Cyber and data security
Where you are exposed, in the terms a director has to think in: the records you hold, who can reach them, and the access routes an intruder would try first.
Managed Services
Switching IT provider, without the usual chaos
We take over IT support in nine stages, and you approve each one before we move to the next. You see the plan, the risks and the decisions in writing. Nothing gets ripped out, and your current provider is not stood down until the replacement has been tested.
Free Audit worth £800
An in-depth review of your IT that reports against six business safeguards: cyber and data security, resilience, efficiency, brand and customer protection, compliance and barriers to sale, and scalability and competitive advantage. Carried out remotely, with an on-site visit where your estate needs one.
Why switching providers goes wrong
Three things go wrong when an IT provider changes, and none of them are technical.
The first is discovery. Nobody writes down what is actually in the building, so week one is spent guessing which server does what and who still holds the administrator password.
The second is timing. A provider leaves on a Friday, the new one starts on Monday, and in between there is a gap where nobody answers for the backups.
The third is ownership. Licences, domains, phone numbers and vendor accounts sit in someone else's name, and getting them back takes longer than anyone planned.
Our process exists to remove those three problems before they cost you a working day.
The nine stages
Grouped into five phases so a busy reader can follow it. The stage numbers stay the same throughout, so we can talk about the same stage you can see.
Before you commit: understanding and agreement
1We listen first.
We learn about your business, your goals, objectives and challenges, talk through what an audit involves and what it covers, and give you one named person to deal with from that point.
2.1A Master Services Agreement with no commercial binding terms.
Before anyone touches a system we put our Master Services Agreement in place, covering confidentiality and data protection. At this stage it contains no commercial binding terms, so nothing you have seen so far commits you to buying anything.
The audit: what you actually have
2.2Microsoft 365.
Cloud security and configuration, tenant settings, licence position, admin roles, sign-in protection, mail and file sharing exposure. Read against the risk of unauthorised access to client and commercial data, and against the licences you are paying for but not using.
2.3Network, devices and inventory.
What is on the network, what it is, how old it is, how it is configured, and what is exposed. Judged on how much of it would stop the business if it failed, and what replacing end of life equipment would cost if it is left unrenewed.
2.4Software.
What is installed, what is licensed, what is unsupported, and what is no longer needed. Judged on spend you cannot justify, and on the exposure of running software the vendor no longer patches.
2.5Compliance and governance alignment.
How your current setup lines up with the obligations that apply to you, in plain language. Framed by what a client, insurer or tender will ask, and where your answer would be missing.
Findings reach you in writing. The audit tells you what is wrong and what it would take to fix it, but it does not authorise us to start fixing it.
Plan and terms
3.1Strategy and service plan.
An IT plan built around how your business and your regulatory obligations actually work, not a template.
3.2Consultation on audit, strategy and commercials.
We sit down with the findings and the plan and agree what is in scope, what is not, and what it costs.
4Service order agreement.
The commercial terms start here, once you have seen the audit and the plan. Nothing before this point binds you commercially.
The switch itself
5.1Backups established and verified before takeover goes ahead.
We set up Microsoft cloud, computer and server backups, then verify that coverage is real and run a recovery test where it is practical to do so before takeover proceeds. If a reliable backup or recovery cannot be established, we stop, explain why in plain English, and continue only on your written risk decision.
5.2A phased, scheduled takeover.
Agreed with your current provider, your third-party ISP and software vendors, with their information collected first. Agreed dates, agreed order, agreed rollback position.
5.3Your staff told properly.
A welcome email to your team explaining exactly how to reach support, so nobody has to guess or route a problem through a colleague.
6Named people on both sides.
A named lead in your team and a named lead in ours, working from one written takeover plan that shows milestones, next steps, risks, dependencies and the decisions waiting on you. Progress is reported to both leads at each milestone, so you are not chasing for updates. You can pause a milestone, and pausing it is not a problem.
7Independent takeover to the agreed plan.
We take services over against the signed agreement and the takeover plan, and review with your team at each milestone before the next one starts.
Making it work, then keeping it working
8.1Implementation of the IT strategy, with consultation first.
Changes are discussed with you before they happen.
8.2Staged, tested, with contingencies.
A planned project rather than a big-bang change: testing before deployment, a fallback position, and milestone reviews with your key people and ours. Identity and administrator security, multi-factor authentication, Conditional Access and device protection are part of this work, not an afterthought.
9Quarterly review, and the next round of improvement.
We review what is working and what needs improving, refer back to the strategy work at 8.1 where needed, and talk about recurring issues, business objectives and where technology can give you a commercial advantage.
