Answer the renewal questionnaire with evidence, not guesses.
Carriers no longer take your word for it. The Review maps every questionnaire item to what actually exists in your Microsoft 365 or Google Workspace tenant, so you answer honestly and your broker places a cleaner risk.
Read-only access. Zero disruption. You keep every deliverable, whoever runs your IT afterward.
Carriers now require evidence, not checkboxes.
Underwriters expect MFA everywhere, endpoint detection on every device, tested and isolated backups, same-day offboarding, and a written incident-response plan. A misstatement on the questionnaire is grounds for a denied claim when you need the policy most.
| Control | What underwriters actually ask | The gap we see most |
|---|---|---|
| MFA everywhere | “Is MFA enforced for all users, all remote access, and all admin accounts?” | The exceptions: legacy protocols, service accounts, that one executive who opted out. |
| Endpoint detection (EDR) | “What percentage of endpoints run EDR, and who monitors the alerts?” | Coverage gaps on field laptops and unmanaged devices; alerts nobody reads. |
| Backups, tested and isolated | “When was your last successful restore test? Are backups immutable or offline?” | Backups that run nightly and have never once been restored. |
| Access lifecycle | “How quickly is access removed when someone leaves?” | Accounts that outlive employment by months. |
| Email security | “What phishing and spoofing protections are configured?” | Defaults from three years ago, never revisited. |
| Incident-response plan | “Who is notified, in what order, and where is it written down?” | A plan that exists only in the questionnaire answer. |
Why this is an ownership problem.
Every row above fails the same way: not for lack of tools, but because the control lives in the gap between the MSP, the security vendor, and “whoever set that up.” The questionnaire forces the question your operation should have answered already: who owns each control, and can they prove it works?
Three deliverables. Yours to keep.
If you want the questionnaire answered with evidence rather than a conversation, this is the packaged engagement. You keep every deliverable, whoever runs your IT afterward.
1 · Security Baseline Report
Your environment measured against the controls insurers actually check: MFA coverage, endpoint protection, backup verification, admin hygiene, access sprawl. Each rated in place, partial, or missing.
2 · Questionnaire Mapping
Your actual renewal questionnaire, mapped line by line to the evidence in your tenant: what you can answer honestly today, and exactly what closing each gap takes.
3 · License & Priority Roadmap
What you are paying Microsoft or Google for and not using, plus a ranked fix list: five items maximum, sequenced by risk per dollar. Not a forty-page wall.
One fixed fee.
Credited if you stay.
Published up front, scoped by headcount, and credited in full toward onboarding if you become a managed client within 90 days.
$2,500 for 76–150 users. Either fee is credited in full toward onboarding if you become a managed client within 90 days.
- Read-only access to your tenant
- Ten business days, zero disruption
- All three deliverables, yours to keep
- Works alongside your current IT provider
Keep them.
The report either validates their work or hands you a specific list to ask of them. Both are good outcomes.
Nothing in the Review requires changing who runs your IT.
See managed IT pricingA renewal on the calendar and a questionnaire nobody can answer with confidence.
- 30 to 150 people on Microsoft 365 or Google Workspace, with a renewal in the next few months.
- Leadership that wants the honest answer before the broker does, not a questionnaire filled in from memory.
- Companies with an existing MSP or internal IT who want an independent check on the controls insurers ask about.
- Teams considering managed IT who would rather start with a fixed-scope project than a sales conversation.
We will not attest to controls that do not exist.
A misrepresented questionnaire voids coverage exactly when you need it. The Review tells you what is true today and what it takes to make the rest true.
Three things the Review never does.
- No attestation without evidenceIf a control is partial or missing, the report says so, and says what closing it takes.
- No changes to your environmentRead-only access. Nothing is reconfigured, migrated or switched off during the Review.
- No forty-page wallA ranked fix list of five items maximum, sequenced by risk per dollar.
Read-only access. Ten business days. Zero disruption.
Read-only access
You grant read-only access to your Microsoft 365 or Google Workspace tenant and share the renewal questionnaire. Nothing in your environment changes.
Ten business days
We measure your environment against the controls insurers check and map your actual questionnaire, line by line, to the evidence in your tenant.
Report and walkthrough
You get the Security Baseline Report, the Questionnaire Mapping and the License & Priority Roadmap, and we walk you through them in plain language.
The 90-day path to a clean renewal.
A renewal deadline is the most useful forcing function your security posture will ever get. Use it.
- Days 1–15: inventory reality: every account, device, backup job, and exception. The gaps list writes itself.
- Days 15–45: close the big four: MFA exceptions eliminated, EDR to full coverage, one restore test performed and documented, offboarding made same-day and automatic.
- Days 45–75: write the incident-response plan around named people, and run one tabletop walkthrough so it is real.
- Days 75–90: assemble the evidence pack: screenshots, reports, test records, so the questionnaire takes an afternoon instead of a scramble.
Tell us what needs an owner.
What is growing, what is breaking, and where you keep chasing answers across vendors. We will start there.
Prefer to just pick a time?
Book a Meeting →