Services
IT and OT cybersecurity
IT policy, audits, penetration testing and industrial security. We review access, test your systems and verify the agreed fixes.
SMEs and industrial sites · Switzerland
IT policy, testing or a correction plan
Vanguard Systems works with SMEs and industrial sites in French-speaking Switzerland. We work on office IT and industrial systems (OT) with your team or IT provider.
You can commission an IT policy, a penetration test or several stages of corrective work. We choose testing methods and plan changes with the people who operate the affected systems.
An initial assessment
You need to decide what to address first.
Assessment of a defined scope, management summary and action plan. Duration depends on sites, systems and available documentation.
A focused engagement
You have a specific issue to resolve.
IT policy, penetration test, Microsoft 365 review, vendor access or restoration exercise. Scope and verification criteria are agreed before work starts.
A phased correction plan
Several fixes need to be coordinated.
We plan fixes with your IT and operations teams, then track their completion. Each work package has its own budget and maintenance window.
Our cybersecurity services
Security audit and assessmentUnderstand what is exposed, what is already protected and which issues to address first.
- Inventory of devices, applications, sensitive data and service providers.
- Review of configurations, access rights, backups and internet-facing services.
- Priorities based on business impact and dependencies between systems.
What you receive
Assessment, risk register and action plan with priorities, proposed owners and outstanding checks.
IT policy and security rulesSet out how staff may use their accounts, devices and company data.
- Acceptable use policy: email, passwords, remote work, personal devices, cloud tools and AI use.
- Information security policy, information classification and rules for sharing with third parties.
- Joiner and leaver procedures, access approval, incident reporting and exception reviews.
What you receive
Editable policies, responsibility matrix and staff briefing material. HR and legal clauses are submitted to your responsible teams.
Accounts, endpoints and Microsoft 365Remove permissions that are no longer needed and check account, endpoint and external sharing protections.
- Review of administrator, shared and service accounts, including permissions no longer needed.
- Multifactor authentication (MFA), recovery procedures and conditional access subject to your licences.
- Endpoint configuration, updates, encryption and external sharing controls within the agreed scope.
What you receive
Access matrix, documented settings and repeatable access checks, including employee offboarding.
Web, API and infrastructure penetration testingTest an application, customer portal or network before launch or after a significant change.
- External or internal testing, with or without test accounts, on explicitly authorised domains, applications and networks.
- Manual checks of authentication, permissions, sessions and data isolation, supported by appropriate tools.
- Controlled vulnerability validation, prompt reporting of critical findings and retesting of agreed fixes.
What you receive
Management summary and technical report: systems tested, minimum necessary evidence, vulnerability impact, fixes and retest results.
Industrial networks and remote accessCheck who can access PLCs and supervisory workstations, through which connections and for how long.
- OT mapping, traffic analysis and separation of office, production and maintenance networks.
- Zone and conduit design, traffic filtering and hardening compatible with installed equipment.
- Named vendor accounts, time-limited access, logging and revocation procedures.
What you receive
Network diagrams, traffic matrix, configurations and a change plan with tests and rollback. Sensitive operations are scheduled in a window agreed with operations.
Backups and recovery planningRecover your data and restart the services your business depends on.
- Review of backup copies, separation, retention and permissions to modify or delete them.
- Recovery order, dependencies, acceptable downtime and data loss defined with business owners.
- Restoration exercise in an isolated environment, followed by business-user verification.
What you receive
Recovery plan, restoration runbooks and exercise report with observed timings, gaps and remaining actions.
Incident preparednessWhen an alert arrives, staff need to know whom to contact, what to preserve and who decides on emergency action.
- Review of available logs, useful alerts and the people responsible for handling them.
- Response checklists for compromised accounts, ransomware, data leakage or loss of supervision.
- Tabletop exercise with management, IT and operations to test escalation and provider coordination.
What you receive
Response plan, crisis contacts, evidence retention rules and exercise report. The engagement covers incident preparedness; continuous monitoring and on-call response must be arranged with a dedicated provider.
Staff awareness and working practicesWork with your teams on suspicious payment requests, attachments and document sharing.
- Workshops on payment requests, attachments, document sharing and remote maintenance access.
