Ricoh Cybersecurity Assessments

The assessment reviews areas that most directly shape M365 security posture, including identity and access (Entra), email protection (Exchange), collaboration, and sharing settings, along with device management. Deliverables focus on the posture baseline and priority actions which are tailored to your organisation.

M365 environments often grow over time across identity, collaboration, and data. Visibility can become fragmented, and posture can drift through small changes in users, access, sharing, and integrations. These changes can create M365 security vulnerabilities for attackers to exploit. A structured assessment provides a consolidated view of posture and a clear priority order for action.

This assessment is best suited to organisations where M365 is business-critical, and security posture needs to be clear and defensible. Common triggers include recent cybersecurity incidents, tender requirements, cyber insurance discussions, remote work, and third-party access.

Access is kept to the minimum needed to complete the review and confirmed during scoping. The assessment is designed to be low impact and typically uses read-only access.

We audit M365 tenant security by reviewing identity and access controls, email and threat protection settings, Teams, SharePoint and OneDrive sharing and permissions, third-party access, and relevant security policies as part of our assessment, all done using Microsoft native APIs and connectors.

Typically, a M365 owner or IT lead is involved to confirm environment context and access. Where governance, risk, or tender requirements apply, a risk or compliance stakeholder may also be involved.

A detailed assessment report is delivered with an at-a-glance summary, priority findings, and recommended actions ranked by urgency, with scope stated upfront. You also receive a guided walkthrough session with a Ricoh expert to discuss your organisation’s next steps.

The assessment is non-disruptive. It’s point-in-time read-only discovery that runs in parallel of the day-to-day operations of your environment.

The Ricoh M365 Security Posture Assessment is aligned to Essential Eight. Where relevant, the assessment can provide context against ACSC’s Essential Eight maturity model (E8MM) and Essential Eight expectations to support tender, assurance, and audit conversations. Work outside M365 is clearly identified as out of scope, so gaps are not hidden.

Yes. The assessment gives you a comprehensive view of your M365 security posture and a prioritised set of actions. It supports ‘trust but verify’ by making priorities clear and easier to agree with your provider.

We recommend reviewing M365 security on a cadence that matches how often your environment changes and the level of assurance you need. Quarterly reviews suit organisations with frequent change (new users, new sites, new integrations, policy updates) or higher assurance requirements. An annual review suits more stable environments, with additional reviews triggered by major changes including tenant migrations, mergers or acquisitions, new third-party integrations, significant identity or MFA changes, and changes to data governance or retention requirements.