In my previous blog, I wrote that the Golden Tenant is not a myth, as long as you view it as a reference that grows with your organization. A single snapshot doesn’t count; only the most current one does. Nowadays, you must be ready at all times: after all, cyberattacks are becoming increasingly intelligent.
Most environments start out excellent
Almost every organization invests a lot of time in setting up Microsoft 365. The real challenge arises after that. Vendors are temporarily granted extra permissions, new functionalities become available, and exceptions sometimes persist unnoticed. None of these changes are significant on their own, but after a few years, the environment can deviate considerably from the original design.
An audit looks backward
“But didn’t we just do an audit?” In my view, that is not enough. An audit primarily tells you what the environment looked like on the day of the check. However, a cloud environment changes daily. Therefore, the question shifts from ‘Have we checked?’ to ‘Do we continuously know if our environment still aligns with our principles?’ For example, the addition of an AI application can already impact the information security level of your ISO 27001 certification.
From auditing to maintaining control
Auditing suggests you are looking for errors. It also carries a negative connotation. Maintaining control means understanding why something changes, which deviations are intentional, and which changes could introduce new risks. Gaining a grip doesn’t come from auditing more often, but from understanding changes.
How we at Secure at Work view a Golden Tenant
Our reference environment is continuously updated based on new Microsoft functionalities, current security guidelines, and changing compliance requirements. We then compare customers’ Microsoft 365 environments with that reference. Not to automatically adjust everything, but to provide insight into deviations and the informed choices that are best made, taking the relevant industry into account.
Ultimately, this provides something that every CISO, IT manager, or board member needs: peace of mind. Not because nothing ever changes again, but because you can always explain why your environment is configured the way it is today.
Perhaps that is the best definition of a Golden Tenant.
Need help explaining your security level?
Contact us if you would like to discuss this further. We are happy to share our experiences.
Joost Gelijsteen
Back to Blogs
