Hope
Shared passwords, personal laptops, MFA on nothing. A questionnaire answered with optimism.
One phish from a very bad weekInsurance claim denied for a false 'yes'
PROTECTED WORKPLACE / GOODOPS MODULE 11
Launching soon · early access open
Your insurer
has five
questions.
Answer yes.
Is MFA on everywhere. Is there a password manager. Are devices protected. Does your email prove it's you. Has the team been trained. Most organizations can say yes to two. Protected Workplace does all five, properly, in six weeks, and keeps them true, with a report you can hand to the insurer.
Built for organizations that have outgrown "someone will sort it."
Pairs with Backups. Together they are the security pair almost every organization is missing.
Which of the five can you say yes to?
MFAOn for email · off for everything else
38 laptops11 unmanaged · 4 unknown
Spoofed invoiceLooked like the CEO · $14k · caught
Renewal day
FIG. 01 / TWO OUT OF FIVE IS A NO.
"Can you confirm MFA, backups, endpoint protection and training?"
Yes to all five. Report attached, dated this quarter. Premium held.
Illustrative. Your data stays yours.
Most organizations we meet have cyber insurance.
Half couldn't prove what they signed.
Works with what you already run.
Business Premium or Workspace does most of this when it's actually configured.
1Password and awareness training fill the rest.
Microsoft 365Google Workspace1PasswordIntune · DefenderKnowBe4Datto · Dropsuite
NOT A FIREWALL SALE
You don't need
more security tools.
You need the five basics, actually done.
Almost every breach in an organization your size starts with a password, a phish or an unmanaged laptop. The fixes are not exotic. They are the five things every insurer asks about, done properly and kept true, with evidence. That's the whole module.
THE PROTECTED WORKPLACE WAY11 / 11
✓Switch on the five basics across every account and deviceFirst
✓Teach the team to spot the phish, with real practiceThen
✓Keep it true every month, and prove it every quarterAlways
Five yeses
you can prove.
Pairs with Backups: the two things that make a bad day survivable.
WHERE ARE YOU TODAY?
Three stages.
Most organizations are stuck on two.
Buying the licences is the easy part. Having all five switched on, for everyone, and proven, is what's missing.
Licensed, half switched on
Business Premium or Workspace paid for. MFA on email only. Some laptops managed. A password manager two people use.
Eleven unmanaged laptopsEmail anyone can spoofTraining once, in 2023
Five yeses, proven
MFA enforced everywhere. One password manager, everyone. Every device encrypted and wipeable. Email authenticated. Team practised. Quarterly report.
38 of 38 on MFA, by policyPhish click rate under 3%Insurer questionnaire answered from the report
Protected Workplace takes you from two to three in six weeks.
THREE STEPS. FIVE BASICS.
Switch it on.
Train the team.
Prove it.
We configure the five basics across every account and device, run practical awareness training, and produce the report that answers the insurer.
01
Switch it on
MFA enforced for every account by policy, not by asking. One password manager for everyone, shared vaults replacing the shared doc. Every laptop and phone enrolled, encrypted and wipeable, with the unknown ones found. Email authentication (SPF, DKIM, DMARC) set to enforce so nobody can send as you. Endpoint protection on, monitored.
How did the team do on last month's phish test?
Ask it anything. Try it.
02
Train the team
A 60-minute session built on your organization's real scenarios: the spoofed CEO invoice, the fake Teams login, the vendor who changed bank details. Then a monthly simulated phish so the lesson stays fresh. Click rates tracked by team, not by name, and the people who report phishes get thanked.
03
Prove it
A one-page security posture report every quarter: the five basics, their status, the evidence, what changed. Written to answer the insurer's questionnaire line by line. Monthly checks that nothing drifted: new devices, new accounts, exceptions. Access reviewed when people leave.
WHAT YOU GET
Not a firewall.
Five yeses you can prove.
Measured, not promised. Every one of these is checked with you before we call it done.
The five basics,
everywhere.
MFA enforced, one password manager, every device encrypted and wipeable, email authenticated, endpoint protection on. For everyone, by policy.
A team that
spots the phish.
Training on your real scenarios, a monthly simulated phish, click rates tracked by team. The lesson stays fresh because it keeps being tested.
A report the
insurer accepts.
One page, every quarter: status, evidence, what changed. Written to answer the questionnaire line by line, so the 'yes' is true.
Pairs with Backups.
Protected Workplace stops most bad days from starting. Backups makes the ones that start survivable. Most organizations need both and have neither.
HOW WE KEEP IT TRUE
By policy,
not by asking nicely.
Security that depends on people remembering doesn't hold. These rules make it hold, agreed in week one.
