We hold ourselves to the standard we set for you.
Alden holds administrative access to your Microsoft 365 tenant. Here is how we protect that access, what happens if something goes wrong, and what you can put in your vendor file.
How we protect the keys to your tenant.
Whoever administers your Microsoft 365 tenant is part of your attack surface. These are the controls on ours.
One admin workstation
Client tenants are administered only from a dedicated, hardened workstation. Conditional Access restricts Alden's admin sign-ins to that device.
Delegated, role-scoped access
We work through Microsoft's granular delegated admin privileges (GDAP), with roles scoped to the job. Each tenant also has one named Alden admin account. No shared logins.
Emergency access, split in two
Each tenant has two break-glass accounts. Your firm holds one; Alden holds the other in an encrypted vault. You never depend on us to reach your own tenant.
Credentials in a vault
Passwords, recovery codes and keys live in Keeper, behind multi-factor authentication. Never in email, notes or spreadsheets.
Our own tenant first
Alden's own Microsoft 365 tenant runs the controls we deploy for clients, starting with devices enrolled in Intune and Conditional Access on every admin account.
AI tools, with limits
Client configurations and findings may be processed in Microsoft Copilot and Claude, on business plans only. Your clients' personal information never goes into an AI tool.
If something goes wrong, here is what happens and when.
Huntress's 24/7 security operations center watches every identity and device we manage. The response runs on a written plan with clocks attached.
- Huntress analysts contain the threat, isolating a device or disabling an account, using actions you approved in advance.When: as soon as it is detected, day or night
- Brian takes over the incident and runs it through containment, investigation and recovery.When: within 4 hours
- You get written notice: what happened, what data was involved, what we have done and what comes next.When: within 72 hours of our becoming aware of an incident that affects your data
- Every step is logged, and the record goes into your evidence binder for your examiner, carrier or auditor.When: throughout, with a written summary afterward
Planned for the day Alden can't answer.
Alden is a one-person firm today, so continuity is written down, not assumed.
If Brian can't be reached
If Brian is unreachable for 24 hours during an incident, or for two business days at any other time, the continuity plan takes effect. A sealed emergency packet, held by a designated person outside the business, starts the hand-over. Your own break-glass account means your firm keeps access throughout.
If you leave, or if we close
If you leave, your data and evidence binder come back to you, and we delete your data from our systems 30 days after the hand-over is complete. If Alden ever winds down for good, every client gets 60 days of transition support and can exit with no penalty.
The providers behind the program.
Your email, files and client records stay in your own Microsoft 365 tenant. These providers run the security program around it.
- Huntress24/7 detection and response for identities and devices
- CIPPDeploying and monitoring tenant security baselines
- CYRISMAVulnerability, dark-web and compliance scanning
- HuduDocumentation and the evidence binder
- KeeperEncrypted credential vault
The full service-provider inventory, with each provider's SOC 2 status, is in the due-diligence packet.
What's in the vendor due-diligence packet.
Ready to send to your CCO, compliance consultant or carrier for the service-provider oversight that Regulation S-P and the FTC Safeguards Rule expect.
- ✓Information Security Program
- ✓Incident response plan
- ✓Business continuity plan
- ✓Service-provider inventory, with SOC 2 reports
Alden does not have a SOC 2 report of its own. The packet shows the written program and the evidence behind it instead, and we will walk through it with your CCO or consultant.
Found a security issue?
Email brian@aldencyber.com with "Security" in the subject line. Tell us what you found and how to reproduce it, test no further than you need to show it, and give us a reasonable chance to fix it before you share it. We will acknowledge your report within one business day.
Please don't
- ✕Access, change or delete data that isn't yours
- ✕Disrupt the site or our services
- ✕Use phishing, social engineering or physical attacks