Less risk, stronger continuity
We implement safeguards that protect business operations.
We design, configure and launch protection for accounts, email, endpoints, networks and data. We connect it with event detection, an agreed response path and safe recovery of operations.
The right starting point
Diagnosis and implementation are two different stages.
We do not sell safeguards blindly. The correct starting point depends on whether the organisation already knows its environment and can identify a specific technical objective.
Diagnosis first
You do not know the actual condition
An IT audit organises the environment, evidence, risks and order of action. It ends with a report and a 30/90-day plan, without requiring an implementation engagement with us.
Go to the IT audit →Proceed to implementation
You know the problem or already have a plan
We move to change design, configuration and testing. We examine only the part of the environment required to deliver the agreed work safely.
View implementation scope ↓Implementation scope
From a specific risk to a working safeguard.
A complete diagnosis of the environment is a separate audit service. Here we verify the configuration required to design a change, implement the agreed mechanisms and confirm that they work.
Named accounts, MFA, least privilege and administrative access
Email and domain protection, including suspicious sign-ins and rules
EDR or XDR selection and deployment, updates and endpoint protection
Backup, retention, isolation and agreed recovery tests
Network segmentation, VPN, firewalls and controlled remote access
Logs, alerts, accountable recipients and a technical incident-response procedure
Protection layers
Protection works when the layers reinforce one another.
We do not reduce security to purchasing antivirus software. Each layer is intended to limit a different path into the environment, lateral movement or loss of operational capability.
Identity and access
Named accounts, MFA, least privilege, separation of administrative access and prompt removal of access after a role change or the end of cooperation.
Email and domain
Protection of mailboxes, forwarding rules and the domain, reduction of impersonation risk and control of unusual sign-ins and changes.
EDR, XDR and devices
EDR focuses on detection and response at endpoints. XDR can additionally correlate signals from endpoints, email, identity, cloud or network sources, depending on the platform, integrations and licensing.
Network and remote access
Firewalls, segmentation, secure Wi-Fi, VPN and restriction of remote-access tools to solutions that are genuinely needed and controlled.
Data and backups
Defined backup scope, retention, isolation, protection against deletion and recovery tests for specific data and systems.
Logs and detection
Required event sources, meaningful alerts, a named notification recipient and information sufficient to assess the scope of an event.
Incident response
An emergency channel, responsible people, the order for limiting harm, preservation of technical information and agreed recovery priorities.
People and daily decisions
Practical education, a safe way to report mistakes and simulations conducted only for an agreed purpose and scope with all required approvals.
Protection in practice
How the layers work together in common scenarios.
The examples illustrate our approach to protection. Actual safeguards always depend on the environment, data value and the agreed risk.
Scenario 01
Phishing and a stolen password
A message persuades a user to disclose sign-in details.
- Email protection limits some suspicious messages
- MFA makes a password alone less useful
- Logs help identify an unusual sign-in
- The procedure enables rapid session revocation and access changes
Scenario 02
Ransomware on a workstation
A malicious file executes on an employee device.
- Updates and EDR or XDR capabilities reduce the opportunity to execute the attack
- Least privilege reduces its reach
- Segmentation makes movement to other systems more difficult
- An isolated and tested copy supports data recovery
Scenario 03
Lost laptop
A device with access to business data is lost or stolen.
- Encryption limits access to locally stored data
- A named account allows access and sessions to be revoked
- Device management supports the appropriate response
- Records help establish the most recent activity
Scenario 04
Administrative error
A configuration change affects access or service operation.
- Separate administrator accounts reduce accidental actions
- A change log helps establish the cause
- A configuration or data copy supports rollback
- An agreed escalation path shortens decision time
Control and accountability
We describe security honestly: no guarantees and no shortcuts.
IT security reduces risk but cannot remove it entirely. Findings and decisions are limited to evidence, the agreed scope and the competence required for the work.
- 01We do not independently perform penetration tests, certification audits or legal opinions.
- 02We can coordinate a penetration test as a separate, independently priced engagement delivered by an appropriate specialist. The customer commissions certification and legal opinions directly.
- 03We do not request passwords through forms or ordinary correspondence; access is agreed as named, minimal and time-limited.
- 04Active work that could affect the environment is performed only after separate approval and with a safe rollback plan.
How the work proceeds
Every change has an objective, an owner and an acceptance test.
We do not begin by buying another tool. We use audit findings, customer documentation or a limited technical verification required for the specific change.
- 01
Objective and starting point
We establish the protected process, known risk, existing findings and a measurable implementation outcome.
- 02
Change design
We describe scope, dependencies, required access, operational impact and a safe rollback path.
- 03
Controlled implementation
We configure the agreed safeguards in stages and record material technical decisions.
- 04
Test and handover
We verify operation, alerts and the response scenario, then identify the owner of ongoing maintenance.
Clear boundaries
Implementation, operation and specialist services have separate scopes.
Technical implementation
Design and configuration of agreed safeguards, controlled launch, functional testing and safe handover for ongoing operation.
Operational maintenance
Updates, configuration reviews, alert handling and response times are delivered only within the scope and hours set out in the agreement or SLA.
Separate services
A full IT audit, 24/7 SOC/MDR, certification and legal opinions are not part of implementation. We can coordinate a penetration test as a separate engagement.
FAQ
Common questions about IT security.
Clear service boundaries are as important as the safeguards themselves: they help plan the right sequence of actions and the involvement of the right specialists.
Does cybersecurity replace an IT audit?+
No. An audit provides a cross-environment view, evidence-based findings and a 30/90-day plan. This service implements and maintains specific safeguards. If the environment is unknown or the planned change is broad, we recommend beginning with an IT audit.
Is this a penetration test?+
No. A penetration test is delivered by an appropriate independent specialist as an additional, separately priced engagement. Sigma Vision can coordinate its scope, timing and safe delivery.
Do we need to provide every password for implementation?+
No. We agree a named account with minimum permissions, MFA and a time limit appropriate to the work. We do not request passwords through a form or ordinary correspondence.
Does the 3-2-1 principle guarantee successful recovery?+
The principle alone provides no guarantee. Actual backup scope, retention, isolation, media availability and agreed recovery tests matter. These elements are verified separately.
What happens after an incident is identified?+
We first assess urgency, limit the risk of further harm and organise the available information. The exact action, escalation channel and response times depend on the situation and the applicable agreement or SLA.
What is the difference between EDR and XDR?+
EDR collects and analyses data primarily from computers, servers and other endpoints and can support response at that level. XDR broadens the view by linking signals from several areas, such as endpoints, email, identity, cloud and network sources. XDR is not automatically the better choice: it requires appropriate data sources, integrations, licensing and a person accountable for alerts.
Do EDR or XDR mean round-the-clock security monitoring?+
Not automatically. Both can record events and perform configured technical responses, but continuous human analysis of alerts requires a SOC or MDR service commissioned by the customer from an appropriate provider.
Must the existing antivirus, firewall or backup be replaced immediately?+
No. We first examine the actual configuration, licences, alert quality and recovery capability. We recommend replacement only when the current solution does not meet the agreed objective or its maintenance cost is not justified.
A specific next step
Protect the area where the risk is real first.
If you have a report or know the problem, we will define the implementation scope and acceptance test. If the environment is unknown, a separate IT audit is the appropriate first step.
Define implementation scope →