The HeptaShield Baseline · v1.0 · October 2026
The exact controls every client gets, in writing.
Competitors say “security-first.” We publish the checklist. These controls are applied to every client from onboarding, and checked every quarter.
01
Identity
- MFA on every accountAuthenticator app with number matching. No SMS for admins.All plans
- Separate admin accountsAdmin rights never on a daily-use mailbox.All plans
- Legacy authentication blockedSign-in methods that can't do MFA are switched off.All plans
- Conditional AccessSign-ins blocked from unexpected countries and non-compliant devices.Secure+
- Quarterly access reviewWho has access to what, checked and signed off.Secure+
02
- SPF, DKIM and DMARCConfigured on every domain, DMARC moving to quarantine or reject.All plans
- Phishing and impersonation filteringLook-alike senders and malicious links caught before delivery.Secure+
03
Devices
- Enrolled in IntuneEvery managed laptop, phone and tablet.All plans
- Disk encryptionBitLocker or FileVault on every computer.All plans
- Weekly patchingOperating systems and apps, with urgent fixes sooner.All plans
- Endpoint protectionMicrosoft Defender on every managed device.All plans
- Managed EDRAlerts reviewed by a person.Secure+
04
Continuity
- Microsoft 365 backupMail, OneDrive, SharePoint and Teams, outside your tenant.Secure+
- Quarterly restore testA real restore, documented.Secure+
- Workstation backupFor computers holding data that isn't in the cloud.Complete
05
People and documentation
- Admin credentials documentedStored in a password manager you can access.All plans
- Domain and tenant in your nameYou own them; we're the technical contact.All plans
- Security awareness trainingShort modules and simulated phishing, results monthly.Secure+
Version 1.0, updated October 2026. Changes are listed here with each new version. See which plan includes what on the Pricing page, or test one control yourself with the Email Security Check.
How does your setup compare to the Baseline?
A free review checks your Microsoft 365, email and backups against it.
No pressure. If your setup is fine, we'll tell you.