OUTSOURCED IT

Secured | Managed Services Provider

IT Services | With a Secure Foundation and Support

A modern cloud IT solution managed by SSO and powered by Microsoft, built specifically for small and medium sized businesses.

S-MSP Services are best for:

• US-based businesses with 20 to 300 users that want to provide a modern, highly secure and collaborative IT services and management platform for each member of their team.

• Businesses that want a modern cloud-based approach to IT services, security, support, disaster recovery, strategy and management.

• IT managers that want to offload the day-to-day management and support, so they can focus on business projects and work with a partner that has the training, experience, processes and systems to support an enterprise cloud-based system.

Imagine outfitting your valuable employees for which you have a monthly investment in the $5,000 to $10,000+/month range, with the latest, most modern data systems, prompt highly trained helpdesk support, a training system so they can use the most modern IT tools, a proactive security and systems management process, and a V-CIO & V-CISO to align your technology & security with your business strategy.

THAT – is the REAL IT that you need for your business.

With the SSO | S-MSP your team will get more done with less stress, less emails and less meetings, collaborate better, be more innovative, and your company will look very impressive to potential hires.

SSO can help get you to where you need to be.

Secured-IT Options to fit wherever your business is at and to scale to where your business will grow:

All Our Secured-IT Services Are Built On SSO’s:

Inventory:

Simply put, you cannot secure what you don't know you have. Security starts with inventory.

You can't tell if you've lost something if you don't keep track of when you got it, what you did with it, who has it, and where it is.

Inventory of each of the five elements is the most basic foundation of the Five Point Secured-IT Framework. 

Inventory basically evolves through three phases:

1. Static Inventory

2. Active Inventory

3. Proactive Inventory

It starts simple, and then iterates until it becomes more complex but more effective as well. The objective is to achieve "Continuous Inventory" using a proactive inventory solution.

Map to the inventory requirements / controls in the CIS-20 CSCs:

• HW Inventory CSC-01

• SW Inventory CSC-02

• Credentials Inventory CSC 04-01

• Data Inventory CSC 13-01

• Staff Inventory CSC 17

Governance

Governance mandates what we are supposed to do, and even required to do, in an IT environment and in a company - it's the guidance we follow when we take action. Governance often comes in the form of written policies.

• Policies identify what data is important and what data is not.

• Policies tell us what data we are supposed to secure and how significantly we are supposed to secure it.

• Policies give us guidance as to who should and who should not have access to sensitive data.

• Policies give our staff guidance on what is appropriate behavior and what is not.

Budget:

We can't meet the guidance of the Governance if we don't have the budget to install and maintain the controls mandated by policy. Governance is leveraged to help develop the budget to protect what needs to be protected most, and then the next important thing, and the next on down the line. The highest risk Hardware, Software, or Data should receive the strongest security protection. Often, staff is considered the highest risk and security training becomes the earliest control implemented in the company as a result.

In order to develop a budget, the security options must be well-researched, well understood and proven by the security implementation team. In the absence of these factors the risk to maintain successful cost control is high.

We develop planning with the focused intent to protect the most important data first, and the less important data after that must be well understood. With knowledge of the cost of the security solutions to implement the security controls to protect the data, a single security remediation effort can be planned or an iterative effort can be planned over several, well organized and risk driven iterations. In some cases the iterative approach is preferable so the budget can be spread across several iterations. During budget planning it is very important to understand the upfront non-recurring engineering costs, and the recurring subscription costs of security solutions, but also operating costs of those solutions. Someone has to monitor and maintain the security solutions and in many cases respond to alerts and indications generated by the security tools. This budget must also be planned accordingly.

Security:

Once we have a budget, we can begin to work on the security remediation plan to close the gaps identified during the assessment by installing effective security solutions.

In general, we implement security to drive down risk starting from the highest risk and work to lower risk. Not everything can be secured to the maximum extent - it's just not feasible or affordable to do so. As a result, the primary approach is to secure what you can and drive down your risk to meet your "risk appetite" - the level of risk acceptable to your company, and then transition the residual risk through cyber insurance.

In many cases it is valuable to map the required security controls to a well-known standard such as the CIS-20 CSCs (Center for Internet Security 20 Critical Security Controls). When this is done properly, your security provider will have a set of well developed, mature security solutions to implement the security controls defined by the standard.

Process:

The fifth aspect, Process, addresses to primary categories:

• The processes to define, install, configure, test & verify IT components and the security configurations and controls

• The process to iterate and update the framework across all the elements

All things in IT and Cyber Security change continuously. Modifications are made to systems and sometimes patches or modifications are not properly implemented - sometimes things get missed. Staff members come and go and people enter and leave security groups.

A Process must be defined that calls for a periodic Assessment, Feedback, and Improvement, which is critical to maintaining a successful Secured-IT environment.

The results of assessing are fed back for continuous improvement. This is the mark of a mature and effective organization.