Service
CIS Hardening & Secure Score
CIS Microsoft 365 Foundations, staged by maturity, with audit-ready evidence.
Who it's for
- Organisations at any maturity level securing their Microsoft 365 tenant
- Mid-market and regulated businesses needing evidenced hardening
- High-risk organisations targeting an advanced security posture
What's included
- CIS M365 Foundations assessment against 100+ controls
- Staged remediation across IG1 (Essentials), IG2 (Intermediate) and IG3 (Advanced)
- Microsoft Secure Score uplift and tracking
- Audit-ready evidence binder
- Board-level reporting on posture and progress
Staged by CIS Implementation Group
QG delivers end-to-end CIS assessment and remediation against 100+ controls, producing an audit-ready evidence binder.
01
IG1: Essentials
The 'must-do' baseline: MFA, Conditional Access, basic logging, secure email, admin hygiene. Target: every organisation.
02
IG2: Intermediate
Adds depth: advanced monitoring, granular DLP, stronger device controls, incident response. Target: mid-market & regulated.
03
IG3: Advanced
Highest maturity: advanced SOC, extensive logging, pen-test readiness. Target: regulated / high-risk organisations.
How we work
- 1
Assess
Baseline assessment against the CIS M365 Foundations benchmark (100+ controls).
- 2
Prioritise
Map findings to IG1/IG2/IG3 maturity and agree the target implementation group.
- 3
Remediate
Staged remediation with Secure Score uplift at each stage.
- 4
Evidence
An audit-ready evidence binder documenting every control and its status.
Secure Score: from baseline to target
| Stage | Typical Microsoft Secure Score |
|---|---|
| Pre-engagement baseline | 25–40% |
| After Business Premium rollout | 55–60% |
| After Microsoft 365 E3 | 60–75% |
| After Microsoft 365 E5 full stack | 75–100% |
Common questions
01What is an Implementation Group (IG)?
CIS defines three maturity tiers. IG1 (Essentials) is the must-do baseline for every organisation; IG2 (Intermediate) adds depth for mid-market and regulated firms; IG3 (Advanced) targets regulated, high-risk organisations. We assess where you are and take you to the right tier.
02Do we get evidence we can show auditors?
Yes. The engagement produces an audit-ready evidence binder documenting each of the 100+ controls, mirroring the audit-ready discipline the QG group applies across all its work.
Let's build your certification roadmap
Book a short discovery call to talk through your current systems, sector and target standards. We'll come back with clear, practical next steps.