Understand access
Who can access business systems? Which accounts have elevated permissions? These are practical questions to bring to an identity security discussion.
Identity security posture management
Know who has access.
Know who has access.
Close the gaps as your business changes.
People join, roles change and old access can be overlooked. Identity Security Posture Management (ISPM) helps identify weaknesses in account settings and permissions so you can prioritise improvements. Included in Protect, Maintain and Manage, with appropriate controls confirmed during onboarding.
What is ISPM?
Make identity security part of your IT planning.
ISPM focuses on how identities and access are configured: who has access, what permissions they hold and where settings may create unnecessary exposure. It complements ITDR by helping identify weaknesses in the identity setup.
An example you can recognise
The temporary access that became permanent.
A staff member was given administrator access to help with a change. Months later, their role has changed but the extra permissions remain. Nothing looks broken, so the access is easy to overlook.
If that account is compromised, those permissions could give someone more control than the staff member needs for their everyday work.
Illustrative scenario, not a customer incident or a checklist of controls included for every environment.
Is this relevant to your business?
When access has grown harder to keep track of.
ISPM is worth discussing when you want a clearer view of account security and a plan for improving it. It can be especially relevant when staff responsibilities change, several people administer systems or your team handles sensitive client information.
- Do you know who holds administrator permissions and why?
- Have old accounts and temporary access been revisited?
- Do security settings still fit the way your team works today?
- Is someone responsible for prioritising improvements?
These are starting questions for a discussion. The checks available depend on the systems you use; some ISPM capabilities are specific to Microsoft 365.
What ISPM focuses on.
Understand the approach, then agree the coverage appropriate to your business.
Identify configuration gaps
Identity settings and permissions can leave avoidable weaknesses. ISPM helps bring those gaps into view so improvements can be prioritised.
Plan improvements
Use findings to inform security posture reviews and improvement planning. Manage also includes quarterly IT and security planning and asset and security governance.
How the protection fits together
Different controls answer different questions.
Your devices, accounts and access settings all need attention. Each layer has a different job.
| Protection | The question it helps answer | Included in |
|---|---|---|
| Multi-factor authentication (MFA) | How do we make signing in harder for someone with a stolen password? | Protect, Maintain and Manage |
| Endpoint Detection and Response (EDR) | Is there a threat on a managed computer? | Protect, Maintain and Manage |
| Identity Threat Detection and Response (ITDR) | Is a business account showing signs of misuse that need a response? | Maintain and Manage |
| Identity Security Posture Management (ISPM) | Are identity settings or permissions creating weaknesses we should address? | Protect, Maintain and Manage |
These controls work together. Appropriate identity coverage is confirmed for your environment; some ISPM capabilities are specific to Microsoft 365.
Working with Stack2
Turn access concerns into priorities you can act on.
Confirm what fits your environment
We confirm the appropriate ISPM controls during onboarding. Tell us whether you use Microsoft 365, Google Workspace or a mix of systems so the applicable coverage is clear.
Connect findings with your business risks
Manage includes security posture reviews and improvement planning. The aim is to decide which weaknesses deserve attention first, taking account of the access involved and how your business works.
Keep security in the IT plan
Manage includes quarterly IT and security planning, asset and security governance, and a written incident response plan kept current. ISPM contributes to that broader responsibility for your IT.
Your managed IT plan
Included in every IT support plan.
ISPM is included in Protect ($69), Maintain ($149) and Manage ($199) per user per month, including GST. Maintain adds ITDR and unlimited remote support during business hours. Manage includes everything in Maintain and adds security posture reviews, improvement planning and greater ownership of your IT.
Some ISPM capabilities are specific to Microsoft 365. We confirm the controls appropriate to your environment during onboarding. For Google Workspace or a mixed environment, discuss your setup with us so the applicable coverage is clear.
One computer per person. Month to month, no fixed term and no minimum team size — we ask for 90 days' notice to cancel. Additional projects and implementation work outside the plan are scoped and quoted before starting.
See plan inclusions and pricingBuild a broader security plan.
Understand ITDR
ITDR focuses on detecting and responding to identity threats. Maintain and Manage include ITDR alongside ISPM, bringing threat response and posture improvement into the same plan.
Explore ITDRYour security foundation
Device protection, email security, MFA and backup monitoring form part of every managed IT plan.
Explore managed cyber securityPriorities guided by SMB1001
We recommend and follow SMB1001 to guide security improvements across people, processes and technology. Reviews and assessments do not provide certification.
Understand our SMB1001 approachYour ISPM questions, answered.
Which plan includes ISPM?
ISPM is included in Protect, Maintain and Manage. Maintain and Manage also include ITDR.
Is the same ISPM coverage available for every platform?
Some ISPM capabilities are specific to Microsoft 365. We confirm the controls appropriate to your environment during onboarding, including where Google Workspace or other systems are involved.
How is ISPM different from ITDR?
ISPM focuses on identity configuration, access and security posture. ITDR focuses on detecting and responding to identity threats. Maintain and Manage include both.
Does buying Microsoft 365 include Stack2 security management?
No. Microsoft 365 licence purchases include initial tenant setup and licence management. Ongoing technical support, security configuration and management are separate services. We agree scope and charges before additional paid work starts.
Why choose Manage rather than Maintain?
Maintain includes ITDR and unlimited remote support during business hours. Manage adds security posture reviews and improvement planning, asset and security governance, quarterly IT and security planning, and greater ownership of projects and incident readiness. Choose based on the responsibility you want Stack2 to take for your IT.
Will ISPM automatically remove access or change settings?
Do not assume every finding triggers an automatic change. Available controls and appropriate changes depend on your environment. We confirm the controls during onboarding and scope and quote work outside your plan before starting.
Does ISPM include fixing every issue it finds?
No. Every plan includes ISPM. Manage also includes security posture reviews and improvement planning. Additional implementation or remediation work outside the plan is scoped and quoted separately. Additional licensing requirements are confirmed for your setup.
Does ISPM replace setting up new starters and removing leavers?
No. Maintain and Manage include new starter and leaver support. ISPM adds a focus on weaknesses in identity configuration and access; day-to-day account administration still matters.
Will this make us compliant or SMB1001 certified?
Buying Manage does not automatically establish conformity or provide certification. Stack2 recommends and follows SMB1001 to guide improvements. Reviews and assessments do not issue certification or replace a formal certification assessment.