Security by design

Identity
Passkeys/FIDO2, conditional access, least‑privilege roles.
Devices
Baseline hardening, patch cadence, managed endpoint protection.
Data
M365 backups, versioning and regular recovery tests.
Detection
Log streaming, UBA and tuned alerting.