Guides · 50
Guides
Step-by-step guides and policy templates for Microsoft 365, Google Workspace, email security, AI use and incident readiness.
- GuidesManaged ITA baseline set of Conditional Access policiesMost small and mid-sized Microsoft 365 tenants need only a handful of well-tested Conditional Access policies.
- GuidesManaged ITA modern password policy (NIST-aligned)Many password policies still demand a capital letter, a number, a symbol and a change every 90 days. The U.S.
- GuidesCyber ForensicsA payment verification procedure to stop wire fraudMost payment fraud is not a technical failure. It is a convincing request that skips a step.
- GuidesPrivacy & AIA vendor security questionnaire for small organizationsTwenty questions that tell you whether a vendor can be trusted with your data, how to read evasive answers, and how to turn the answers into contract terms.
- GuidesPrivacy & AIAI acceptable use policy: what to includeStaff are already using generative AI tools. A short, clear acceptable use policy tells them which tools are approved, what information must never go in, who is…
- GuidesPrivacy & AIAI meeting notetakers: privacy and confidentiality risksAI notetakers join calls, record everything, and send summaries to everyone on the invite.
- GuidesManaged ITBacking up Microsoft 365: what Microsoft does and doesn't doMicrosoft keeps Microsoft 365 running. Getting your data back after a bad deletion, a departed employee or a ransomware attack is mostly your job.
- GuidesManaged ITBlocking legacy authentication in Microsoft 365Legacy authentication sends a username and password and nothing else, so MFA never gets a say.
- GuidesManaged ITBring your own device (BYOD) policy guideA BYOD policy has to do two jobs at once: protect company and client data on phones and laptops the company doesn't own, and tell employees honestly what the company can…
- GuidesManaged ITBuilding a device compliance baseline with IntuneA compliance policy answers one question about every laptop and phone: is this device safe enough to open company data?
- GuidesPrivacy & AIBuilding a records retention scheduleKeeping everything forever feels safe until a breach exposes ten years of client files, or a litigation hold has to search all of it.
- GuidesManaged ITBuilding a security awareness program that changes behaviourAn annual video and a quiz do not change what people do when a convincing email arrives at 4:55 p.m. on a Friday.
- GuidesManaged ITConfiguring Defender for Office 365 anti-phishing, Safe Links and Safe AttachmentsDefender for Office 365 does little for users who aren't covered by a policy, and Microsoft's Standard and Strict presets are off until someone turns them on.
- GuidesCyber ForensicsControlling OAuth app consent in Microsoft 365Consent phishing doesn't steal a password. It tricks a user into clicking 'Accept' on a real Microsoft permission prompt for an attacker's app, which then reads mail and…
- GuidesManaged ITControlling third-party app access in Google WorkspaceEvery 'Sign in with Google' button and every add-on that asks to 'see, edit and delete your Drive files' is a third-party app with a token to your data.
- GuidesPrivacy & AIData classification policy for small organizationsA simple four-level scheme, with handling rules for each level, lets staff make the right call on sharing, storage and email without a manual, and maps straight onto…
- GuidesCyber ForensicsDeepfake voice and video fraud against businessesFraudsters can now clone an executive's voice from a few public clips and appear as familiar colleagues on a video call.
- GuidesManaged ITEmployee offboarding security checklistMost access problems after someone leaves come from process gaps, not technology: nobody told IT, a shared password wasn't changed, or a laptop came back weeks late.
- GuidesManaged ITEmployee onboarding security checklistThe first week sets habits that last years. If a new hire gets admin rights "just to get started", skips MFA because IT was busy, or never hears how to report a…
- GuidesManaged ITEnforcing 2-Step Verification and security keys in Google WorkspaceTurning on 2-Step Verification in Google Workspace takes a few clicks.
- GuidesCyber ForensicsFinding and blocking malicious mailbox forwarding rulesAfter an attacker gets into a mailbox, one of the first things they do is set up a rule: forward anything mentioning 'invoice' to an outside address, or move replies…
- GuidesPrivacy & AIFinding the AI tools your staff already useBefore you can write a sensible AI policy, you need to know what is already in use.
- GuidesPrivacy & AIGetting started with sensitivity labelsSensitivity labels tell people, apps and Copilot how sensitive a document or email is, and can enforce encryption and access rules that travel with the file.
- GuidesManaged ITGmail and Yahoo bulk sender requirements explainedSince February 2024, Gmail and Yahoo have required anyone sending to their users to authenticate mail, keep complaints low, and make unsubscribing easy.
- GuidesLegal TechnologyGoogle Vault retention rules and holdsGoogle Vault is Workspace's built-in tool for keeping, preserving and exporting data.