01
Enforced, not encouraged.
MFA, encryption and the password manager are set by policy. Nobody can opt out by being busy.
02
Every device is known.
If it touches organization data, it's enrolled. Unknown devices lose access until they are.
03
Exits close the door the same day.
Access removed, devices wiped or returned, logged. No ex-employee with a live login.
04
Evidence, every quarter.
If it isn't in the report with a date, it isn't done.
House rule
You own everything.
The prompts, the agents, the rules, the templates, the data and the accounts. Everything is set up in your tenant, in your name. Leave any time and take all of it; nothing GoodOps builds is a reason to stay.
Your tenantYour accountsNo lock-in
THE 30-MINUTE MINI-DIAGNOSTIC
Your rollout plan,
before you commit to anything.
Three questions: which of the five basics are actually on for everyone, what did you tell your insurer, and what's already in your Microsoft or Google plan unused? Every tool lands in one of four states. That list is the plan.
Activate
You have it. It's off.
Business Premium or Workspace includes device management and protection nobody configured. We switch it on.
e.g. Intune, Defender for Business, Workspace endpoint managementOptimize
It's on. Half the people.
MFA on email only; a password manager two people use. We make it everyone, by policy.
e.g. Partial MFA, shared password docMigrate
Three security tools, no owner.
An antivirus, a VPN and a trial of something. We replace them with the five basics.
e.g. Legacy antivirus, consumer VPN, trialsGood to go
Already working.
A tested backup or a managed provider you trust. We include it in the report.
e.g. Managed backup, existing MDM done rightWe run this on ourselves.
GoodOps answers its own insurer from the same quarterly report. We'll show you ours.
6 WEEKS, THEN IT JUST RUNS
Clear steps.
A clear "done" for each.
You approve before we move to the next step. We start with one team or one cycle, prove it, then roll it out to everyone.
Weeks 1–2
Switch on
MFA enforced, password manager rolled out, devices enrolled and encrypted, email authentication set. Unknown devices found.
Weeks 3–4
Train
60-minute session on your real scenarios. First simulated phish. Click rates by team. Exits process built.
Weeks 5–6
Prove
First quarterly posture report, written to the insurer's questionnaire. Exceptions closed. Owner's guide handed over.
Ongoing
Looked after
Runs on your GoodOps retainer. Monthly drift checks and phish test; quarterly report; access review on every exit.
HOW IT'S SOLD
Typically CAD 8k–15k, fixed after the mini-diagnostic.
Then Protected Workplace runs on your GoodOps fractional retainer. Configuration, rollout and the first report are the module. Licences you already pay for do most of the work.
The mini-diagnosticThirty minutes. Where the problem lives today, where it needs to go, and a four-state plan for every tool.
Free30 minutes
Set-up & rollout6 weeks. Fixed after the mini-diagnostic, based on your size and how many places the problem lives today.
CAD 8k–15ktypical, fixed after the call
Looked afterIncluded in your GoodOps retainer: checks, quality reviews, new features, a named contact.
Retainerno separate care fee
Software: Microsoft 365 Business Premium or Workspace Business covers devices and endpoint. 1Password CAD 8–12 and awareness training CAD 3–8 per person per month.
FAIR QUESTIONS
Before you
say yes.
The things owners ask us on the first call.
We have antivirus. Isn't that enough?
Antivirus is one fifth of one of the five. Most incidents in organizations your size start with a password, a phish or an unmanaged laptop, none of which antivirus addresses. The five basics do.
Our insurer already renewed us. Why does this matter?
Because you signed a questionnaire. If a claim is investigated and the 'yes' wasn't true, it can be denied. The quarterly report makes every yes provable with a date.
Will MFA and device management annoy the team?
For a week. Then it's a tap. We roll it out with the training so people understand why, and the password manager removes more friction than MFA adds.
What about personal phones used for email?
Managed lightly: the work apps are protected and wipeable, the personal side is untouched. Or we provide a work profile. Either way, no organization data on an unknown device.
Does this include backups?
No; that's the Backups module, and they pair. Protected Workplace stops most bad days from starting. Backups makes the ones that start survivable.
What does it cost?
The 30-minute mini-diagnostic is free. From it you get a fixed price for the six-week rollout, typically CAD 8,000–15,000 depending on headcount and devices. Once live, it runs on your GoodOps retainer, including the monthly checks and the quarterly report.
FIVE YESES YOU CAN PROVE.
Answer
the insurer
honestly.
Book the 30-minute mini-diagnostic. We'll check which of the five basics are really on, what you told your insurer, and give you a four-state plan for every tool.
A conversation about your organization.
Not a demo of software.