Microsoft 365 contains important security controls, but the presence of a licence does not mean those controls have been configured or are being managed. A security plan turns the available technology into an agreed way of protecting accounts, devices and business information.
Begin with the current position
Before adding tools, establish what the business already has. That includes the licences assigned, administrator accounts, sign-in controls, email protection, managed devices and any settings introduced by a previous provider.
This avoids paying twice for similar capability and prevents important gaps being hidden by a long list of products.
Build a consistent security baseline
A baseline is the minimum agreed position across Microsoft 365. It may cover areas such as:
- multi-factor authentication and secure sign-in;
- appropriate administrator access;
- email protection and domain settings;
- company-device configuration and protection;
- account changes when employees join, move or leave; and
- separate backup for important Microsoft 365 information.
The exact controls should match the licences, risks and working practices of the business.
Decide what needs continuous attention
Some controls are configured and then reviewed regularly. Other security activity needs to be watched continuously. The plan should explain whether the business needs 24/7 monitoring, who investigates alerts and what response can be taken when a genuine threat is confirmed.
Give every action an owner
A plan fails when nobody knows who is responsible. The support provider, security monitoring team and client should each understand what they manage, which decisions require approval and who must be contacted during a serious incident.
Review the plan as the business changes
New employees, licences, applications and working practices change the risk. The plan should be reviewed at agreed intervals and after a significant project or incident.
baseMSP uses an initial three-month review followed by six-month reviews to discuss the support service, the Microsoft 365 roadmap and any new priority.
Turn the plan into proportionate action
The goal is not to buy every available security service. It is to understand the gaps, consider the benefit and choose what is proportionate for the business.
The free Microsoft 365 security review provides that starting point. Our Microsoft 365 Security service adds continuous monitoring when the risk and requirement justify it.
Further reading
Microsoft publishes current Microsoft 365 security guidance for small and medium-sized businesses.
