My Client
A 40-person professional services firm operating across law and accounting, with a strong dependency on Microsoft 365, email, client documents, secure access, and reliable day-to-day IT support.
Executive Summary
My Client has a functional IT environment that supports day-to-day operations, but the current setup requires stronger structure, security, documentation, and forward planning.
Overall IT posture: Yellow
The environment is operational, but several areas need attention to reduce risk, improve consistency, and support future growth.
The immediate opportunity is to move from reactive IT support to a more proactive, documented, and roadmap-driven technology strategy.
Client Snapshot
The following snapshot summarizes the current business and technology context for My Client.
Professional Services
Law and accounting firm handling confidential documents, financial records, legal matters, tax information, and client communications.
40 Staff
A mix of partners, accountants, lawyers, administrative staff, and support users who depend on reliable access to email, documents, and business applications.
Microsoft 365
Email, Teams, SharePoint, OneDrive, Office applications, file collaboration, identity, and access control are central to daily operations.
Current Business Priorities
For a professional services firm, IT must support productivity, confidentiality, continuity, and predictable planning.
Legal, financial, tax, identity, and client records need to be protected from unauthorized access, accidental sharing, and cyber threats.
Users need reliable access to email, documents, applications, printers, scanners, and remote-work tools.
The firm needs stronger backup, recovery, device lifecycle, and incident response planning to reduce business disruption.
A visible roadmap will help the business understand what should happen now, what can wait, and what needs to be budgeted.
Initial vCIO Focus Areas
```Based on the client profile, the first vCIO review should focus on the areas most likely to reduce risk and improve business confidence.
Our first priority is to turn the current IT environment into a clear, documented, and manageable plan.
The audit will confirm the current state. The recommendations will define the options. The roadmap will show what happens next.
The following ICT Audit is designed to provide you with a complete status report of your ICT infrastructure. We use a traffic light system to identify the status of each Audit item. From here we can target the areas of improvement.
| Type | Status | Time Frame | Comments |
|---|---|---|---|
| Meets Requirements | |||
|
Core Internet Connectivity
Core Internet Connectivity |
Q3 Sep/2026
|
We found that Microsoft 365 is the primary productivity platform and is actively used by staff, which means the business has a stable foundation for email, collaboration, and document work, so we recommend continuing to monitor licensing, usage, and service health each quarter.
|
|
|
Endpoint Protection
Endpoint Protection |
Q3 Sep/2026
|
We found that endpoint protection is installed across the known business devices, which means the firm has a basic protection layer against common threats, so we recommend validating coverage, alerting, and policy consistency as part of ongoing security reviews.
|
|
|
Microsoft 365 Availability
Microsoft 365 |
Q3 Sep/2026
|
||
|
Remote Work Capability
Remote Work Capability |
Q3 Sep/2026
|
We found that staff can access key cloud services remotely, which means the business can support flexible work when required, so we recommend reviewing access controls and device compliance to ensure remote access remains secure.
|
|
| Medium Term Review | |||
|
Device Lifecycle
Device Lifecycle |
Q2 Jun/2026
|
We found that the device fleet includes mixed-age laptops and desktops, which means support effort, downtime risk, and replacement costs may become harder to predict, so we recommend creating a device lifecycle and warranty review plan.
|
|
|
Backup Coverage
Backup Coverage |
Q3 Sep/2026
|
We found that backup coverage has not yet been fully validated across Microsoft 365, endpoints, and business-critical data, which means the firm may not know exactly what can be recovered after deletion, ransomware, or system failure, so we recommend confirming backup scope, retention, and recovery testing.
|
|
|
Business Applications
Business Applications |
Q3 Sep/2026
|
We found that key business applications are used for legal, accounting, billing, and document workflows, which means application ownership, renewals, access, and vendor support are business-critical, so we recommend creating an application inventory and ownership register.
|
|
|
Email Security
Email Security |
Q3 Sep/2026
|
We found that email security controls need further validation, which means the firm may have increased exposure to phishing, spoofing, or impersonation attempts, so we recommend reviewing SPF, DKIM, DMARC, mailbox rules, external forwarding, and anti-phishing policies.
|
|
|
Microsoft 365 Licensing
Microsoft 365 Licensing |
Q3 Sep/2026
|
We found that Microsoft 365 licenses appear to be assigned inconsistently, which means the firm may be overspending or missing required security features, so we recommend reviewing licensing against user roles and business requirements.
|
|
|
Network Documentation
Network Documentation |
Q3 Sep/2026
|
We found that network documentation requires improvement, which means troubleshooting and change management may take longer than necessary, so we recommend documenting the firewall, switches, Wi-Fi, internet services, and key network dependencies.
