Services
Security, governance and compliance consultants for New Zealand organisations
Know what's set up. Know who can see what. Know it's under control.
We help New Zealand organisations assess their security, governance and compliance across their entire ICT environment, from Microsoft 365 and Azure to AWS, on-premises infrastructure and the devices your people use every day.
Book a callYou're responsible for keeping everything secure. But can you see everything that needs protecting?
Your organisation relies on a mix of technology.
Some systems are in the cloud. Others are still running on-premises. You've got laptops, servers, business applications and information moving between different platforms.
And somewhere in the middle of all that, you're expected to know whether everything is secure and compliant.
Then the questions start.
The board wants reassurance. Are we secure? What are our biggest risks? What are we doing about them?
The cyber insurance renewal arrives. You're being asked about security controls, configurations and processes, but some answers aren't as straightforward as they should be.
An audit is coming up. You need to demonstrate that the right controls are in place, supported by evidence.
Your IT environment has grown. But your asset register, security policies and governance processes haven't necessarily kept up.
Your team is stretched. There's barely enough time to manage the day-to-day, let alone investigate every possible security gap.
It's a lot to be accountable for.
Especially when you're not entirely sure what you might be missing.
And that's the problem. You can't properly protect, manage or demonstrate compliance with something you don't have visibility of.
Your security is only as good as the things you've overlooked
You know how it's set up, who can see what, and that your information is protected.
- You know where you stand. A clear picture of your security, sharing and settings.
- You use the security you're already paying for. Protection that was licensed but never switched on gets put to work.
- Information reaches the right people only. Oversharing is found and stopped.
- You have evidence ready for auditors and insurers.
- Governance helps people instead of getting in their way. Information is protected, and collaboration still works.
- You know what to do first. A prioritised roadmap, in stages you can manage.
- Your team can keep it that way. Settings stop drifting back to the way they were before.
Security, Governance & Compliance | Client Case Study
They were using Microsoft 365 every day. But how secure was it?
Over time, a New Zealand organisation's Microsoft 365 environment had grown. New services had been introduced, settings had changed and different teams were managing different parts of the system. Everything appeared to be working. But nobody had a complete picture of how the security, governance and compliance controls fitted together. The concern wasn't just what they knew needed fixing. It was what they might have missed. With plans to make greater use of Microsoft's security and AI capabilities, getting that visibility became even more important. We reviewed access controls, security configurations, governance processes and reporting. Then we helped strengthen visibility, clarify ownership and establish a practical roadmap for addressing gaps and managing security over time.
The difference? Better visibility of security settings, access and potential risks. Clearer ownership and stronger governance processes. Improved security controls across the Microsoft environment. A prioritised plan for what needed attention now and what could wait. They went from wondering how well their Microsoft environment was protected to having a clearer picture of their risks, controls and priorities, and the confidence to make informed decisions about what came next. "We finally had a clear picture of what needed attention, what was working well, and what could wait."
From not knowing what's wrong to knowing what to do about it
We know security and compliance can feel overwhelming, particularly when you've inherited years of systems, processes and decisions made by different people.
We're here to help you make sense of them and work out what needs to happen next.
1. Understand your environment and obligations
We start by understanding your business, technology, concerns and the security or compliance requirements you're trying to meet.
That includes agreeing which systems, platforms, devices and processes need to be reviewed.
2. Find the gaps and understand the risks
We assess the agreed areas of your ICT environment, looking at the security controls, governance arrangements and supporting processes already in place.
We identify weaknesses, missing controls and areas where further investigation may be needed.
3. Work out what matters most
You'll get a clear explanation of what we've found, why it matters and what we'd recommend doing about it.
We'll distinguish between immediate priorities, longer-term improvements and things that don't warrant unnecessary time or expense.
You'll know what's worth fixing, why it matters and what can reasonably wait.
4. Help put the improvements in place
Where implementation is included in the agreed scope, we work alongside your team to address the identified gaps.
That might involve strengthening security configurations, improving governance processes, updating documentation or introducing better controls across your systems and devices.
5. Leave your team confident and in control
We help your people understand what's changed, why it matters and what they need to do to maintain the improvements.
Because security and compliance aren't things you sort out once and never think about again.
Your organisation needs to be able to keep managing them long after the project is finished.
Why organisations choose It's Us for security, governance and compliance
We look at the whole picture, not just the technology. We start by understanding your organisation, its risks and what you need to comply with. Then we assess what's in place before recommending changes. We're not here to sell you another product.
One connected view of your ICT environment. Security gaps don't always sit neatly inside one system. We look across cloud, hybrid and on-premises environments, including devices, applications, infrastructure and the people using them. We also consider how identity and access management and technology costs affect the bigger picture.
The right priorities, not a never-ending to-do list. Not every risk needs the same response. We help you understand what needs attention now, what can wait and where changes will make the biggest difference to your security and compliance.
Security that works in the real world. There's little point introducing controls that make everyday work so difficult people start finding ways around them. We balance security, compliance, performance and usability so your people can get on with their jobs.
Straight answers you can take to the board. We'll explain the risks, requirements and recommendations in language your leadership team can understand, while giving your IT people the technical detail they need. No jargon to hide behind. No scare stories to justify a bigger project.
