Somebody asked who can see your data. You could not answer.

It arrives attached to a customer security questionnaire, a Cyber Essentials renewal or an ISO deadline, and it has a date on it. We find out who can actually reach what across your Microsoft 365, and hand you the evidence to send back.

Get in touch →

Why you cannot answer it

£450

EXPOSURE REPORT TO START

Three

FRAMEWORKS MAPPED AND RATED

Evidence

NOT A CERTIFICATE

Microsoft keeps the answer behind a licence you do not hold

This is not a failure of your IT. The reporting that answers the question is a paid add-on, and the plan most organisations your size are on cannot buy into it.

What you are being asked

Who has access to our data, how is that access reviewed, what is shared outside the organisation, and how would you evidence any of it.

Where the answer lives

In SharePoint Advanced Management: permission state reports, sharing links reports, and site access reviews. It needs an E1, E3 or E5 base, and then a Copilot licence or the SAM Plan 1 add-on on top.

Why that is a wall

Business Premium and Business Standard do not qualify. If you are on Business Premium, the reporting you are being asked for is not something you can switch on.

What we do instead

We produce the equivalent from the Graph API and PnP, across the whole estate in one pass, with the exceptions named and counted rather than described.

Start with a report, and stop whenever you like

Every engagement starts with the same £450 report, because nothing above it can be quoted honestly until somebody has measured the estate.

Microsoft 365 Exposure Report

Sites, libraries, storage and how far permissions have spread. It sets the band, so everything after it is priced from measurement.

The Evidence Pack

Who can reach what, and the proof to hand whoever asked. Findings mapped to Cyber Essentials, ISO 27001 Annex A and a standard customer questionnaire, each control rated and cited.

Permissions Remediation

The oversharing closed, in tranches you approve, with a change log you keep.

Storage Trim

Version bloat and retention settings, where they are costing you money or hiding what matters.

DLP and Purview Setup

Controls that stop the next problem, rather than describing the last one.

Evidence Kept Current

The pack is true the day it lands and untrue within a quarter. This re-runs it and tells you what moved.

We are not a certification body. We issue no certificates and sign no statement of applicability. We produce the evidence your assessor asks for, and your assessor reaches their own determination. Every mapping in the pack carries that in writing, with the date it was true.

What it costs

Fixed price for the diagnosis, a day rate for the cure. We can predict a report. We cannot predict what is wrong inside your Microsoft 365 until we have looked, and we are not going to pretend otherwise in writing.

EXPOSURE REPORT

START HERE

£450

FIXED, PAID UP FRONT

What the estate actually looks like. Credited in full against The Evidence Pack if you go ahead within 30 days, so it costs you nothing to find out.

THE EVIDENCE PACK THE MAIN PIECE

£950 – £1,750

BAND SET BY THE REPORT

The findings, mapped to the framework your customer is asking about, each control rated met, partially met or not met, and every rating citing what it came from.

REMEDIATION MINIMUM TWO DAYS

£950 a day

PERMISSIONS, DLP AND PURVIEW

Quoted from findings you have already read and signed off. Nothing changes before that.

Storage Trim is £850 to £1,900 fixed, by band. Evidence Kept Current is £150 to £350 a month on a twelve month term, or £1,500 to £3,500 paid annually, and it needs The Evidence Pack first because it reports drift against that baseline. Bands are set by how many sites and libraries you have, not by headcount, and the report is what establishes which. If it puts you in a higher band than you bought, we re-quote before starting rather than after.

Nothing changes until you have read it and said yes

What we need from you: an admin account created for the engagement, and somebody who can answer questions about how the place is actually used.

Access

A named admin account for the engagement, carrying the two roles the work needs and Global Reader for the read-only stages. Removed on completion, and the removal recorded in the closing pack.

The report, then the pack

We collect, then we write. You get findings, not raw output, with the exceptions counted.

You sign off the findings

Remediation is quoted from a list you have already read. Nothing is touched before that signature.

Changes in tranches

With a named approver on your side and 48 hours between tranches, so anything that breaks surfaces while it is still small.

Some changes cannot be undone. Trimming old file versions bypasses the recycle bin, and a trimmed version is gone. Irreversible steps are approved line by line rather than in a batch, and they are labelled as irreversible before you agree, not afterwards. Reversible changes carry a documented rollback. Every change is logged before and after, and the log is part of what you are buying, because it is itself evidence.

Two things we turn down rather than guess at. Hybrid or on-premises SharePoint alongside your Microsoft 365, because it needs tooling we do not have and roughly doubles discovery. And any tenant under active legal hold or eDiscovery, because preservation blocks version trimming outright and touching permissions in the middle of a matter is a real risk. On-premises file servers we can scope, at the day rate, where there is an agent or a jump box we can run from.

Impending Tech

We build AI and data systems for organisations that cannot put their data in a public cloud. Most of the work is the assurance around them rather than the models themselves: impact assessments, audit trails that hold up when somebody checks them, and the evidence an assessor will actually accept.

We have been on the other side of it

We have taken organisations through ISO certification, which means assembling evidence for an auditor rather than only asking for it. That is the difference between evidence that holds and evidence that falls over when somebody actually looks.

We run it on ourselves

The same collection and the same pack, against our own Microsoft 365, before it goes anywhere near a client. If you want to know how we would treat your data, ask what we found in ours.

We are not your IT provider

We do not sell IT support and the pack does not comment on whoever does. If you have a managed service provider, they keep the relationship.

Tell us what you have been asked, and we will tell you whether the report would answer it.

If the answer is that you can already evidence it, that is a fine answer and it costs you one email.