Twelve controls. How many could you prove tomorrow?
These are the controls that stop the three attacks small regulated firms actually see: account takeover, email fraud and ransomware. Answer “yes” only if you could hand over the record today. The gap between “we have that” and “here it is” is where renewals and exams get uncomfortable.
- 01Phishing-resistant two-step sign-in on every account, partners and shared mailboxes includedProof looks like: A sign-in method export covering every accountYes, with proofYes, no proofNo / not sure
- 02Legacy sign-in protocols blocked; access allowed only from managed devicesProof looks like: The conditional access policy exportYes, with proofYes, no proofNo / not sure
- 03Admin accounts separate from everyday accounts, and protectedProof looks like: An admin role list showing the separate accountsYes, with proofYes, no proofNo / not sure
- 04Identity alerts watched 24/7, with a person on the other endProof looks like: The alert and response logYes, with proofYes, no proofNo / not sure
- 05Outside auto-forwarding off, and mailbox rules watchedProof looks like: A mailbox-rule auditYes, with proofYes, no proofNo / not sure
- 06SPF, DKIM and DMARC enforced on every domain you send fromProof looks like: A DMARC report showing enforcementYes, with proofYes, no proofNo / not sure
- 07Inbound mail screened for phishing and impersonationProof looks like: The mail threat-policy reportYes, with proofYes, no proofNo / not sure
- 08Call-back verification before any payment or wire change, trained and testedProof looks like: The written procedure and training recordsYes, with proofYes, no proofNo / not sure
- 09Every device enrolled, encrypted, patched and remotely wipeableProof looks like: A device compliance reportYes, with proofYes, no proofNo / not sure
- 10Endpoint detection and response on every device, 24/7Proof looks like: A detection coverage reportYes, with proofYes, no proofNo / not sure
- 11Client files open only on managed devicesProof looks like: The device access policy exportYes, with proofYes, no proofNo / not sure
- 12Mail, files and Teams backed up, with a restore test in the last quarterProof looks like: The restore-test recordYes, with proofYes, no proofNo / not sure
Get it as a PDF, with what to fix first
The proof to look for under each control, a record sheet for your answers, and the order we'd close the gaps in.
It arrives by email within a few minutes.
A rough number. Here is what to do with it.
Rare, and worth protecting.
Make sure every record is dated and filed where you can find it at the renewal, the exam, or when an acquirer asks. Keeping it that way is what the managed program does.
The controls are mostly there. The proof usually isn't.
These are the gaps that turn into uncomfortable questions on a renewal application or a document request. The assessment ranks them, and onboarding closes them in order of risk.
At least one of the three attacks has an open door.
The assessment ranks which gaps to close first: $995, three weeks, counted toward onboarding, and the report is yours whether or not you continue.
Want the real score, with the evidence?
The self-check is a rough number. The assessment is the real one: your tenant, devices, vendors and written program, scored against your rule and your insurer's application, with every gap ranked.
How we describe our work
Alden's assessments are point-in-time observations against named standards. We build and operate controls and produce the evidence behind them. We do not audit or certify your firm, and we do not provide legal advice. Your firm reviews and signs its own attestations. Regulators and insurance carriers make their own determinations; our work supports insurability and exam readiness, it does not guarantee either. Our controls reduce the likelihood and impact of the attacks described; no control prevents all of them.