|
|
|
Printer and Scanner Workflow
Printer and Scanner Workflow |
Q3 Sep/2026
|
We found that printing and scanning remain important to document-heavy workflows, which means unreliable or poorly documented devices may affect productivity, so we recommend reviewing device age, support arrangements, scan destinations, and secure print requirements.
|
|
|
SharePoint and File Permissions
SharePoint and File Permissions |
Q3 Sep/2026
|
We found that document storage and permissions require review, which means confidential client files may be harder to govern and staff may be unsure where the correct version of a document lives, so we recommend reviewing folder structure, access permissions, and external sharing settings.
|
|
| Urgent Review | |||
|
Admin Account Controls
Admin Account Controls |
Q3 Sep/2026
|
We found that administrator access has not been fully reviewed or separated from standard user activity, which means a compromised account could create a wider business impact, so we recommend reviewing admin roles, reducing unnecessary privileges, and implementing dedicated admin accounts.
|
|
|
Incident Response
Incident Response |
Q3 Sep/2026
|
We found that there is no confirmed incident response process, which means the firm may lose time and clarity during a security event or major outage, so we recommend creating a simple incident response plan with roles, escalation paths, communication steps, and recovery actions.
|
|
|
MFA Enforcement
MFA Enforcement |
Q3 Sep/2026
|
We found that MFA is not fully enforced for all users, which means unauthorized access to email, documents, and client data is more likely if credentials are compromised, so we recommend enforcing MFA across all users and reviewing conditional access policies.
|
|
|
Microsoft 365 Backup
Microsoft 365 Backup |
Q3 Sep/2026
|
We found that Microsoft 365 backup is not clearly confirmed, which means deleted, corrupted, or encrypted mailbox and SharePoint data may not be recoverable to the level the business expects, so we recommend implementing or validating dedicated Microsoft 365 backup and restore testing.
|
|
|
Onboarding and Offboarding
Onboarding and Offboarding |
Q3 Sep/2026
|
We found that onboarding and offboarding processes are not fully standardized, which means new users may receive inconsistent access and former users may retain access longer than necessary, so we recommend implementing a documented joiner, mover, and leaver process.
|
|
|
Security Policies
Security Policies |
Q3 Sep/2026
|
We found that core security policies are not fully documented, which means the firm may struggle to demonstrate consistent security expectations to staff, clients, or insurers, so we recommend creating baseline policies for acceptable use, passwords, MFA, data handling, and incident reporting.
|
|
The following recommendations are designed to provide your business with solutions to the problems identified which match your budget and expectations using our unique 'SOLUTION BUILDER' approach.
| Status | Good | Better | Best | Client Preferred | |
|---|---|---|---|---|---|
| Active Directory | |||||
|
Remote Work Capability
Remote Work Capability |
Maintain current access
$1.00 One Time
$1.00 Per Year
|
Remote access review
$1,200.00 One Time
$1.00 Per Year
|
Secure remote work standard
$2,500.00 One Time
$200.00 Per Month
|
Remote access review
$1,200.00 One Time
$1.00 Per Year
|
|
| Data Protection and Business Continuity | |||||
|
Backup Coverage
Backup Coverage |
Backup scope review
$1,200.00 One Time
$1.00 Per Year
|
Backup validation and restore test
$2,500.00 One Time
$1.00 Per Year
|
Managed backup governance
$3,500.00 One Time
$450.00 Per Month
|
|
|
|
Incident Response
Incident Response |
Basic incident response plan
$1,500.00 One Time
$1.00 Per Year
|
Incident response package
$3,500.00 One Time
$1.00 Per Year
|
Incident readiness program
$6,500.00 One Time
$350.00 Per Year
|
Incident readiness program
$6,500.00 One Time
$350.00 Per Year
|
|
|
Microsoft 365 Backup
Microsoft 365 Backup |
Basic Microsoft 365 backup
$800.00 One Time
$240.00 Per Month
|
Microsoft 365 backup with restore validation
$1,500.00 One Time
$350.00 Per Month
|
Microsoft 365 recovery assurance
$3,500.00 One Time
$550.00 Per Month
|
Microsoft 365 recovery assurance
$3,500.00 One Time
$550.00 Per Month
|
|
| Information Governance and Business Process | |||||
|
Business Applications
Business Applications |
