Protective controls
Implementation and maintenance of preventive controls across infrastructure and applications: segmentation, access control, endpoint and email protection, system hardening and configuration baselines.
01Service · Infrastructure and Managed Services
Protective controls that are maintained in operation
Security controls are typically procured once and then left to age. X-Shift implements protective controls across the infrastructure and applications in scope, monitors them for security-relevant events, manages the vulnerability and patching cycle, and supports the client's team when an incident requires handling. Practical security operations support, described in plain terms.
Control health · this cycleProtective controls
5 of 6 maintained · 1 action open- Endpoint protection98%412 / 420 agentsTuned 2 days ago
- Email protection100%Rules currentTuned 3 days ago
- Segmentation100%Zones reviewedReviewed this cycle
- Privileged access88%Review due in 6 daysLast review 24 days ago
- Patch baseline94%3 exceptions · measures agreedApplied Thursday
- Log sources97%37 / 38 reporting1 stopped · ticket raised
Finding register14open9in remediation0without an owner
Cybersecurity ServicesConsult X-Shift
What we do
Controls are implemented and maintained in working order
X-Shift operates at the level at which a systems integrator can credibly operate. The protective controls across the infrastructure and applications in scope (segmentation, access control, endpoint and email protection, hardening, logging and backup protection) are assessed, and the gaps identified are closed. Security monitoring is configured so that security-relevant events are collected and reviewed against agreed rules, with alerts routed to named responders rather than accumulating in a console. The vulnerability management cycle is operated, comprising scanning, prioritisation by exposure and severity, and tracked remediation through the patch and change process. When an incident is suspected, the client's team is supported with containment, technical investigation and recovery. Advice is also provided on security governance (policies, standards and control ownership), and the client's regulatory and compliance requirements are accommodated rather than circumvented.
- 01Protective controls
- 02Security monitoring
- 03Vulnerabilities tracked
- 04Access reviewed
- 05Incident support
- 06Governance advisory
Control cycle
The sequence in which the work is performed
Security work in this context is operational rather than investigative. Each stage informs the next, and the cycle recurs for as long as the service operates.
- 01Control assessed
- 02Gap closed
- 03Event monitored
- 04Finding prioritised
- 05Remediation tracked
- 06Coverage reviewed
This cycle is operated by X-Shift alongside the client's own security function and any specialist provider that is retained.
Scope
What the service covers
Scope is agreed against the client's estate and existing security arrangements.
Security monitoring
Collection and review of security-relevant logs and events against agreed detection rules, with alerts triaged and routed to named responders on a defined path.
02Vulnerability management
Scheduled scanning across systems in scope, prioritisation of findings by severity and exposure, and remediation tracked through the agreed patch and change process.
03Patch and hardening cycle
Operation of the security patching calendar and configuration baselines, with exceptions recorded, compensating measures agreed and drift identified at each review.
04Identity and access support
Administration of accounts, roles and privileged access in scope, with scheduled access reviews and removal of entitlements that are no longer justified.
06
Incident response support
Defined procedures for suspected incidents, with X-Shift assisting the client's team with containment, technical investigation, recovery of affected systems and post-incident findings.
07
Security operations support
Ongoing operational security work alongside the client's team: control health checks, rule tuning, log source coverage and coordination with security vendors and suppliers.
08
Security governance and advisory
Advisory on security policies, standards, control ownership and risk treatment, aligned with the regulatory obligations that apply to the client's organisation and sector.
Service commitments
What is committed, and how it is demonstrated
Security commitments carry little value when stated as an aspiration. The following describe what is measured and reported, at a level that a systems integrator can credibly sustain.
What is measuredHow it is reportedWho owns it
01Coverage of agreed log sources and monitored systems
How it is reportedReported as sources configured against sources agreed, with any source that has ceased reporting named individually
Who owns itX-Shift security operations lead
02Alert triage against the agreed rule set
How it is reportedReported by volume, outcome and time to triage, including alerts closed as false positives and the tuning applied as a result
Who owns itX-Shift security operations lead
03Vulnerability remediation by severity band
How it is reportedRemediation windows are agreed per band, and progress is reported against the open register and not against new findings alone
Who owns itX-Shift security lead, with the client's system owners
04Patch cycle and configuration baseline completion
How it is reportedCompleted against planned, with every exception recorded alongside the compensating measure agreed for it
Who owns itX-Shift security lead, under the client's change approval
05Access review completion and entitlements removed
How it is reportedReported per review cycle, listing what was removed and what was retained with a stated justification
Who owns itX-Shift identity owner, with the client's access approvers
06Incidents and near misses
How it is reportedBoth reported, including events contained before impact, with findings and corrective actions maintained until closed
Who owns itX-Shift service manager, with the client's security owner
Targets are set per engagement against the client's estate, regulatory obligations and existing security arrangements, then reported against that agreement. Detection and response targets are set against the client's estate and are not published as standard figures, because a figure quoted before the estate is understood does not constitute a commitment.
How it runs
The operating cadence
Security work is continuous. Following the initial assessment, the cycle of monitoring, remediation and review recurs for as long as the service operates.
