Managed IT Security, Monitoring & Backup Services
DRAFT VERSION How Olive Branch IT supports eXpress badging’s internal systems through endpoint protection, security monitoring, updates, backups and workforce awareness.
- Service Scope and Responsibilities
- Endpoint Protection and Remote Management
- Updates, Vulnerability Management and Lifecycle Support
- Security Monitoring and Incident Escalation
- Backup, Retention and Recovery Verification
- Email Protection and Security Awareness
- Device Encryption and Remote Access
- Credential Exposure Monitoring
- Support, Records and Security Evidence
- Governance and Supporting Documentation
DRAFT VERSION
Service Scope and Responsibilities
eXpress badging® (EBS) works with Olive Branch IT (OBIT) to protect and maintain its internal computers, servers, network and Microsoft 365 environment. The service combines preventive safeguards, ongoing monitoring, managed response, backup protection and technical support.
This article describes OBIT’s existing services and the additional security services approved by EBS. It supports EBS’s “Security Obsessed” core value and ongoing alignment with the NIST Cybersecurity Framework 2.0.
OBIT’s current administrative scope includes EBS’s managed, domain-joined computers and servers and its Microsoft 365 environment. OBIT also supports applicable internal network equipment and security configurations.
EBS retains business ownership of its systems, information, policies and customer commitments. OBIT provides the technical services within its agreed scope. EBS’s AWS-hosted website, Veonics® Portal and other cloud application environments have separately assigned technical responsibilities. Coverage of one environment should not be assumed to extend to every EBS platform or a fulfillment partner’s systems.
Endpoint Protection and Remote Management
OBIT uses remote management and monitoring (RMM) tools to identify hardware and software issues and maintain visibility into managed devices. These tools track device information, software, maintenance activity, user logins and failed login attempts.
Managed computers and servers receive layered security protection, including:
- Managed antivirus operating continuously.
- Endpoint detection and response (EDR), with third-party monitoring 24 hours a day, seven days a week.
- Ransomware detection and protection.
- DNS-based web filtering, with centrally managed allow/block settings.
- Tamper protection restricting local changes to managed security settings.
Detected threats can trigger device isolation and alerts to OBIT. Response actions depend on the nature of the threat and the capabilities of the affected system.
Updates, Vulnerability Management and Lifecycle Support
OBIT manages updates for covered computers, servers and supported applications on a weekly schedule. Emergency Windows security updates are addressed as soon as possible.
RMM tools help identify hardware and software vulnerabilities, track installed software and support maintenance of applications such as web browsers. Device and software information also supports decisions about updates, replacement and continued supportability.
Maintenance records and device reports provide evidence of activity within OBIT’s managed environment. Application-specific and AWS maintenance remain with the providers responsible for those environments.
Security Monitoring and Incident Escalation
Existing endpoint monitoring focuses on threats involving files, programs, malware, ransomware and suspicious device activity.
Approved addition: RocketCyber managed security monitoring. EBS has approved deployment of RocketCyber to add centralized analysis of security events from configured devices and supported log sources.
RocketCyber’s managed security operations service provides 24/7 monitoring of the connected sources. Security-event analysis supplements endpoint protection by helping identify suspicious authentication activity, potential exploitation and security-relevant configuration changes.
RocketCyber alerts OBIT to identified concerns. OBIT prioritizes investigation and coordinates the appropriate technical response. Coverage depends on the systems connected and configured during deployment.
EBS leadership coordinates business decisions and customer communications through EBS’s established incident-response process. Monitoring alerts are evaluated to determine their significance and the appropriate containment, investigation and recovery actions.
Backup, Retention and Recovery Verification
OBIT manages Datto-based backup services for EBS’s main internal server, ExpressSVR, and a separate cloud backup service for Microsoft 365.
| Environment | Backup and recovery arrangements |
|---|---|
| Internal server | Incremental backups every hour between 8 a.m. and 5 p.m. on weekdays. Backup data is encrypted in transit and at rest, stored on a managed local backup appliance and replicated to U.S. East Coast and West Coast facilities. |
| Internal server retention | Approximately one month of local history and 365 days of cloud history. Restore-point frequency reduces as backups age; year-long retention does not mean every hourly version is retained for a year. |
| Microsoft 365 | Cloud backups three times daily for email, OneDrive and SharePoint, with encryption, replicated storage and one year of retention. |
The internal server’s daily verification process assembles a virtual copy from backup data and starts it to confirm that it can boot. Backup integrity checks and monitoring also help identify corruption, unusual file changes and conditions that could interfere with recovery.
This verification provides evidence of backup integrity and bootability. Recovery of a particular application, file or complete business workflow depends on the applicable restoration procedure and validation.
Backup administration is restricted through OBIT’s management platform. Protection relies on encryption, controlled management access and separation from ordinary user access. These arrangements are described as managed backup isolation rather than a physically disconnected backup system.
Email Protection and Security Awareness
EBS’s Microsoft 365 email environment uses Microsoft phishing and spam protections together with INKY filtering for suspicious messages, dangerous content, links and impersonation attempts. Additional SaaS security monitoring records relevant account changes and suspicious sign-in activity.
Approved addition: BullPhish security awareness and phishing simulations. EBS has approved a program that supports simulated phishing campaigns, follow-up training and management reporting.
OBIT configures campaigns in coordination with EBS. Results help identify where additional guidance is needed and support ongoing employee education. These activities complement EBS’s onboarding cybersecurity training and continuing internal security communications.
Device Encryption and Remote Access
OBIT’s remote-access tools require two-factor authentication for access to managed computers and servers. Authorized support personnel use these tools to investigate issues and perform maintenance.
BitLocker drive encryption is deployed on designated EBS workstations. Where enabled, OBIT tracks recovery information through its management tools. Actual encryption status is determined from device configuration and inventory records.
Drive encryption helps protect stored information when a device is powered off or its storage is accessed without authorization. Passwords, session locking and endpoint protection provide additional safeguards during normal use.
Credential Exposure Monitoring
Approved addition: Dark Web ID monitoring. EBS has approved monitoring for company-authorized identifiers, such as business email addresses, to help identify potentially exposed credentials or related information.
Alerts support investigation and appropriate actions, such as changing an affected password, reviewing account activity and checking authentication protections. Exposure alerts are assessed in context; an alert alone does not establish that an EBS system has been compromised.
Support, Records and Security Evidence
OBIT’s HELP! ticketing system records support requests and work performed. Supported requests can include device diagnostics to assist investigation and resolution.
RMM records and available service reports can support reviews of managed devices, installed software, maintenance, security events and remediation activity. Reports or audits can be requested from OBIT. Available evidence depends on the relevant service, configuration and retention period.
Authorized OBIT personnel and supporting technology providers process the operational information, security telemetry or backup data needed to deliver their respective services. Sensitive security findings and technical details are shared through appropriate authorized channels.
Governance and Supporting Documentation
EBS uses these services as part of its broader cybersecurity risk-management program. EBS leadership owns policy and customer obligations; OBIT manages the technical services within its scope; separately assigned providers manage other environments.
NIST CSF 2.0 provides an organizing framework for these activities. The use of managed security tools supports the program but does not itself constitute certification or establish compliance with every customer requirement.
Newly approved services are represented as operational only after deployment and coverage have been confirmed. This article should be updated when service scope, provider responsibilities or material configurations change.
https://support.expressbadging.com/knowledge/cybersecurity-incident-response-reporting-process
https://support.expressbadging.com/knowledge/what-is-asset-management