We understand New Zealand's public sector. We've worked with government organisations and understand the security, governance and assurance requirements they need to demonstrate. We help your team address gaps and prepare the evidence needed for audits and assessments. We don't act as the auditors.
Your team stays in control. We make sure your people understand what's changed, why it matters and how to maintain the improvements. The goal is stronger security and governance that your organisation can keep managing without depending on us.
You'll work with the people who know their stuff. The specialists you meet at the beginning are the people doing the work. We've worked across government, insurance, energy and finance, and we take responsibility for seeing the job through.
So you're not left wondering what you've missed. You know where you stand, what needs doing and who's taking care of it.
Is a security, governance and compliance review the right fit for you?
It's probably a good fit if you:
- Adopted cloud services quickly.
- Have never had a full review of how it's set up.
- Are worried about files being shared too widely.
- Have security features you're licensed for but may not have switched on.
- Have platforms that are growing out of control.
- Struggle to find information.
- Aren't sure how long you need to keep things.
- Are getting ready for AI or need AI governance.
- Have been asked by auditors or insurers for evidence.
- Have privacy or data loss concerns.
- Are paying for storage you suspect is filling with old document versions.
- Still have settings left over from COVID.
- Want a practical improvement roadmap.
It's probably not the right fit if you:
- Only need routine support.
- Need active incident response.
- Only want penetration testing.
- Want one feature switched on without checking the impact.
- Have no business or governance owner.
- Can't provide the information we need about your setup.
- Won't consider changing policies or the way things are done.
- Need formal legal advice or statutory certification.
If that's you, we'll say so, and point you to someone who can help.
Three steps to getting your security and compliance under control
Book a call.
Tell us what's keeping you up at night, whether it's an upcoming audit, cyber insurance requirements, security concerns or simply not knowing what you might be missing. We'll tell you if we can help, and you'll get a clear proposal and price before anything starts.
We show you where you stand.
We assess the agreed parts of your ICT environment, from cloud platforms and on-premises systems to devices, security controls and governance processes. You'll get a clear picture of the gaps, what needs attention and what can wait. You decide what happens next.
Get the risks under control and the confidence to keep them that way.
We help you address the agreed gaps, strengthen security and meet relevant compliance requirements. So you can answer questions from your board, auditors or insurers with confidence, and your team knows how to maintain the improvements.
Security, governance and compliance questions we get asked
Can you review non-Microsoft platforms as well?
Yes. While Microsoft 365 and Azure are common areas of focus, we can assess other cloud platforms, backup solutions, infrastructure services and vendor agreements where the relevant information, contracts and expertise are available.
Is Microsoft Copilot a security risk?
Copilot doesn't create new permissions. It exposes the permissions that already exist. If users can already access information, Copilot can help them find it faster. That's why governance, permissions and information ownership matter before you switch it on.
How do we know if we're using the Microsoft security features we're paying for?
Many organisations have licences that include advanced security, compliance and governance capabilities that have never been configured or fully adopted. We assess what's licensed, what's enabled and whether you're getting value from the investment you're already making.
We moved to Microsoft 365 years ago. Why would we need a review now?
Many Microsoft 365 environments grew quickly during cloud migrations, COVID remote work projects or organisational change. Temporary decisions often become permanent. We regularly find old sharing settings, forgotten Teams sites, excessive permissions and governance gaps that nobody realised were still there.
How do we know who can access our files and information?
Most organisations have far more sharing and access complexity than they realise. We review permissions across Microsoft 365, Teams, SharePoint, OneDrive and external sharing arrangements to identify who can access information and whether those permissions are still appropriate.
Can you help us prepare for Microsoft Copilot?
Yes. Before introducing Copilot, we assess permissions, information governance, document ownership, retention requirements and oversharing risks. This helps ensure Copilot surfaces the right information rather than exposing long-forgotten governance issues.
Do we need Microsoft E5?
Not automatically. We look at what you've already got licensed, what your business needs, and whether extra capability would be worth the cost. A good first step is checking that you're using the security features you already pay for.
What does good Microsoft 365 governance actually look like?
Good governance means information has owners, permissions are controlled, retention requirements are understood, sensitive information is protected, and users can still work efficiently. Governance should support the business, not get in the way of it.
Can stronger security make Microsoft 365 harder to use?
Not if it's designed properly. The goal is to improve protection while maintaining productivity. We balance security, user experience, compliance and operational requirements so staff aren't driven towards workarounds.
How do we know our Microsoft 365 is secure?
Security is more than turning a few features on. We assess identity, access, privileged accounts, device management, data protection, threat protection, sharing controls, monitoring and governance to provide a clear picture of where you stand and what needs attention.
Do you use Infrastructure as Code (IaC) for cloud and Microsoft environments?
Yes, where appropriate. We use Infrastructure as Code technologies such as Terraform and Azure DevOps to deploy and manage cloud environments in a documented, repeatable and auditable way. This helps reduce configuration drift, improve governance, maintain an audit trail of infrastructure changes and support security and compliance requirements.
Can you make us compliant?
We can assess controls, identify gaps and support compliance programmes, but compliance remains an organisational responsibility. Our role is to help you understand where you stand, what risks exist and what practical improvements will reduce those risks.