The process
How it works
Six steps from first call to verified fixes. Designed so the assessment demands almost nothing from your team and changes nothing in your tenant until you decide otherwise.
Step 1
Scoping call
45 minutes, free. We establish which workloads your tenant uses, agree the scope band and confirm the published price. You leave knowing exactly what will be checked.
Step 2
Read-only access
Your team grants read-only access using guidance we provide. Nothing is installed, nothing is changed, and access is removed the moment the work ends.
Step 3
The assessment
A consultant works through the scoped areas against the CIS Microsoft 365 Foundations Benchmark: several hundred settings read in the context of how your business actually uses the platform.
Step 4
The hour with your team
One conversation with whoever runs IT: what is deliberate, what is legacy, what nobody remembers. Configuration only tells half the story; intent tells the rest.
Step 5
Report and debrief
You receive the scored findings, the board summary and a remediation roadmap ranked by impact and effort, then a debrief where every finding can be challenged before anyone acts on it.
Step 6
Remediation re-test
When your fixes land, whether your team makes them or ours, we re-verify the priority items at no charge, so the roadmap ends in evidence rather than intentions.
Quick answers
The process, answered plainly
How long does the whole process take?
Typically three to four working days of assessment inside a two-week window from scoping call to debrief, depending on the scope band and how quickly access is granted. The re-test happens whenever your fixes are ready.
How much of our team's time does it need?
About two hours in total for most engagements: the scoping call, granting access, and the interview hour. The debrief is as long as your questions deserve.
Can you also make the fixes?
Yes. Most clients split the roadmap: their team takes the straightforward items and we handle the changes that need care, like Conditional Access rollouts that could lock people out if sequenced badly. Remediation is scoped and priced separately once the roadmap exists.
What happens after the re-test?
You choose the ongoing rhythm: an annual review to catch drift, continuous monitoring through the CyPro SOC, or both. Neither is required; the assessment stands alone.
Step one is free
Start with the scoping call
45 minutes, no obligation: your workloads mapped, your band confirmed at the published price, and a start date if you want one.