Perimeter review
A perimeter is not a wall. It is every boundary a session crosses on its way from a person to a service: the network edge, the identity layer, the host, the session, the record. Our review walks all five and writes down what actually stands at each one.
Five boundaries, one walk
We review in a fixed order, because each boundary assumes the one before it holds.
- Edge. What is reachable from outside, through which published service, and under whose ownership.
- Identity. How a person is verified, where authority lives, and how it is revoked when circumstances change.
- Host. What the arriving person can then reach, with which rights, and by what default.
- Session. Who can see a session, whether it is recorded, and how long any record survives.
- Record. Whether the client could reconstruct last month's access, from their own systems, without asking us.
Method
We work from evidence, not from intention. We read configuration, sample logs, and ask two or three people the same question separately, because documents and practice often disagree. Where we find a gap we classify it: a design gap, a configuration gap, an ownership gap or a record gap. Each class has a different remedy and a different cost, and saying so plainly spares clients from buying the wrong fix.
What you receive
A written review of twenty to forty pages, depending on scope, containing a one-page summary for management, a table of findings ordered by consequence, and a proposed sequence of work with effort estimates referenced to our rate card. Findings are marked open, accepted or closed by the client; nothing is closed without client agreement.
Evidence-based
Conclusions rest on configuration and logs you can inspect, not on a questionnaire score.
Ordered by consequence
Findings are ranked by the harm they could permit, not by the elegance of the fix.
Actionable
Every finding carries an owner, an effort estimate and a suggested window.
Where reviews usually end
Most reviews produce two or three changes that matter and a longer list of tidiness items. The changes that matter are usually about ownership: an access path with no named owner, a review date nobody watches, a record that lives only with a supplier. Tidiness matters too, but a client should not spend a quarter on it before fixing the two things that keep them awake.
Recurring review
A perimeter is a moving picture. Staff change, suppliers change, systems migrate. Clients on a retainer receive a light review each quarter and a full review each year, so the written picture never falls more than one quarter behind practice.
Commission a review
Tell us the sites and systems in scope. We will confirm the effort in writing before work starts, and you keep the report regardless of what follows.
Reach us Assurance reportingReviews are conducted only under the client's written instruction and within the client's own environment, in accordance with the law applicable in Colorado, USA.