Security is a practice, with clear responsibilities.

Principles that guide our work

These principles describe our approach to planning and scoping work. The safeguards, responsibilities, and evidence for your environment are agreed for each engagement.

Purposeful access

Give people and systems the permissions they need for their role. Favor multi-factor authentication, separate administrative access, and deliberate account changes when people join or leave.

Separation and careful handling

Plan separate access boundaries and credential handling for each customer. Agree on appropriate access and secure channels before sharing sensitive information. Public inquiries should contain only general business context.

Accountable changes

Document responsibilities and meaningful changes. Consider auditability, rollback, and vendor access as part of system design rather than leaving them until something goes wrong.

Recovery that can be evaluated

Discuss which systems and information matter most. Review backup coverage, restoration steps, and how recovery can be tested against agreed objectives.

Responsible vendor choices

Consider access, information handling, maintenance, and recovery implications when selecting or integrating a service.