One path. Three stages. Every deliverable named.
Every firm starts with the assessment, under one agreement that also covers onboarding and the monthly program. Each stage produces artifacts you can hand to an examiner, an underwriter, the IRS or an acquirer's due-diligence team — they are listed under every item below.
12 controls scored
Security & compliance assessment
A three-week review of your Microsoft 365 tenant, devices, vendors and written program, scored against your rule and your cyber insurer's application. You receive a findings report with every gap ranked, written for a principal and a board rather than an IT department. The $995 you pay at signing covers it and counts toward onboarding; if you stop at the readout, the report is still yours.
Onboarding & remediation
We close the gaps the assessment found, at a per-user price set before you sign. Identity protection and conditional access in Entra. Device compliance through Intune. Data loss prevention and retention in Purview. Managed detection and response on every identity and endpoint. And the written policies that describe each control exactly as configured.
Managed compliance
Priced per user under one agreement, billed from the day your controls go live. We run the stack, watch the alerts around the clock, keep the evidence current, run your annual tabletop exercise and awareness training, track vendor reviews, and sit beside you through exams, renewals and questionnaires. Microsoft 365 Business Premium is required for every user and billed separately.
We confirm headcount, Microsoft 365 and the rule you answer to, then send one agreement with every price in it.
What you receive at each stage, and the evidence that comes with it.
- Identity and tenant review: MFA coverage, Conditional Access, admin accounts, legacy authenticationArtifact: Entra sign-in and policy exports
- Device and data review: enrollment, encryption, patch state, data loss preventionArtifact: Intune compliance report, Purview policy export
- Vendor inventory with the breach-notice clause checked in each contractArtifact: vendor register with contract status
- Written-program gap review against your rule (Reg S-P and S-ID, ALTA Pillar 3 and FTC Safeguards, or IRS Pub. 4557)Artifact: control-by-control gap matrix
- Insurance application comparison: what was attested against what is configuredArtifact: attestation variance list
- Ranked findings report and a readout with your principalsArtifact: findings report, remediation plan, readout minutes
- Microsoft 365 Business Premium licensing verified or moved under AldenArtifact: license assignment report
- Conditional Access baseline: MFA on every account, legacy authentication blocked, protected admin rolesArtifact: policy set export and test results
- Intune device compliance: encryption, patching, compliant-device access to client dataArtifact: device compliance report
- Purview data loss prevention and retention baseline for client informationArtifact: DLP policy export and match report
- 24/7 managed detection and response on every identity and device; Microsoft 365 and endpoint backup with a first restore testArtifact: coverage report, restore test record
- Written policy set drafted to match the configuration; incumbent IT hand-over and user communicationsArtifact: signed policy set, hand-over checklist
- We run the stack: detection and response, vulnerability scanning, patching, backup and licensingArtifact: monthly operations summary
- Security support line for your people: MFA resets, device enrollment, access lockouts, suspicious-email triageArtifact: ticket log with response times
- Evidence pack refreshed every month and available the day it is requestedArtifact: access, device, DLP and backup reports, attested
- Quarterly review: control status, incidents, vendor changes, open itemsArtifact: quarterly review deck and minutes
- Annual incident response tabletop and security awareness training for every userArtifact: tabletop minutes, training completion records
- Annual penetration test, vendor reviews tracked, breach-notice clauses verified as contracts renewArtifact: pen-test report, vendor register, review log
- Beside you through exams, cyber insurance renewals and client due-diligence questionnairesArtifact: completed questionnaires and document-request responses
The policy set Alden owns
Every policy describes a control we have actually turned on in your tenant, so the document and the configuration say the same thing when someone compares them. Your CCO, compliance consultant or principals keep the rest.