Application inventory
$1,200.00 One Time
$1.00 Per Year
|
Application risk review
$2,800.00 One Time
$1.00 Per Year
|
Application governance register
$4,500.00 One Time
$250.00 Per Year
|
Application governance register
$4,500.00 One Time
$250.00 Per Year
|
|
|
Onboarding and Offboarding
Onboarding and Offboarding |
Basic checklist
$1,000.00 One Time
$1.00 Per Year
|
Standardized access process
$3,000.00 One Time
$200.00 Per Month
|
Access governance program
$5,500.00 One Time
$350.00 Per Month
|
Standardized access process
$3,000.00 One Time
$200.00 Per Month
|
|
|
Security Policies
Security Policies |
Core policy starter pack
$2,000.00 One Time
$1.00 Per Year
|
Policy and staff guidance package
$4,000.00 One Time
$1.00 Per Year
|
Security governance pack
$6,500.00 One Time
$300.00 Per Month
|
|
|
|
SharePoint and File Permissions
SharePoint and File Permissions |
Permissions review
$1,500.00 One Time
$1.00 Per Year
|
Document governance cleanup
$4,000.00 One Time
$1.00 Per Year
|
Information governance program
$6,500.00 One Time
$400.00 Per Month
|
Document governance cleanup
$4,000.00 One Time
$1.00 Per Year
|
|
| Infrastructure and Device Lifecycle | |||||
|
Device Lifecycle
Device Lifecycle |
Asset and warranty review
$1,200.00 One Time
$1.00 Per Year
|
Endpoint standardization
$4,500.00 One Time
$320.00 Per Month
|
Managed lifecycle program
$6,500.00 One Time
$600.00 Per Month
|
|
|
|
Network Documentation
Network Documentation |
Network documentation review
$1,200.00 One Time
$1.00 Per Year
|
Network security cleanup
$3,000.00 One Time
$1.00 Per Year
|
Network resilience uplift
$5,500.00 One Time
$250.00 Per Month
|
Network security cleanup
$3,000.00 One Time
$1.00 Per Year
|
|
|
Printer and Scanner Workflow
Printer and Scanner Workflow |
Printer and scanner review
$750.00 One Time
$1.00 Per Year
|
Workflow cleanup
$1,800.00 One Time
$1.00 Per Year
|
Document workflow improvement
$4,000.00 One Time
$150.00 Per Month
|
Document workflow improvement
$4,000.00 One Time
$150.00 Per Month
|
|
| Productivity and Cloud Foundation | |||||
|
Core Internet Connectivity
Core Internet Connectivity |
Keep current service
$300.00 One Time
$1.00 Per Month
|
Connectivity review
$750.00 One Time
$1.00 Per Year
|
Internet resilience plan
$2,500.00 One Time
$200.00 Per Month
|
|
|
|
Microsoft 365 Availability
Microsoft 365 |
Continue monitoring
$1.00 One Time
$1.00 Per Month
|
Service health and usage review
$900.00 One Time
$1.00 Per Year
|
Microsoft 365 success program
$1,500.00 One Time
$250.00 Per Month
|
Microsoft 365 success program
$1,500.00 One Time
$250.00 Per Month
|
|
|
Microsoft 365 Licensing
Microsoft 365 Licensing |
License cleanup
$900.00 One Time
$1.00 Per Year
|
Role-based license alignment
$1,800.00 One Time
$1.00 Per Year
|
Quarterly license optimization
$2,500.00 One Time
$200.00 Per Month
|
|
|
| Security and Identity | |||||
|
Admin Account Controls
Admin Account Controls |
Admin role review
$1,200.00 One Time
$1.00 Per Year
|
Separate admin accounts
$2,500.00 One Time
$1.00 Per Year
|
Privileged access control program
$5,500.00 One Time
$300.00 Per Month
|
|
|
|
Email Security
Email Security |
Email authentication baseline
$1,200.00 One Time
$1.00 Per Year
|
Email security hardening
$2,800.00 One Time
$150.00 Per Month
|
Business email compromise reduction program
$5,500.00 One Time
$300.00 Per Month
|
Email security hardening
$2,800.00 One Time
$150.00 Per Month
|
|
|
Endpoint Protection
Endpoint Protection |
Maintain current protection
$1.00 One Time
$1.00 Per Year
|
Protection coverage validation
$1,200.00 One Time
$1.00 Per Year
|
Managed endpoint security review
$1.00 One Time
$300.00 Per Year
|
Protection coverage validation
$1,200.00 One Time
$1.00 Per Year
|
|
|
MFA Enforcement
MFA Enforcement |
Enable MFA for all users
$1,500.00 One Time
$1.00 Per Year
|
MFA rollout with access baseline
$2,800.00 One Time
$150.00 Per Month
|
MFA with conditional access
$5,000.00 One Time
$350.00 Per Month
|
Enable MFA for all users
$1,500.00 One Time
$1.00 Per Year
|
|
| Total Investment | |||||
| One Time | $17,453.00 | $44,550.00 | $77,501.00 | $36,700.00 | |
| Per Month | $242.00 | $1,170.00 | $4,850.00 | $1,300.00 | |
| Per Year | $15.00 | $13.00 | $900.00 | $605.00 | |
The following Roadmap is designed to outline the time-frames proposed to resolve your ICT issues. Please feel free to comment and discuss these items at any time.
