An all Mac team, ready for a formal security audit.
How TUCU secured an all Mac corporate communications firm so it could pass a formal IT security audit and keep its largest client.
Client since
2020
Industry
Corporate Communications
Team size
70-75 staff
This spotlight is published without the client name at their request.
Results at a glance
From self assessed questionnaires to passing a formal, evidence based IT security audit.
The controls the audit asked for are now in place and reviewed every year.
Additional high value clients secured with new data security controls.
Their largest client, a global leader, increased channel and partner security requirements.
For years that client accepted a self assessed IT security questionnaire from smaller organizations it did business with. As cyber threats against supply chains grew, it moved to a formal IT security audit for all channel partners, regardless of size.
That put the firm’s biggest revenue relationship on the line, and it exposed a gap that is common, which is that Macs feel safe. They are well built and they ship with good security features. But a secure computer and IT security are very different things. An auditor does not ask what features a computer has. An auditor asks how data is protected, what you enforce, how you prove it, and what happens if a device goes missing.
To answer those questions, pass their audit, and keep the client, the firm needed security controls applied across the board, quickly.
With experience in channel partner security screenings, TUCU was able to help them move quickly.
We started by reading the client’s actual security requirements list line by line, then mapped each requirement to a control we could implement and evidence. No guessing at what the auditor might want.
Controls were organized against NIST Cybersecurity Framework practices. That framework matters here for a practical reason rather than a technical one. It gives you a structure and a vocabulary the person reviewing your answers already knows.
Specifically, TUCU enabled:
Entra ID as the identity foundation, connecting users, devices and cloud applications under one directory with conditional access on company data.
Apple Business Manager for device provisioning and managed Apple IDs, so accounts and devices belong to the company rather than the individual.
Microsoft Intune enrolment for every Mac, enforcing FileVault encryption, update policies and application control.
Data classification and sensitivity labelling, so a file marked confidential is encrypted and cannot be forwarded, shared or printed outside approved boundaries.
Data loss prevention policies across Microsoft 365.
Retention labelling with defined deletion timeframes for client owned material.
Audit logging across services and devices that touch client data.
The firm works with one TUCU team for security, device management and day-to-day support.
Every control the audit asked for is documented and reviewed every year, so the next audit is a review of work already in place, not a scramble.
Has a client asked for a formal IT security audit?
We map each requirement to a control we can implement and evidence.
About this client
Their work for large organizations is confidential by nature. The team runs on Apple, and work moves fast between full time staff and contractors.
Cybersecurity controls are consistent across many industries, but you have your own challenges and workflows. TUCU is here to help you balance both.
Schedule a call to discuss how we can help you.
