01 · Assess
Establish the truth
Review identity, email, devices, backups, networks and staff processes. Every finding is tied to evidence, an owner and a date.
See the baseline assessment →Managed IT with a cybersecurity specialty
Know who owns your IT. Know how it is secured.
We document the environment, protect the accounts and devices people rely on, and put every responsibility in writing. Start with a scored assessment. Expand only where the evidence supports it.
Published starting pricesWritten scope and ownershipInsurer-first incident process
Executive control summary
Example Office Ltd.
11/20Developing
Administrative accessExposedOwner · 7d
Backup restorationUnverifiedIT · 14d
Email authenticationReadyReview · 90d
Payment verificationExposedFinance · 3d
Evidence recorded for every controlTop 5 actions →
20 controls scoredEvidence, status and ownership recorded
3-business-day reportPlain English, prioritized by operational risk
Authorized changes onlyBackup, change record and rollback plan
Business-hours supportNo implied 24/7 response or hidden SLA
The operating model
Assess. Remediate. Operate.
Responsibility grows in controlled steps. You see the evidence, scope and price before Bastani takes on more of the environment.
02 · Remediate
Close the priority gaps
Complete only the authorized changes. Back up configurations, record what changed and keep a rollback path.
See the Security Tune-Up →03 · Operate
Keep ownership current
Maintain the systems and controls assigned in the agreement, with a clear boundary between Bastani, your team and specialist providers.
See ongoing coverage →Trust comes from boundaries
What we will not leave vague.
Security work fails when responsibility is assumed instead of assigned. Every engagement states who owns access, backups, changes, incidents and support.
01
No unauthorized testing
Simulations and technical testing begin only under signed scope.
02
No hidden incident promise
Your insurer's breach line leads a covered live incident. Bastani supports readiness and coordination.
03
No mystery administrator access
Named accounts, strong MFA, documented sessions and removal at handoff.
04
No silent scope expansion
The proposal states rates and estimated hours. Material overruns are raised before invoicing.
Designed for a clear fit
Enough responsibility to matter. A boundary you can inspect.
We are strongest where a small internal team, an office manager or an incumbent provider needs one accountable security owner.
A strong fit today
- Toronto and GTA organizations with 5-150 people
- Microsoft 365 or Google Workspace environments
- No dedicated security owner, or a small IT team with limited capacity
- A buyer willing to start with evidence and written scope
Scoped carefully or referred
- 24/7 helpdesk or live security monitoring
- Complex servers, enterprise networks or unsupported systems
- Live breach response outside the insurer's appointed team
- Compliance certification or legal advice
A named vertical
Built for the systems care homes cannot pause.
Long-term care and retirement homes bring shared workstations, rotating shifts, resident information and thin IT coverage together. Our audit records the controls, owners and first fixes without opening resident records.
Start with the evidence.
Twenty minutes is enough to decide whether an assessment is the right next step.