Security & compliance

There is no HIPAA certification, and PCI DSS and SOC 2 are attested by qualified independent assessors. ALCO gets you ready and keeps the evidence; the assessor or auditor makes the formal decision. We will never tell you otherwise.

Small businesses are the usual target because the controls are usually missing. The core set, MFA, backups, patched devices, trained people and a password manager, is affordable and most of this page is about doing those well.

Yes, as part of the service. The emails look like the real thing, the lesson for anyone who clicks is short and kind, and you see the trend each quarter.

Call the help desk; it is staffed around the clock. The incident plan we wrote together says who isolates what, who is told, and in what order.

Yes. A standalone assessment with a prioritised report is a common first step. You can fix the findings with us, with your own people or with someone else.

Yes. Managed EDR is part of the help desk plan for every managed device. It can also be added on its own.

A commercial EDR platform deployed and watched through ALCO's remote management tools. We will walk you through the product and the data it collects before anything is installed.

No noticeably. The agent is light, and we tune exclusions for the software you actually run.

No. EDR stops most attacks early. Backups are what you fall back on if something still gets through. We do both.

The device is isolated automatically if the alert is serious, and the on-call engineer investigates. You hear from us in the morning with what happened, or sooner if we need you.

Usually not. Google Workspace and Microsoft 365 both include strong filtering that is rarely configured well. We start there. If your risk calls for more, we will say so and why.

Not if it is done in order. We authenticate every sender first and watch the reports in monitoring mode before switching to reject. Nothing legitimate stops.

Yes. Forward it to the help desk. We read the headers and the links and give you a straight answer. There is also a free Learning Center video on doing it yourself.

Mail between major providers is already encrypted in transit. For content that must only be read by the recipient, we set up message-level encryption in your platform and show your team when to use it.

We can still fix SPF, DKIM and DMARC and review your mailbox security. We will also tell you honestly whether staying on your current mail host is wise.