What you approve, and when
| Stage | What you are approving |
|---|---|
| 1 | That an audit is worth doing, and who your contact is |
| 2.1 | The Master Services Agreement covering confidentiality and data protection, with no commercial binding terms |
| 2.2 to 2.5 | Authorised access and testing for the audit |
| 3.1 to 3.2 | The strategy and plan, and the scope and commercials |
| 4 | The service order |
| 5.1 | That backup coverage is verified and recovery has been tested before takeover proceeds, or a written risk decision if it cannot be |
| 5.2 to 5.3 | The takeover dates, order and staff communication |
| 6 | Your named lead, and the milestones and decisions in the plan you can pause |
| 7 | Each milestone, before the next one begins |
| 8.1 to 8.2 | Each implementation step, with consultation first |
| 9 | The quarterly review agenda and next improvements |
How we keep the business running during the switch
- Your existing coverage is not removed until the replacement has been tested. The old provider stays in place until the new one is proven.
- The takeover is phased and scheduled with you, not run as a single cut-over night.
- Anything that could interrupt you is listed in the plan with a named person responsible, the dependency behind it and a fallback if it goes wrong.
- You can pause a milestone. A pause is a decision, not a failure.
If something urgent turns up
This applies across the whole process, not to one stage. If we find active compromise, a backup that is failing, a licence or domain about to expire, or a critical outage, you hear from us the same day rather than at the end of an audit. The urgency is dealt with first, and the rest of the plan follows around it.
We will not tell you that switching carries no risk, because that would not be true of any provider. What we can tell you is where the risk sits at each stage, and who is dealing with it.
The health check and the full audit are two different things
We offer a free health check, and it is where many conversations start. It is a short look at what you already have, enough to tell you whether a bigger problem is likely. The full audit is the work described here. It covers four areas in depth, it is scoped in advance, and there is no charge for it. We carry it out remotely, and on site where your estate needs it.
What we actually look at
The audit covers four areas: Microsoft 365 cloud security and configuration, your local network with devices and inventory, the software you run and licence, and how your current setup aligns with the compliance and governance obligations that apply to you.
Those four areas are the method. What you actually receive is a report on the safeguards below, in the language a director acts on, so nobody has to translate a technical finding into a business decision.
What the audit tells you about your business
Resilience
What keeps the business trading when a server, a line or a key person fails, and whether your backups are likely to restore on the day you actually need them. Downtime is a cash flow problem before it is a technical one.
Efficiency
Where time disappears into workarounds: duplicated data entry, manual handoffs, people waiting on a system that should have answered instantly. Worth counting in paid hours, not in features.
Brand and customer protection
What a data loss or an outage would do to the reputation you have spent years building, and which of your customers would find out first. Trust is the asset that takes longest to rebuild.
Compliance and barriers to sale
The obligations that apply to you, and the questions a client, insurer or tender will ask that your current setup could not answer. Compliance that blocks a deal is a commercial problem, not a paperwork one.
Scalability and competitive advantage
Whether the setup you have carries the growth you are planning or quietly caps it, and where technology could give you an advantage your competitors have not taken. Growth exposes weak foundations first.
What the audit is not
The audit is an assessment. It is not a repair service, not legal advice, and not a certificate of compliance. Finding a weakness does not authorise us to change anything, and an alignment assessment does not mean a regulator or an auditor will reach the same conclusion. If something needs fixing, you get the finding, the options and what the fix would cost, and you decide.
Who is accountable
Every takeover has a named lead in your business and a named lead in ours. They work from the same written plan, which records milestone status, risks, dependencies and the decisions waiting on you, and each milestone is reviewed with your team before the next one starts. You get the current plan and a plain answer on progress whenever you ask for one, and your lead is expected to raise problems with you before you notice them.
After the switch
Once the takeover is complete we stay close for a stabilisation period before routine service settles in, because the weeks straight after a change are when small issues surface and would otherwise sit unnoticed until a quarterly review. After that the relationship moves to scheduled quarterly reviews under stage 9.
Questions people ask before a switch
How long does it take?
It depends on what the audit finds and how many sites are involved. We agree the takeover dates with you after the audit rather than quoting a number before we know the estate.
Do we have to leave our current provider before you start?
No. That is the point of the phased approach. Your existing support stays in place until the replacement has been tested.
What if the audit turns up something serious?
You hear about it immediately, not in a report at the end. If it is urgent we deal with the urgency first and agree the rest afterwards.
Who owns our Microsoft 365 tenant, domains and phone numbers?
You do, and part of the handover work is making sure the ownership and administrator access sit with you rather than with a provider.
What happens to the equipment we already own?
It stays. If something genuinely needs replacing, you get a plain-English explanation of why before anything is bought.
Can we stop part-way through?
Yes. The commercial commitment begins at stage 4, and milestones can be paused.
Thinking about a change of provider?
If you are thinking about a change of provider, the first step is a conversation and an audit, not a contract. Tell us what is worrying you and we will tell you honestly whether the audit is worth your time.