Know what security you have in place, and have it in writing before someone asks for it. Citadel Security reviews how your security is set up, keeps watching it, and keeps the record up to date.
Most businesses discover the gap when somebody puts them on the spot. A renewal form arrives, a client sends a 40-question security questionnaire, or an auditor asks to see how something is set up, and nobody has ever written it down. You almost certainly have security in place already. Citadel Security adds three advanced services to what Elevate includes, and it gives you a written record you can send the same day somebody asks.
Every quarter we scan your systems from the outside to find exposed weaknesses. You see what an attacker could see and what we recommend fixing first.
We monitor each of your domains for stolen credentials on the dark web. If a staff password is exposed, it can be changed before somebody uses it.
Managed detection and response detects, investigates, and responds to threats. A dedicated person reviews alerts alongside the automated tools.
You get a response plan with a list of who to call if something goes wrong. You also get a written record of your security setup, kept up to date.
Added to either Elevate plan
No IT company can promise that a business is protected, and we do not try. What we can do is show how your security is set up, write it down, keep it up to date, and hand it over.
You can answer a renewal form from a written record of your setup.
You can return a client’s security questionnaire the day it arrives.
You can show an auditor in writing how each part is set up.
You can see where you are exposed and what we recommend fixing first.
You can follow a written plan and a call list if something goes wrong.
You can rely on a record that we check and update as things change.
The complimentary assessment reviews your security setup against the questions insurers and auditors ask. It takes two weeks and ends with a written report and a 45-minute walkthrough of what we found. The report is yours whether or not you work with us.
No service can make a business compliant by itself, and we do not claim that Citadel Security does. Compliance depends on your policies, your staff, your contracts, and how you handle information every day, as well as on your technology.
What Citadel Security does is cover much of the technical side and give you the paperwork to show it. Privacy laws such as PHIPA for health information in Ontario and PIPEDA for commercial organizations in Canada require you to protect personal information with safeguards that suit its sensitivity. Client contracts and security questionnaires usually ask for specific measures, such as multifactor authentication, monitoring, tested backups, and an incident response plan.
Citadel Security provides vulnerability scanning, stolen-credential monitoring, and managed detection and response. It gives you a written response plan.
And it gives you a written record of how your security is set up, kept up to date. When an auditor or a client asks how you protect information, you can show them.
For clinics, we write down how your PHIPA obligations are met on the technical side, and we set up every location the same way so that an audit at one site does not become a project at all of them.
For legal questions about what a law or contract requires of you, speak to your lawyer or privacy officer. We work from their answer and set up the technology to match.
Insurers now ask detailed questions before they offer or renew a cyber policy, and the answers have to be accurate. If you make a claim, the insurer can compare what you wrote on the form with what it finds on your systems.
A typical form asks where multifactor authentication is turned on, and it asks about email, remote access, administrator accounts, and backups separately. It asks whether your backups are kept apart from your network and when you last restored from one. It asks you to name your endpoint protection and say whether anybody watches the alerts. It asks how quickly you apply urgent updates, who holds administrator rights, when staff were last trained, whether you have an incident response plan, and what access your suppliers have.
Citadel Security helps in two ways. The services themselves answer several of the questions. Managed detection and response means somebody is watching the alerts. Incident response planning means the plan exists and has a call list. Vulnerability scanning shows you are checking for weaknesses.
The written record helps with the rest. It sets out how your security is set up, so you or your broker can fill in the form from a document instead of chasing answers from several people.
We cannot tell you whether an insurer will offer coverage or at what price. Those decisions belong to the insurer.
Elevate is the base and Citadel Security is added on top of it. Elevate already includes a firewall for up to 75 users, endpoint protection, email threat protection, patching, backups, and multifactor authentication. Those are the basics that keep everyday threats out.
Citadel Security adds three advanced services. Quarterly external vulnerability scanning identifies exposed weaknesses. Stolen-credential and dark-web monitoring for each domain identifies exposed login details. Managed detection and response detects, investigates, and responds to threats. Citadel Security also adds the response plan and the written record.
Because the same team delivers both services, the work connects. If a vulnerability scan finds a system that needs a patch, the people who manage your patching already know about it. If stolen-credential monitoring finds an exposed password, the people who manage your Microsoft 365 accounts can reset it. If an alert needs somebody to look at a computer, the help desk your staff already use can do it.
With separate IT and security vendors, each of those steps involves a handoff, and handoffs are where things get missed. With one team, a finding goes to the people who can fix it.
Both services appear in the same written plan, and we review them with you in the same meeting. You have one account, one team to call, and one place where everything is written down.
It starts with the assessment, which takes two weeks from the day we get access. We look at your systems, your security setup, your software licenses, and your risks, and we compare your security with the questions insurers and auditors ask. You receive a written findings document and a 45-minute walkthrough.
The plan follows and takes about a week. It lists what we would do, in what order, and what each part costs, with a firm price. It also lists what we would leave for now.
Setting up the services is scoped in the plan because it depends on your setup. The number of domains affects stolen-credential monitoring. The number of systems that face the internet affects vulnerability scanning. The number of computers and servers affects managed detection and response. For a business already on Elevate, we already manage the systems and have them written up.
The written record begins with the assessment findings and is filled in as each part of the service is set up. The response plan is written with you, because it needs your decisions about who should be called and who speaks for the business.
If you have an insurance renewal or a client deadline coming, tell us the date at the start. We can put the items that the form asks about at the front of the plan.
Antivirus and a firewall stop some attacks, and every business should have them. They are part of Elevate for that reason. They do not do three things that businesses are now expected to do.
