• How We Measure and Report Your Firm's Security Posture.

    A secure environment needs to be measurable. Innessco uses two frameworks: Microsoft Secure Score for ongoing platform hygiene, and the CSA Cyber Essentials baseline for maturity alignment.

     80+

    Secure Score Target

    Top Tier – Small Business
    Microsoft 365 Tenants

    MEASUREMENT FRAMEWORK

    Microsoft Secure Score

    Microsoft Secure Score measures your Microsoft 365 environment’s security configuration, scored 0 to 100. Innessco maintains all managed environments above a Secure Score of 80 – in the top tier of small business Microsoft 365 tenants.

    Innessco reviews Secure Score recommendations on an ongoing basis and applies improvements during the regular management cycle.

    MATURITY FRAMEWORK

    CSA Cyber Essentials

    CSA Cyber Essentials is a set of baseline cyber-security controls defined by the Cyber Security Agency of Singapore (CSA). It is designed to help organisations implement fundamental cyber hygiene measures and improve resilience against common cyber threats.

    CSA Cyber Essentials covers practical security areas including:

    • People awareness and cyber hygiene
    • Hardware and software visibility
    • Data protection
    • Virus and malware protection
    • Access control
    • Secure configuration
    • Software updates
    • Essential data backups
    • Incident response

    Innessco manages environments to align with CSA Cyber Essentials principles as part of the standard managed service. For firms that need to demonstrate alignment, certification readiness or meet insurer or regulatory expectations, Innessco can provide a current-state assessment and remediation plan against the CSA Cyber Essentials requirements.

    Reporting

    Innessco provides regular security reporting covering Secure Score status, users approved for access from outside Singapore, and backup status. Security-related changes are managed through change control, with a risk assessment included where appropriate. Clients are advised of security incidents and any follow-up required.

    This gives your firm practical evidence that key security controls are being monitored and managed over time.