How is this different from Microsoft Secure Score?+
Secure Score measures general configuration quality but doesn't map to specific regulatory frameworks or produce the compliance evidence auditors require. Our assessments produce framework-specific scores — E8 maturity levels, NIST CSF function ratings, CMMC practice gaps, NIS2 Article 21 coverage — with per-control pass/fail evidence and remediation guidance.
Which frameworks and regions do you cover?+
We offer 23 products across 3 tiers. Assessments (12): Essential Eight, MCSB, CIS M365, Copilot Readiness, CPS 234, Ransomware Resilience, Power Platform, NIST CSF 2.0, CMMC, NIS2, Cyber Essentials, MAS TRM. Security Packs (7): Entra ID Hardening, Email Security, SharePoint Oversharing, Finance, Legal, Endpoint/Intune, Healthcare. Intelligence Reports (3): Cyber Insurance Readiness, Board Cyber Risk, Investor-Ready Security. Regions: AU, US, EU, UK, SG.
What happens if a check fails?+
Every failed check includes a remediation action with the exact Intune, Entra, or Azure portal path to fix it. High-severity failures are called out at the top of the report. The monthly subscription shows your score trend over time so you can demonstrate improvement.
Can I bundle multiple assessments?+
Yes — purchase assessments individually and they'll run as separate assessments against the same tenant. Bundle pricing available on request for two or more products. Contact assessments@baref00t.io.
Do you support multi-tenant or MSP use?+
Yes. If you manage multiple tenants as an MSP, contact us for volume pricing. Each tenant requires a separate consent grant, but reports are delivered per-tenant and can be white-labelled for your clients.
How do I revoke access after the assessment?+
Entra ID → Enterprise Applications → search "baref00t" → Delete. Done in 30 seconds. You can also do this from the Microsoft MyApps portal (myapps.microsoft.com). Access is revoked immediately — no notice period, no support ticket.
Where is my data processed?+
Assessments run in the Azure region closest to you — Australia East, US East, West Europe, or Southeast Asia. Your tenant data never leaves the processing region and is not retained after the report is generated. Only the report output is stored, accessible via the secure link sent to you.
What currencies do you accept?+
We accept USD, AUD, GBP, EUR, and SGD. Your currency is auto-detected based on location and can be changed using the currency selector in the navigation bar. All 23 products are priced in all 5 currencies. Payments are processed securely via Stripe.
Do I need CMMC Level 1 or Level 2?+
Level 1 (17 practices) is for contractors handling Federal Contract Information (FCI). Level 2 (110 practices, mapped to NIST SP 800-171) is for those handling Controlled Unclassified Information (CUI). Most DoD contractors handling sensitive data need Level 2. Our assessment lets you select either level and identifies your gaps to certification.
Is the E8 assessment suitable for PSPF compliance?+
The E8 assessment covers all controls in the ACSC Essential Eight Maturity Model at ML1, ML2, and ML3 — the framework assessed under the PSPF. Note: formal PSPF compliance at PROTECTED level requires an IRAP assessment. Our report is ideal for identifying gaps and preparing for one.
What does the NIS2 assessment cover?+
It assesses all 10 Article 21 cybersecurity risk-management measures — from risk analysis and incident handling to supply chain security, encryption, and multi-factor authentication. Automated checks cover identity, access control, and detection. A governance questionnaire covers policy, training, and business continuity evidence.
How does the Ransomware Resilience score work?+
We assess seven dimensions — Identity (20%), Backup (20%), Endpoint (15%), Email (15%), Data (10%), Network (10%), and Detection (10%) — with weighted scoring. Each dimension produces a percentage score, and the composite gives you an overall resilience rating: Strong, Moderate, Weak, or Critical Risk. The report highlights the highest-impact remediation actions first.