From zero measurement to a secure workplace: a step-by-step plan

Sept 22, 2026 (updated on Nov 11, 2026)

"Replace everything" is the fear that opens every security discussion, and rightly so. An organisation that tears its entire IT environment apart grinds to a halt. The good news is that replacement is rarely necessary. Steering is. But steering starts with knowing where you stand, and that starting point deserves more attention than it usually gets.

In this article: how to build a baseline assessment that actually tells you something, using scores, an official framework and the right tools. And how to work from that starting point towards a secure workplace in five steps. This is the path as we see it work with customers. Not theory, but the sequence that works time and again.

Step 1: measure the cheapest risk

Start with e-mail, because that is where almost every attack on an SME begins. Phishing is the front door, spoofing the window next to it: whoever can imitate your domain sends your customers invoices that look entirely credible. The free e-mail scan shows within seconds whether someone can send mail that appears to come from your domain. It costs nothing and it tells you something about the door that stands open the widest.

A red verdict is not a disaster, and a green one is not a certificate. The scan measures the SPF, DKIM and DMARC settings of your domain, the first hurdle for anyone who wants to impersonate you. Above all, it is the fastest way to experience that security is measurable, which is precisely the mindset the next step needs.

Step 2: do the baseline assessment, and do it properly

A baseline assessment is more than a checklist of settings that happened to be on someone's list. A good one draws on three sources that complement each other: the scores Microsoft already puts in your portal for free, an official framework that says what actually matters, and tools that automate the fieldwork. None of the three is new or secret on its own. The value lies in the combination, and in the honesty with which you read them.

Scores as a starting point

The most basic form of baseline measurement is already inside your Microsoft environment, and it costs nothing. Microsoft gives every tenant a Secure Score, a percentage in the Defender portal that summarises how many of the recommended security settings are active. You find it under Exposure management, and the report beneath it shows per recommendation what the impact is on your score and on your users. That advice is not academic: Microsoft builds it from how attacks have actually played out. Turn the score into a trend line and you know within a minute whether your position is improving or deteriorating. That is measuring without having to build the yardstick yourself.

A figure from practice: most SMEs we look at for the first time score somewhere between 40 and 60%, not because nobody tried, but because nobody ever took the time to click through the portal. That is exactly why the first measurement is useful rather than embarrassing. It shows the distance, and the distance is the roadmap.

Next to it sits the Exposure Score, which answers a different question: not how many settings are correct, but how exposed your organisation is. The two scores complement each other, one looks at what you do well, the other at where you remain vulnerable.

Honesty about the limits, because they are real. Scores are snapshots. They do not weigh what is specifically important to you. And you can inflate them with points that matter little in practice, or by switching off functionality the organisation needs. Then you have a beautiful score and a worse workplace. Treat them as what they are: the depth sign next to the pool, not the swimming lesson.

Test yourself against a framework: the CyberFundamentals self-assessment

Scores say nothing about the question management actually asks: are we doing the things that really matter? Belgium has an official answer to that. CyberFundamentals, CyFun for short, is the CCB's framework, aligned with the international NIST standard. The CCB publishes a free self-assessment tool alongside it. Fill it in and you know where your organisation stands on four levels: Small as the entry level, then Basic, Important and Essential, with each level including the previous one. The questions revolve around access, identities, patching, backups, logging and network protection. What the tool asks is that you can substantiate every answer. "Probably yes" is not an answer; a setting you can show is.

Why do the exercise if NIS2 does not formally oblige your organisation? Because the world around you is counting. Customers, insurers and public tenders increasingly ask for evidence instead of promises, and the CCB advises suppliers of essential organisations to implement at least CyFun Basic. According to the CCB's own material, the framework covers 82% of known attack techniques at the Basic level and 94% at Important. That is exactly why we recommend aiming high, even when nobody enforces it. Better to know you do not reach Important yet, than to assume Basic suffices.

One more warning from practice: a self-assessment is only as honest as the person filling it in. Whoever answers the question whether MFA is enforced for external access with "anyone can activate that" does not have Basic level but a spreadsheet dream. Fill in the tool with your IT partner, with the settings open next to it, and treat the result as a first measurement, not a diploma.

For organisations that do fall under NIS2, the link is even more direct: Belgium uses CyberFundamentals as the reference framework for evidence of implementation, and the deadline for important-classified organisations has already passed. The framework does not lose value after that. A self-assessment along CyFun also produces exactly the structure a later external audit needs: a status per theme, a piece of evidence per status. Whoever one day faces a customer with NIS2 expectations can impress today with an honestly filled-in tool rather than a slide deck full of intentions.

Let tools do the heavy lifting

The third source consists of tools that automate half the baseline assessment, and there are many of them now. For Microsoft 365, Maester is our favourite: an open-source PowerShell framework that uses more than 300 automated checks to see whether your tenant meets best practices, from Entra ID to Exchange Online and Intune. It builds on the controls of the American CISA and can run daily in a pipeline, so you do not have one report but a series of measurements. We use it for the baselining of our customers in the highest tier.

