I review security for Charlotte small businesses: old admin accounts, former users, weak email protection, untested backups, and outdated computers.Charlotte business security reviews: old admin accounts, former users, email, backups, and outdated computers.
We talk through how your business works, who manages its systems, and what concerns you. I use that to prioritize the review; it is not a compliance audit.Your business, system responsibilities, and concerns guide the priorities. This review is not a compliance audit.
I identify the people and accounts controlling Microsoft 365, domains, websites, file storage, network equipment, backups, and other systems the business depends on.I identify who controls Microsoft 365, domains, websites, files, networks, backups, and essential systems.
I review MFA, administrator roles, updates, endpoint settings, email safeguards, shared access, backup status, and the recovery information attached to important accounts.I review MFA, admin roles, updates, device/email protection, sharing, backups, and account recovery.
You receive a short list separated into urgent fixes, near-term improvements, and items that can wait. I explain the business reason for each recommendation.Get prioritized fixes—urgent, near-term, or able to wait—with reasons for each.
I review ownership, devices, protection, alerts, response contacts, and recovery.I review system ownership, protection, alerts, response contacts, and recovery.
Owners, administrators, vendors, and employees need clear responsibilities.
Critical accounts, devices, data, and customer-facing systems are identified first.Identify critical accounts, devices, data, and customer-facing systems first.
MFA, updates, least-needed access, safer email, and tested backup reduce avoidable exposure.MFA, updates, limited access, safer email, and tested backups reduce exposure.
Alerts, account activity, endpoint warnings, and vendor notices need an owner.Assign responsibility for alerts, account activity, device warnings, and vendor notices.
The response list should include the owner, IT contact, bank, insurer, vendors, and legal help when applicable.List response contacts: owner, IT, bank, insurer, vendors, and legal help when applicable.
Backups, restore testing, replacement plans, and account recovery paths matter before an incident.Plan backups, restore tests, replacement equipment, and account recovery before an incident.
For owner education, I also point clients to the CISA small-business resources and the NIST small-business quick-start guidance.Learn more from CISA’s small-business resources and NIST’s quick-start guidance.
You’ll have a short list of the issues, why they matter to your business, and what to do next.Know the issues, why they matter, and what to do next.
See an example of this work: PVG’s Microsoft 365 account and access review.See PVG’s Microsoft 365 access review.
No. This reviews practical controls, ownership, Microsoft 365, backups, and response readiness. Regulated businesses may need a specialist.
The first priorities usually protect the accounts and systems that could stop the business: administrator access, MFA, former-user access, supported and updated computers, email protection, and a backup that can actually be restored. The order depends on your operation.
Tell me a little about your business and what concerns you. I’ll help you work out what needs attention first.Tell me about your business and concerns. We’ll work out what needs attention first.
