Cyber insights
Short notes on the security decisions we see teams wrestle with most. These are our own views, grounded in public guidance and general practice, with no client or project detail.
Most public-sector environments are not greenfield. A workable Zero Trust program starts with identity and device signals on the systems that already exist, then narrows access as visibility improves, rather than waiting for a full re-architecture.
Informed by NIST SP 800-207
Control profiles lose their value when they are copied without tailoring. Deciding early which controls are inherited, which are shared and which the system genuinely owns is what makes an assessment package readable and defensible.
Informed by CCCS ITSG-33 guidance
When alerts are noisy, the constraint is rarely the platform. Reviewing log source coverage, mapping detections to relevant ATT&CK techniques and retiring rules that never produce action delivers more than another product.
Informed by MITRE ATT&CK
Tenant boundaries, identity models, logging retention and privileged role design set the ceiling on what can be secured later. These are worth deliberate design time before workloads start moving.
General practice
Standing administrative access is the most common finding we expect to see and the most tractable to fix. Time-bound elevation, an approval trail and a review cycle address it without disrupting operations.
General practice
AI tools tend to arrive faster than the data handling and oversight practices around them. Use-case triage, a documented data boundary and mapping to an accepted risk framework keep adoption inside an approved perimeter.
Informed by the NIST AI Risk Management Framework
If one of these matches a decision you are working through, we are happy to discuss it against your own environment.
Engage
Connect with Frank Dolphins regarding cybersecurity requirements, subcontracting, teaming arrangements and professional-services opportunities.