- GuidesLegal TechnologyHow to instruct a digital forensics expertA practical guide for lawyers: what to check before retaining, what to put in the instruction letter, how to hand over evidence, and how scope drives both cost and the…
- GuidesManaged ITHow to read DMARC aggregate reportsDMARC aggregate reports are XML files from Gmail, Microsoft, Yahoo and others telling you who sent mail using your domain and whether it passed.
- GuidesCyber ForensicsInvestigating incidents with the Google Workspace investigation toolWhen something goes wrong in Google Workspace, the evidence is in the alert center, the audit and investigation logs and, on higher editions, the security investigation…
- GuidesCyber ForensicsInvestigating suspicious sign-ins in Microsoft EntraA strange sign-in alert, a user who says 'I didn't approve that', or a client who received an odd email from your domain: each starts in the Entra sign-in logs.
- GuidesManaged ITLocking down SharePoint and OneDrive external sharingOut of the box, Microsoft 365 lets staff share files with almost anyone. That is convenient until a confidential folder link turns up in the wrong inbox.
- GuidesCyber ForensicsManaging vendor and MSP remote accessThe software vendor who supports your accounting system, the copier company, the IT provider: each may be able to reach into your network.
- GuidesLegal TechnologyMicrosoft 365 litigation hold and content search for law firms and legal teamsHow Microsoft 365 preserves and finds content for legal matters in the current Microsoft Purview eDiscovery experience: holds versus retention, creating a case and hold…
- GuidesManaged ITOffboarding a user in Microsoft 365 the right wayDeleting a departing employee's account is the fastest way to lose their email, their files and any evidence you might later need.
- GuidesCyber ForensicsOut-of-band communications and incident call treeWhen an attacker is inside your email or Teams, using them to coordinate the response tells the attacker your plans.
- GuidesManaged ITPhishing-resistant MFA and passkeys in Microsoft 365Text codes and app approvals stop password guessing, but they don't stop a convincing fake sign-in page that relays everything in real time.
- GuidesManaged ITProtecting admin accounts in Microsoft 365An attacker who gets a Global Administrator session owns the tenant: every mailbox, every file, every setting, and the audit trail.
- GuidesManaged ITProtecting company data on personal phones with Intune app protectionMost staff will not hand their personal phone over to company management, and they shouldn't have to.
- GuidesManaged ITQuarterly user access review checklistAccess only ever grows. People change roles and keep their old permissions, guests from finished projects linger, and an admin account created for a one-off job is still…
- GuidesManaged ITRemote and hybrid work security policyWhen work happens at kitchen tables, in cafés and at the cottage, the office firewall and the locked file room no longer protect you.
- GuidesManaged ITRolling out DMARC from p=none to p=rejectPublishing a DMARC record is easy. Getting to p=reject without blocking your own invoices, newsletters and payroll notices takes an inventory, some careful DNS work and…
- GuidesPrivacy & AISecure file sharing with clientsTax returns, medical notes, settlement drafts and payroll files still travel as email attachments every day. Most of the time nothing goes wrong.
- GuidesManaged ITSecuring QuickBooks Online and cloud accounting appsYour accounting platform holds bank connections, vendor payment details, payroll and customer lists. It is a direct line to your money, and criminals know it.
- GuidesManaged ITSecurity defaults vs Conditional Access in Microsoft 365Both switch on multifactor authentication and block old sign-in protocols.
- GuidesPrivacy & AISetting up Microsoft Purview retention policies and labelsRetention in Microsoft 365 decides what must be kept and what should be deleted. It is not a backup.
- GuidesCyber ForensicsThe first 72 hours of a cyber incidentA practical, hour-by-hour view of a cyber incident response: what your team, your responder, your lawyer and your insurer each do, and the decisions that shape the…
- GuidesManaged ITUsing Microsoft Secure Score without chasing pointsSecure Score is a useful to-do list and a poor report card. Used well, it points you at the identity and email controls that stop real attacks.
- GuidesCyber ForensicsUsing the Microsoft 365 audit log in an investigationAlmost every Microsoft 365 investigation comes down to the audit log: who signed in, what they read, which rule they created, what they sent.
- GuidesCyber ForensicsWhat a post-incident attestation letter can and can't sayAfter an incident, clients, partners and insurers often ask for a letter confirming you are safe.
- GuidesCyber ForensicsWorking with your cyber insurer after an incidentYou have had an incident and you have cyber insurance. This guide covers what to check in the policy, how vendor choice works, what evidence the claim will need, and the…
- GuidesCyber ForensicsWriting an incident response plan that works for a small organizationA usable incident response plan is short enough to read under stress and specific enough to act on.
Incident line · 24 hours, 7 days
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.