Scan evidence starts the sheet; people confirm the plan
Customer-specific roles, contacts, authority and procedures need confirmation. Missing information remains a gap rather than an invented owner or a promise of incident-response coverage.
CYBER RESILIENCE
Prepare before impact. Respond with ownership. Recover with proof.
Cyber resilience connects security posture with the operational ability to detect, escalate, contain, restore, communicate, and learn. The 3AM Test keeps those responsibilities concrete.
EVIDENCE · INSIGHT · PROOF
Where one real tenant stood: 15 urgent findings before anyone asked.
01
Observed evidence
Retain the finding, source and date.
02
Customer-confirmed
Record purpose, owner and agreed context.
03
Gap
State what needs review or an approved change.
04
Not assessed
Show unread sources and work not tested.
WHAT'S NEW IN SCOUTz · OPEN BETA
First 24 hours: who does what in a cyber incident
Prepare a one-page incident sheet from the scan's available evidence: roles, first-hour steps, decision authority and communications. Use the accompanying 45-minute tabletop script with the client to confirm who does what before an incident.
Practice the handoffs
Use the tabletop to review first-hour actions, who decides and who speaks. The sheet is preparation material—not proof of recoverability, legal compliance or a staffed incident-response service.
Honest by design: every count names its source. A check SCOUTz could not read stays “Not read”—not “none” or “all clear”. Microsoft 365 reviews use client-consented, read-only access and do not read message bodies, files, chats, documents or prompts.
Reduce exposure.
Identity, email, applications, external services, ownership, policy, monitoring, and tested preparation.
Know who acts.
Alert ownership, escalation, decision authority, containment, communication, and incident-response boundaries.
Recover and verify.
Protected scope, isolation, restoration tests, recovery objectives, evidence preservation, lessons, and control revalidation.
EVIDENCE · INSIGHT · PROOF
Start with the question, then keep the evidence attached.
01
Finding
What was actually observed?
02
Means
What might it mean, and what still needs confirmation?
03
Do
What should the MSP and customer review next?
04
Worth
Scope the effort before applying the MSP’s hourly rate.
A defensible recovery conclusion needs evidence about protected scope, job success, isolation or immutability, restoration tests, recovery objectives, and accountable owners.
THE 3AM TEST
Six questions make the operating model visible.
Monitoring, recovery, escalation, recent review, security basics, and active threat response connect the technical assessment to the people who must act.
Take the six questions →Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.