First, they do not tell you where you are exposed. A firewall blocks traffic according to its rules, but it does not check whether a system that faces the internet has a known weakness. Quarterly external vulnerability scanning does that.
Second, they do not tell you when your passwords are already in somebody else’s hands. Staff reuse passwords, and other companies’ data breaches expose them. Stolen-credential and dark-web monitoring checks for login details from your domains so they can be changed.
Third, they raise alerts but do not decide what to do about them. An alert that nobody reads does not stop anything. With managed detection and response, alerts are investigated and acted on, and a dedicated person reviews them alongside the automated tools.
There is also the question of paperwork. Antivirus gives you nothing you can hand to an insurer or a client. When a renewal form asks which endpoint product you use, where multifactor authentication is turned on, and whether you have a response plan, the insurer expects specific answers. Citadel Security keeps those answers in a written record that we keep up to date.
It means you can show another person, in writing, how your security is set up. That is different from believing you are secure, and it is what insurers, auditors, and clients now ask for.
Most businesses have security in place. They have a firewall, antivirus, backups, and often multifactor authentication on email. What they usually lack is a document that says what is installed, where it applies, who has administrator access, how backups are tested, and what happens if something goes wrong. Without that document, a simple question from a broker can take days to answer, and the answers may be guesses.
Citadel Security produces that document and keeps it up to date. We review how your security is set up against the questions insurers and auditors ask.
We keep watching through vulnerability scanning, stolen-credential monitoring, and managed detection and response. When something changes, the record changes.
We are careful about the words we use. We say you can show how your security is set up. We say we have it in writing and it is up to date. We do not say you are protected, that we can prove you are secure, or that you will not be breached. No IT company can honestly promise those things.
For each part of your security, the record says what is in place, who looks after it, how it is checked, and what you can show. You can send it the day somebody asks for it.
If you are a Citadel Security client, you follow a plan that was written in advance. The plan sets out who gets contacted first, what gets isolated, and who talks to your insurer and your clients. It includes a list of who to call. Nobody has to work those things out at 2 a.m. while the incident is still going on.
The first priority in any incident is to stop it from spreading. That usually means disconnecting affected computers or accounts from the rest of your systems. The second is to understand what happened and what information was involved. The third is to restore what was affected, which is where tested backups matter. The fourth is to tell the people who need to know. Depending on your business and the information involved, that can include your cyber insurer, your clients, a regulator, and your own staff.
Many of these steps have deadlines. Cyber insurance policies generally require you to report an incident promptly and may require you to use the insurer’s approved responders. A plan written in advance records those requirements, so you do not breach the policy by accident.
We do not promise that an incident will never happen. No IT company can honestly promise that. What we can tell you is that you will have a plan, a call list, and people who know your systems.
Citadel Security is the managed cybersecurity service from Unimatrix. It is built for businesses that have basic security in place and now need to watch it more closely and show how it is set up.
It adds three advanced services to the baseline security that comes with Elevate. The first is quarterly external vulnerability scanning, which checks your systems from the outside to find weaknesses an attacker could see. The second is stolen-credential and dark-web monitoring for each of your domains, which tells you when staff login details have been exposed. The third is managed detection and response, which detects, investigates, and responds to threats. A dedicated person reviews alerts alongside the automated tools.
Citadel Security also includes two documents. Incident response planning gives you a plan, written in advance, for what to do if something goes wrong, with a list of who to call. The written record sets out how your security is set up and is kept up to date, so you can hand it to an insurer, an auditor, or a client.
The service starts with a review of your security against the questions insurers and auditors ask. After that, we keep watching and keep the record up to date.
Citadel Security is usually taken together with Elevate under one account. The same team delivers both, so your IT and your security are handled by people who know your systems.
A one-time audit gives you a report on how your security looked on the day it was done. That is useful, and our complimentary assessment works the same way. The limit is that security does not stay still. Staff join and leave, new software is added, passwords are exposed in other companies’ breaches, and new weaknesses are found in products you already use. A report from last year tells an insurer very little about today.
Citadel Security is ongoing. Vulnerability scanning is repeated every quarter, so new weaknesses are found as they appear. Stolen-credential monitoring covers each of your domains. Managed detection and response watches for threats and acts on them. The written record is updated when your setup changes, so the document you hand over matches what is in place.
The other difference is that somebody acts on the findings. An audit report often lists dozens of items and leaves the business to work out what to do.
Under Citadel Security, findings go into your plan in priority order, and the team that manages your systems does the work.
You can start with the assessment and then decide. If the findings are few and your current provider can fix them, you may not need more. If the findings show that nobody is watching your security or writing it down, Citadel Security is designed to fill that gap.
Under Citadel Security, a dedicated person on our side reviews alerts alongside the automated tools. The tools do the first pass. They collect activity from your systems and flag anything that looks unusual. A person then decides whether the alert is real and what should happen next.
That second step matters because security tools produce a lot of alerts and most are harmless. If nobody is responsible for reading them, the important one gets lost among the rest. Many businesses own good security products and still miss an attack for this reason.
The exact hours of monitoring coverage, and who is responsible for each step of the response, are defined for your account. We confirm them with you as part of your assessment and write them into your plan, so you know what is covered and when. We would rather set that out precisely for your business than make a general claim on a web page.
It also helps to know who to contact on your side. During onboarding we agree who we call first if we see something serious, how we reach them outside working hours, and what we are authorized to do on our own, such as isolating a computer from the network. Those decisions go into your incident response plan, so they have been made before anything happens.