Cybersecurity services
Harden the environment. Prove the controls.
Technical security services that reduce real-world risk and produce the documentation examiners and auditors commonly request, delivered through hands-on engineering rather than recommendations alone.
Firewall Security
Perimeter and internal segmentation controls are among the first things examiners and auditors review. We assess, harden, and document firewall configurations so they enforce least-privilege network access and match your network security policy.
What we do
- Rule base review to identify overly permissive, redundant, and unused rules
- Segmentation design for servers, user networks, guest wireless, and management interfaces
- Secure remote access VPN configuration with multi-factor authentication
- Review of firmware currency and intrusion prevention and threat-prevention features
- Administrative access hardening and configuration backup
What you receive
- Firewall configuration assessment with prioritized findings
- Documented rule base with business justifications
- Network diagrams that reflect actual segmentation
Vulnerability Management
Running a scan is easy. Managing vulnerabilities to closure is not. We build repeatable programs that find weaknesses, rank them by real-world risk, and track remediation through verified closure.
What we do
- Authenticated internal and external vulnerability scanning
- Risk-based prioritization that weighs exploitability and asset criticality
- Remediation tracking with defined ownership and timelines
- Rescanning to verify fixes and document closure
- A formal risk-acceptance process for issues that cannot be remediated immediately
What you receive
- Vulnerability management procedure aligned to your policy
- Recurring scan and remediation reporting
- Documented risk acceptances with management approval
Endpoint Protection
Workstations and servers are where most attacks land. We deploy and tune endpoint protection and apply hardening baselines so devices resist compromise and produce useful signals when something goes wrong.
What we do
- Endpoint detection and response (EDR) deployment and policy tuning
- Secure configuration baselines informed by CIS Benchmarks
- Reduction of local administrator rights and application control
- Device encryption and removable media controls
- Coverage reporting to identify unprotected or noncompliant devices
What you receive
- Endpoint security standard and baseline documentation
- Agent coverage and health reporting
- Tuned detection and alerting policies
Patch Management
Unpatched systems remain one of the most common causes of both compromise and audit findings. We establish patching processes for operating systems, third-party applications, and network devices, with reporting that shows they are working.
What we do
- Patch policy, severity-based timelines, and maintenance windows
- Operating system and third-party application patching
- Firmware and network device update planning
- Compliance reporting measured against your defined timelines
- Exception handling for legacy and vendor-restricted systems
What you receive
- Patch management procedure
- Monthly patch compliance reporting
- Documented exceptions with compensating controls
Security Monitoring
Effective monitoring means the right events are collected, alerts are meaningful, and someone is clearly responsible for acting on them. We design and configure monitoring that fits the size and risk profile of your organization.
What we do
- Centralized log collection from firewalls, servers, endpoints, and Microsoft 365
- Alert configuration and tuning to reduce noise
- Documented log review procedures and escalation paths
- Log retention aligned to your policy and applicable requirements
- Integration with a managed detection and response provider where round-the-clock coverage is required
What you receive
- Monitoring architecture and log source inventory
- Alert handling and escalation runbook
- Log review evidence for examinations and audits
Coverage is defined, not implied. SEDSGA does not operate a 24/7 security operations center. Monitoring scope, review schedules, and response responsibilities are documented in writing for every engagement.
Microsoft 365 Security
For many organizations, Microsoft 365 holds email, files, and user identities, which makes it a primary target. We harden tenant configurations against phishing, account takeover, and data loss.
What we do
- Multi-factor authentication and Conditional Access policy design
- Email authentication with SPF, DKIM, and DMARC
- Microsoft Defender for Office 365 policy configuration
- Audit logging, alert policies, and administrative role review
- Data loss prevention and external sharing controls
- Microsoft Secure Score review with prioritized improvements
What you receive
- Tenant security assessment
- Documented configuration baseline
- Identity and privileged access review results
Feature availability depends on your Microsoft licensing. Recommendations account for what you already own before suggesting additional licenses.
Incident Response Planning
When an incident happens, decisions made in the first hours matter. We help you build a plan your team can actually execute, including the regulatory notification considerations specific to financial institutions.
What we do
- Incident response plan development and updates
- Scenario playbooks for ransomware, business email compromise, and data exposure
- Tabletop exercises with management and technical staff
- Notification planning, including the federal banking agencies’ computer-security incident notification rule, which generally requires notice to the primary federal regulator within 36 hours of determining that a notification incident has occurred
- Coordination planning with cyber insurance carriers, legal counsel, and forensic providers
What you receive
- Incident response plan and scenario playbooks
- Tabletop exercise report with lessons learned
- Contact and escalation lists
Incident response planning supports, but does not replace, legal counsel. Regulatory and customer notification decisions should involve your attorneys.
Framework alignment
How this work maps to NIST CSF 2.0.
Each service supports specific outcomes in the NIST Cybersecurity Framework, making it easier to show examiners and auditors how technical work connects to your information security program.
| Service | CSF functions | Example categories |
|---|---|---|
| Firewall security | Protect, Detect | PR.IRTechnology Infrastructure Resilience DE.CMContinuous Monitoring |
| Vulnerability management | Identify | ID.RARisk Assessment |
| Endpoint protection | Protect, Detect | PR.PSPlatform Security DE.CMContinuous Monitoring |
| Patch management | Protect, Identify | PR.PSPlatform Security ID.RARisk Assessment |
| Security monitoring | Detect | DE.CMContinuous Monitoring DE.AEAdverse Event Analysis |
| Microsoft 365 security | Protect | PR.AAIdentity Management, Authentication, and Access Control PR.DSData Security |
| Incident response planning | Respond, Recover | RS.MAIncident Management RC.RPIncident Recovery Plan Execution |
Next step
Not sure where to start?
A focused review of your firewall, endpoints, and Microsoft 365 tenant is often the fastest way to find high-impact improvements.
or email wes@sedsga.net