- ✓Written information security program (WISP)
- ✓Incident response plan, with the client-notice and vendor-notice clocks built in
- ✓Service provider oversight procedures and vendor register
- ✓Identity-theft red flags program (Reg S-ID, where it applies)
- ✓Access control policy
- ✓Records retention and secure disposal
- ✓Business continuity and disaster recovery
What is in scope, and what is not.
Alden is a cybersecurity and compliance firm, not a general IT shop. Knowing where the line sits is what lets one agreement cover everything inside it.
In scope
- ✓Microsoft 365 Business Premium license management (the license itself is billed separately) and the security support line for your users
- ✓Identity, device and data controls: Conditional Access, Intune compliance, Purview DLP
- ✓24/7 managed detection and response, vulnerability scanning, patching, annual penetration test
- ✓Microsoft 365 and endpoint backup with restore testing
- ✓The written security program and the evidence behind it
- ✓Tabletop exercise, awareness training, vendor reviews, quarterly reviews, exam and renewal support
Out of scope
- ✕General IT and break-fix: printers, Wi-Fi, line-of-business applications
- ✕Hardware purchase and refresh. If a device cannot run the required controls, the firm replaces it
- ✕Firewalls and network equipment. Quoted as fixed-fee project work when a firm needs them
- ✕Your firm's wider compliance program — Code of Ethics, Form ADV, underwriting rules, tax practice standards. That stays with your CCO, consultant or principals
- ✕Non-security compliance such as HR, OSHA and billing. We refer you to partners who do this well
- ✕Google Workspace environments. Our controls are built on Microsoft 365
If it's the right-hand list, we'll tell you so on the call and point you to someone who does that well.
The tools generate the exhibits. Alden generates the attestation.
Microsoft 365 Business Premium is the foundation: Entra ID, Intune, Defender for Business, Defender for Office 365 and Purview. Around it we run a managed stack: Huntress for 24/7 detection and response, CIPP to deploy and watch your tenant baselines, and CYRISMA for vulnerability, dark-web and compliance scanning, plus backup, password management and documentation. Every tool produces evidence, and each one is named in your agreement.
Identity & access
Entra ID P1, Conditional Access baselines deployed through CIPP, privileged-role protection, company password manager
Devices
Intune compliance and configuration, encryption, patching, remote wipe
Data
Purview labeling, data loss prevention, retention; Known Folder Move to OneDrive
Detection & response
Defender for Business plus Huntress's 24/7 managed SOC on every identity and endpoint
Backup & continuity
Microsoft 365 backup with quarterly restore tests; endpoint backup where needed
Evidence & documentation
CYRISMA vulnerability and compliance scanning, documentation platform, the dated evidence binder
What happens after you reach out.
Five steps, no sales cycle. We take on one new firm at a time, so the first two steps are about fit: yours and ours.
Fit call
Twenty minutes to confirm headcount, Microsoft 365, and the rule you answer to. If Alden is not the right fit, we say so and point you toward someone who is.
Agreement and kickoff
One agreement with every price for your headcount, and $995 to start. Then thirty minutes with your principal, CCO or office manager to agree scope, access and the readout date.
Assessment
Tenant, devices, vendors and written program reviewed and scored against your rule and your insurer's application.
Readout
Findings report and remediation plan walked through with your principals and, if you have one, your CCO or consultant.
Continue or stop
Onboarding starts and the balance is invoiced, unless you tell us to stop. Stop, and the report is yours to act on with whoever you choose.
Start with the assessment.
The assessment shows where your firm stands against your rule and your insurer's expectations. It costs $995, counts toward onboarding, and you can stop at the readout with the report in hand. It starts with a 20-minute call.
How we describe our work
Alden's assessments are point-in-time observations against named standards. We build and operate controls and produce the evidence behind them. We do not audit or certify your firm, and we do not provide legal advice. Your firm reviews and signs its own attestations. Regulators and insurance carriers make their own determinations; our work supports insurability and exam readiness, it does not guarantee either. Our controls reduce the likelihood and impact of the attacks described; no control prevents all of them.