One term deserves clarification: read-only. Good assessment tools change nothing in your environment; they read configuration, compare it with best practices and report. That means a baseline assessment cannot disturb your production, and the barrier to starting is low. No "appropriate period" needed, no change window, no weekend. Reading is always allowed.

Whoever still has an on-premises Active Directory alongside it does well to add PingCastle. It measures the health of your domain with ordinary read rights, delivers a report with a health score and concrete findings within the hour, and often shows the path an attacker would follow through your rights structure. Exactly those paths surface in real life at organisations that believe they have "just a file server". The American government also publishes its own scanning suite for Microsoft 365 with ScubaGear; Maester already incorporates those checks.

The pitfall is obvious: more output is not more insight. Two hundred findings in a spreadsheet without priority is noise, and noise makes people deaf. Tools measure, people weigh. Someone has to translate the result into your context: which systems really matter, which licences you have, what the organisation can absorb this quarter.

That is precisely what our Security Audit does. More than 200 parameters in your Microsoft 365 environment, read-only and without impact on your production, then placed alongside CyberFundamentals with a maturity score per theme. The end result is a report your management understands and your IT partner can work with, with priorities instead of a list.

What a good baseline assessment yields

Three things, and none of them is a spreadsheet. First a baseline: a number with a date, because without a starting point every later measurement is an opinion. Second a priority list the organisation can absorb, with quick wins at the top and structural work below it. Third a report that reads well outside the IT department, because an assessment nobody understands changes nothing. With those three in hand you can start planning, and planning is the next step.

Step 3: choose, and write down what you will not do

A good report forces choices, and that is the point. What do we tackle first? What do we push to next quarter? What do we consciously accept, documented, because the risk is manageable and the remedy does not outweigh the cost?

That last category is not a loss. Not everything has to be perfect, but everything has to be accountable. A decided acceptance is control; an unconscious one is a miscalculation that surfaces later, usually at the worst possible moment. So write down not only what you do, but above all what you deliberately do not do, why, and until when.

Step 4: finish the foundation

Then the execution, and it involves homework with no glamour attached. MFA enforced everywhere, including for that one account that "always worked this way". Administrator rights pushed back to those who really need them, preferably granted for a short period rather than permanently. Devices in a compliance policy, so a laptop without a patch or a PIN never reaches your data. Backups that also exist outside Microsoft, because ransomware knows your tenant too. And logging that stays, even if that feels like cleaning with no audience.

The core of that list is no coincidence: they are almost literally the key measures of CyFun Basic, from MFA and least privilege to backups and logging. Whoever fills in the self-assessment of step 2 honestly sees this foundation appear on paper. Foundation, not rocket science. Your internal IT or partner can execute this, or we do it together.

One reassurance we get to give often: this foundation is the cheap part. What makes banks and large companies expensive is not the list above but the organisation around it: committees, framework documents, bureaucracy around every change. The ten things that really matter are achievable for an SME in weeks, not years. The baseline assessment of step 2 shows where you stand; this foundation is the first crew that clears the site.

Step 5: make it stick, with evidence

One audit is a photograph. Security is a film: settings expire, people come and go, Microsoft adds features that demand attention again. Today's baseline is history next year, unless someone repeats the measurement and guards the trend. The scores from step 2 make that light work: a Secure Score per quarter, a Maester run per month if you want, an exposure that falls instead of rises.

Making it stick also means there are reports you can show an auditor or a customer. Without that last part every improvement remains a promise based on trust, and trust is a poor replacement for evidence. Our managed services are precisely that motion: continuous monitoring, reporting at fixed moments, and someone who keeps watching permanently.

From baseline assessment to assurance, this path runs parallel to our services, and that is no coincidence: it is exactly how we work with customers.

Frequently asked questions

How long does a baseline assessment take?

The free e-mail scan takes seconds. The full baseline with the CyberFundamentals self-assessment costs you an afternoon if you fill it in alone, and typically two to five days when it results in a full Security Audit with a report. Read-only means your production stays untouched.

What if the assessment comes back bad?

Then it succeeded. The goal of a baseline assessment is not a pretty report but an honest starting point. Almost every first measurement at an SME shows gaps, precisely because nobody ever looked at it this way. Bad news on day one is good news in the quarterly plan.

Which CyFun level should my organisation reach?

Formally that depends on your NIS2 classification. In practice we recommend treating at least Basic as the floor and Important as the target, even if nobody enforces it. The distance between the two is smaller than the distance between knowing nothing and Basic.

Who do we work with? You decide who executes the recommendations: your existing IT partner, or us. We force nothing.

You know within days where you stand, no guessing required. Or first test for free whether your e-mail domain can be spoofed: the e-mail scan takes 2 seconds.