| Quarter | Month | Type | Outcome | Project Manager | Comment |
|---|---|---|---|---|---|
|
Q2
2026 |
June
|
Device Lifecycle
Device Lifecycle |
Productivity, Stability, Compliance
|
Jamie Warner
|
|
|
Q3
2026 |
September
|
Admin Account Controls
Admin Account Controls |
Security, Compliance, Stability
|
viviana pedraza
|
|
|
Q3
2026 |
September
|
Backup Coverage
Backup Coverage |
Business Continuity, Peace of Mind,
|
Jamie Warner
|
|
|
Q3
2026 |
September
|
Business Applications
Business Applications |
Business Continuity
|
Jessica Ross
|
|
|
Q3
2026 |
September
|
Core Internet Connectivity
Core Internet Connectivity |
Business Continuity, Productivity
|
Jamie Warner
|
|
|
Q3
2026 |
September
|
Email Security
Email Security |
Security, Compliance, Stability
|
Viviana Pedraza
|
|
|
Q3
2026 |
September
|
Endpoint Protection
Endpoint Protection |
Security, Stability, Peace of Mind
|
Manuel Giraldo
|
|
|
Q3
2026 |
September
|
Incident Response
Incident Response |
Business Continuity, Peace of Mind,
|
Manuel Giraldo
|
|
|
Q3
2026 |
September
|
MFA Enforcement
MFA Enforcement |
Security, Compliance, Peace of Mind
|
Manuel Giraldo
|
|
|
Q3
2026 |
September
|
Microsoft 365 Availability
Microsoft 365 |
Productivity
|
Viviana Pedraza
|
|
|
Q3
2026 |
September
|
Microsoft 365 Backup
Microsoft 365 Backup |
Business Continuity, Peace of Mind,
|
Jamie Warner
|
|
|
Q3
2026 |
September
|
Microsoft 365 Licensing
Microsoft 365 Licensing |
Productivity, Stability, Compliance
|
Jamie Warner
|
|
|
Q3
2026 |
September
|
Network Documentation
Network Documentation |
Stability, Security, Productivity
|
viviana pedraza
|
|
|
Q3
2026 |
September
|
Onboarding and Offboarding
Onboarding and Offboarding |
Security, Compliance, Stability
|
Jessica Ross
|
|
|
Q3
2026 |
September
|
Printer and Scanner Workflow
Printer and Scanner Workflow |
Productivity, Stability, Compliance
|
Jessica Ross
|
|
|
Q3
2026 |
September
|
Remote Work Capability
Remote Work Capability |
Productivity, Stability, Compliance
|
Manuel Giraldo
|
|
|
Q3
2026 |
September
|
Security Policies
Security Policies |
Compliance, Security, Peace of Mind
|
Jessica Ross
|
|
|
Q3
2026 |
September
|
SharePoint and File Permissions
SharePoint and File Permissions |
Security, Productivity, Compliance
|
viviana pedraza
|
Ticketing, SLA and Backup Transparency Report
A client-facing operational snapshot for My Client, showing support activity, service performance, backup health, and completed work for the current review period.
Executive Summary
```During the current review period, My Client’s environment remained operational and supportable. The majority of requests were resolved within agreed service expectations, while backup monitoring confirmed that core Microsoft 365 data protection and restore checks require continued attention.
Overall operational posture: Yellow
Support performance is stable, but backup validation, recurring ticket themes, and proactive review items should continue to be managed through the roadmap.
This report is designed to show what has been done, what is being monitored, and what should be reviewed next. It supports transparency between My Client and the MSP.
```Review Period Snapshot
```The following figures are a high-level summary of service activity for the last 90 days.
Support requests, alerts, service tasks, and user issues.
Closed during the period.
Response and resolution performance across eligible tickets.
Successful scheduled backup jobs across protected workloads.
Ticketing Summary
```The ticketing data shows what support activity has taken place and where recurring themes are emerging.
```SLA Performance
```Service Level Agreement performance helps confirm whether the support model is meeting response and resolution expectations.
```Backup Health Summary
```Backup reporting helps confirm whether business-critical data is being protected and whether recovery can be demonstrated.
```Work Completed During the Period
```The following items were completed or progressed during the current review period.
```Recurring Themes and What They Tell Us
```Recurring tickets help identify areas where proactive work may reduce future support volume.
```Next Review Actions
```The following actions should be reviewed during the next vCIO or service review meeting.
```This report shows what has happened, what has been managed, and what needs attention next.
Support tickets show activity. SLA data shows service performance. Backup reporting shows resilience. Together, they give the client transparency.
Client Takeaway
```My Client’s support environment is functioning well overall, with strong SLA performance and active ticket management. The next opportunity is to use ticket trends and backup reporting to drive proactive improvement: validating restore capability, reducing recurring issues, improving access processes, and continuing to use the roadmap as the visible plan for what happens next.
```