are reachable from outside. We work with firewalls from Sophos, Fortinet (FortiGate) and Securepoint. If you already have a firewall, we first check whether the vendor still provides security updates for it. Ongoing management of servers and the network is included in the Complete plan, covering up to two servers and one firewall.
MFA makes sure a stolen password alone is not enough to sign in. In addition to the password, you need a second proof, usually a confirmation in an app on your smartphone.
Only through a test restore. We restore backups on a regular schedule and document the results, so you know how long a recovery takes.
The basics are. The Basic plan already includes patch management and backup with tested restores. The Standard plan for $149 per user per month adds MFA, Conditional Access and Microsoft Defender.
Yes. Using everyday examples, we show your team how to recognize fake emails and phone calls and whom to contact when in doubt.
Disconnect affected devices from the network, delete nothing and call us at +1 (562) 514-4234. Our IT emergency page lists the first steps and all the ways to reach us.
That depends on your industry and the data you handle, and in the end it is a legal question for your counsel. Healthcare providers and their business associates fall under HIPAA. Non-bank financial businesses such as mortgage brokers, tax preparers and non-registered investment advisors fall under the FTC Safeguards Rule. Defense contractors face CMMC, and many software and service companies are asked for a SOC 2 report by their customers. Every state also has a breach notification law. We work out with you what needs to happen on the technical side, even when the requirements only reach you through a customer.
IT Security
Give us a short description of your environment. Afterward you will know which starting point makes sense for you.