DESIGNED FOR OPERATION, NOT PRESENTATIONThe design must withstand the demands of live operation.
01 / 06
01
Control assessment and onboarding
Existing controls, log sources, access arrangements and known gaps are documented, and the monitoring, escalation and remediation model is agreed with the client's team.
OutputA control assessment recording existing coverage, log sources, access arrangements and known gaps
02 / 06
02
Control implementation
Gaps identified in the assessment are closed through configuration, hardening, access changes and tooling adjustments, each applied under the client's change process.
OutputA record of each control change applied, with exceptions and compensating measures documented
03 / 06
03
Monitoring and alert triage
Security events are collected and reviewed against agreed rules, alerts are triaged, and any item requiring action is escalated via the documented path.
04 / 06
04
Vulnerability and remediation cycle
Scanning is performed to a defined schedule, findings are prioritised by severity and exposure, and remediation is tracked through patching and change until closed.
OutputA prioritised finding register with remediation tracked through patch and change
05 / 06
05
Access and configuration review
Accounts, privileges and configuration baselines are reviewed on a defined cycle, with drift corrected and unjustified entitlements removed.
OutputAn access and configuration review record, listing the entitlements removed
06 / 06
06
Service governance
A regular review addresses open findings, incident history, control coverage, remediation progress and the security improvement plan agreed with the client.
OutputReview minutes addressing open findings, coverage and the security improvement plan
When this is required
Controls exist on paper but not in operation
Most estates have security tooling deployed; considerably fewer maintain dedicated ownership of it on a weekly basis.
Security products are deployed, configured once and seldom revisited. Alerts accumulate without triage, agents fall out of coverage, and vulnerability findings are reported but not tracked to remediation. Access rights granted for a project remain in place for years. None of these conditions requires a sophisticated adversary to become a significant problem.
Client responsibilities
What the service requires from the client
Security services are delayed by questions of authority more frequently than by technology. Each of the following determines whether a finding is resolved or remains on a register.
- 01
Authority to change security configuration on the systems in scope, within an agreed change process
- 02
Access to the relevant log sources, including the systems owned by teams outside IT
- 03
A named owner empowered to accept a risk formally where remediation will not be undertaken
- 04
The client's current policies, standards and regulatory obligations, so that control work is aligned to them rather than to a generic baseline
Outcomes
Security is maintained rather than assumed
The controls already procured begin to perform their intended function, because they are maintained on a schedule. Findings progress from a report into a tracked remediation queue, and an agreed procedure exists for the day on which an incident occurs.
- 01
Security alerts triaged and routed to named responders rather than accumulating unreviewed
- 02
Vulnerability findings prioritised and tracked through to confirmed remediation
- 03
Access and privilege reviewed on a cycle, with unjustified entitlements removed
- 04
A documented, rehearsed procedure defining responsibilities during a suspected incident
Common questions
Questions commonly raised before contracting
How does transition operate, and what does the first assessment typically identify?
Existing controls, log sources, access arrangements and known gaps are documented by X-Shift, and the monitoring, escalation and remediation model is agreed before any responsibility is assumed. The first assessment almost invariably identifies more open findings than anticipated and coverage narrower than assumed. This is normal, and a provider that reports otherwise within the first month has not examined the estate thoroughly.
Does this replace the internal security team or a specialist security provider?
Neither. X-Shift provides protective controls, security monitoring, vulnerability management, incident response support, security operations support and governance advisory: the operational layer over the estate in scope. It is not presented as a certified security operations centre, and it excludes threat hunting and offensive testing. Where those are required, they are obtained from a specialist, alongside whom X-Shift operates.
How is performance reported?
Performance is reported against the open finding register, coverage of agreed log sources, remediation progress by severity band and incident history, on the agreed cycle and from the tooling records. Near misses are reported alongside incidents, because a service that reports only breaches provides the client with no advance warning.
What is the exit process?
Control documentation, the finding register, detection rules, access review records and incident history are transferred with a support period. Credentials and privileged access are revoked on an agreed schedule at exit, and the revocation is evidenced and not merely asserted.
Next
Recommended next steps
01
Commence with a control assessment
A documented view of the protective controls across the estate, identifying which are configured and maintained, where logging ceases, and which findings are open without an owner.
Applicable where security tooling was procured some time ago and has not been reviewed since.
Consult X-Shift02
Establish governance alongside the controls
Policies, control ownership and decision rights determine whether findings are remediated. Technical work without them produces a longer register.
Applicable where findings are reported reliably but rarely acted upon.
Digital GovernanceX-Shift operates within the scope described here and states clearly where a specialist is the appropriate resource. Security is not an area in which capability should be overstated.
Related offerings
Related
Service
Managed Infrastructure Services
The operated estate to which protective controls are applied
Service
Business Continuity and Disaster Recovery
Recovery capability for incidents affecting the availability of data
Service
Digital Governance
Policy, ownership and decision rights governing digital and security controls
Solution
Digital Compliance
Fulfilment of regulatory obligations across digital platforms and services
Is this the work required?
A short conversation is typically sufficient to establish whether this is the appropriate engagement, a narrower one, or an alternative.