Defend
The evidence file
An insurer, a client or an auditor asks how your firm is protected, and the answer is a file that already exists: what protects you, written down as it is, kept current.
Evidence, not assurances.
Before a corporate client instructs you, its security questionnaire arrives. Before your insurer renews, it asks about multi-factor sign-in, admin accounts, backups and your incident plan. Before an auditor or your supervisor signs off, it wants records. “We think so” isn’t an answer to any of them, and a file written the night before is a guess with a cover page. The evidence file is the opposite: one file that holds what protects your firm, as it is set up, with the date it was last checked, kept current by the team that runs your IT. When someone asks, you hand it over. Evidence by default: the file is ready before anyone asks.
What it holds
Six sections, each written from the systems themselves.
Every section is drawn from how your IT is actually set up, not from what someone remembers. When the setup changes, the file changes with it.
-
Devices and servers
Every laptop, workstation and server, with its protection and patch level, from the management and monitoring that see them every day.
-
Sign-in rules
Multi-factor sign-in, conditional access and admin roles, as they’re set up in Microsoft Entra ID, with their exceptions and the date they were last reviewed.
-
Access and admin rights
Who can open what, from the last access review. Who holds admin rights, that their passwords sit in the vault, and that every use is logged. Our engineers’ access included.
-
Data location
Where your data lives, service by service, so a client’s question gets a page, not a guess.
-
Backups and restore tests
What’s backed up, where the copies live, how long they’re kept, and when a restore was last tested, with its result.
-
Incidents and questionnaires
What happened, what we did and what we changed, for every incident. And your insurer’s and your clients’ questionnaires: answers that are true today, and the gaps we closed to get there.
On record
What makes it stand up.
- The date and author of each section’s last check
- The change log: what changed in the file, when, and by whom
- The complete copy you keep, handed over if you ever leave us
The evidence file is the record every other Defend page ends in. This page is where it all lands.
What usually goes wrong without it.
-
Written the night before
The questionnaire is due Friday. Someone reconstructs on Thursday how things are probably set up. The answers describe a firm that doesn’t quite exist, and a claim later finds the difference.
-
Spread across five people
The backup answer is with one provider, the sign-in answer with another, the access list with the office manager. Nobody can hand over one picture, so the client gets five emails.
-
True once, never again
The file was accurate at the audit two years ago. Since then a policy was switched off, an admin was added and a backup moved. The file still says what it said.
Also under Defend
- Email security Spam, phishing and malware filtered out before a mail reaches anyone, with long-term archiving.
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Who asks for an evidence file, and when?
Corporate clients before they instruct you, through their security questionnaires. Cyber insurers at renewal and after a claim. Auditors and, for financial firms, the supervisor and investors’ due diligence. Each asks in its own words; the file answers all of them from the same record.
How is it kept current?
It’s written from the systems themselves and by the team that runs them. When a rule changes, a restore is tested or an access review is done, the section changes with it, with the date. It’s never rewritten before a renewal, because it doesn’t have to be.
Can we see it, or only hand it over?
It’s yours. You can read it at any time, and your TechPilot goes through it with you, on request or in your steering meeting: what’s protected, what’s open and what it would cost to close. If you ever leave us, it goes with you.
Does it name the security products you use?
In the file, yes: you see what protects each device and account. On our website, no: a published list would tell attackers what to look for. The file is for you and the people you choose to show it to.
Start
What would you hand your insurer today?
In a first call we go through what you could show today, what an evidence file for your firm would hold, and where the gaps are.
- No first level
- No surprises
- Pilot before you buy