Zero Trust
250 questions on identity, devices, network and data enforcement across a Microsoft estate.
250 controls · 9 pillars · 50 categories · assessed by people
250 questions on identity, devices, network and data enforcement across a Microsoft estate.
250 controls · 9 pillars · 50 categories · assessed by people
Zero trust is usually bought as a programme and then reported as finished. This assessment establishes what your organisation actually enforces at the four points where access is decided — who the person is, what device they are using, which path they came in on, and what the data itself permits — and where someone holding a stolen password would still get through. It applies if your identities, your laptops and your documents all sit inside one vendor's cloud platform, which is where most of the public sector and much of regulated finance now runs, and where NIS2 and DORA both expect enforced access control rather than a policy document.
250 questions across nine pillars and 50 categories: four identity pillars at 52, 20, 15 and 20 questions, a 7-question pillar on agent and workload identity, 36 on device and data-on-device management, 40 on the secure access edge, 24 on Azure network controls, and 36 on data governance and loss prevention. One network category deals with client deployment and licensing, so the assessment will tell you where a control you want depends on an entitlement you have not bought — useful before a renewal rather than after. There is no collector for this one, so budget for tenant policy exports done by hand; nothing is changed and no policy is switched on during the work.
Identity carries 69 theme-tagged questions: client secrets on app registrations, consent and delegation, emergency access accounts, phishing-resistant methods for administrators, Conditional Access policy shape, and device registration under hybrid join. Devices go at Intune tenant settings, compliance policies and app protection; the network pillars go at Global Secure Access client rollout, tenant restrictions, private access connectors and published applications, TLS inspection and web content filtering, then Azure DDoS Protection, Azure Firewall, and WAF policy on Application Gateway and Front Door. Data is Purview — sensitivity labels and label policies, auto-labelling, message encryption and retention, DLP, and insider risk and AI interaction controls.
250 controls across 9 pillars and 50 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Every score comes from an assessor reading the configuration with your administrators — Conditional Access and compliance policies, firewall and WAF rules, labels, auto-labelling and DLP — and recording the artefact beside the answer. There is no collector script for this assessment, because most of these controls are only meaningful in combination with the policies around them.
A policy in report-only mode and a policy in enforcement look much the same in an export, so the share of your real user population genuinely covered by a control is asserted by the administrator rather than measured.
Tenant governance, guest access and guest lifecycle run to 20 questions, which is what decides whether a contractor working from a partner tenant can see what they should not.
Public bodies that standardised on a single identity and productivity platform get the whole estate — identity, device compliance and label-based data handling — assessed in one pass instead of three.
The 40-question secure access edge pillar covers the private path to internal applications, which is the control most often asserted and least often verified when a DORA reviewer asks how remote access actually works.
Shared devices and high staff turnover put the weight on device compliance and session handling, and 36 device questions plus the 52-question identity and secrets pillar cover both ends of that.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is broad at 250 controls.
£4,500
Per engagement, excluding VAT.
£12,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.