- Reporting exercises and walkthroughs with the people who will use the procedures.
- Phishing simulation only when included in the mandate, with agreed rules, participants and debriefing.
What you receive
Reusable training material, role-specific instructions and improvement actions. Exercises help improve practices without publicly ranking employees.
Example engagements
These illustrative scenarios describe proposed work, documents and checks. They do not represent completed client engagements and contain no identifying data.
Professional services SMEWrite an IT policy that reflects how people workStaff use email, cloud tools and personal devices. Rules are passed on verbally, and access is not always reviewed when someone leaves.View planned work and documentsHide details
- Proposed work
- Review working practices with management and IT, draft the policy, define sharing rules and document employee onboarding, role changes and offboarding.
- Planned documents
- IT policy, account management procedure, responsibility matrix and staff briefing material.
- Planned verification
- Walk through a fictional departure and an external sharing request to check that each action has an owner and a record.
Software vendor or B2B portalTest a customer portal before launchAn application provides customer accounts, documents and an API. The team wants to check permissions between users and companies before launch.View planned work and documentsHide details
- Proposed work
- Define test accounts and data, review login and recovery flows, then test permissions, sessions and document isolation within the authorised scope.
- Planned documents
- Penetration test report with evidence, severity, proposed fixes and a summary to support the launch decision.
- Planned verification
- Repeat tests that revealed defects after remediation, distinguishing fixed, partially fixed and untested findings.
Multi-site SMERemove unnecessary permissions and accessShared accounts, old administrator privileges and remote connections have accumulated as providers changed.View planned work and documentsHide details
- Proposed work
- Review directory, Microsoft 365 or VPN access, assign an owner to each account, remove unnecessary privileges and scope an internal penetration test for a defined area.
- Planned documents
- Access matrix, account remediation list, hardening plan and test report for the selected scope.
- Planned verification
- Check that a standard user remains limited to their resources and that revoked access no longer works.
Manufacturing workshopRestrict and document remote maintenance accessSeveral equipment vendors connect remotely. The site does not have a complete record of their access paths and accounts.View planned work and documentsHide details
- Proposed work
- Map connections, define named accounts and temporary access, separate maintenance from production traffic and arrange revocation after intervention.
- Planned documents
- Access diagram, filtering rules, vendor procedure and change plan agreed with operations.
- Planned verification
- Test an authorised connection, its expiry and the affected production flows during the agreed window.
Industrial SMECheck that a backup can restore a working serviceBackup jobs report success, but recovery of the business application or supervisory workstation has not been rehearsed.View planned work and documentsHide details
- Proposed work
- Select a service with its owner, identify its dependencies and restore a copy in an isolated environment. Ask a business user to verify that it works.
- Planned documents
- Restoration runbook, documented dependencies, observed recovery time and gaps against recovery objectives.
- Planned verification
- Open the restored service, check an agreed data sample and complete a business workflow defined in advance.
Business with outsourced ITPrepare the response to a compromised accountAn exercise simulates a compromised account and a suspicious payment request. Management, accounting and the IT provider need to coordinate their decisions.View planned work and documentsHide details
- Proposed work
- Walk through the alert in a tabletop exercise, verify contacts, assign access-suspension decisions and identify records to preserve before recovery.
- Planned documents
- Response checklist, contacts to alert, responsibilities for management, IT and the provider, and a list of decisions to clarify.
- Planned verification
- Check that participants can find the right contact and follow the procedure without depending on a single person.
Engagement steps
Agree the scope
We agree which systems to examine, authorised access, exclusions and contacts. The proposal specifies the documents you will receive and the retest terms.
Review and test
We review documents and configurations, speak with staff and run the agreed tests. We report critical vulnerabilities to the designated contact before the final report.
Agree the fixes
We present findings to management and technical teams. For each fix, the action plan records the risk addressed, priority, dependencies and person responsible.
Implement
Your team, provider or Vanguard implements the fixes specified in the agreement. Before a sensitive change, we agree a maintenance window, backup and rollback procedure.
Verify and hand over
We retest the agreed fixes, record remaining risks and hand over the documents. You can arrange periodic reviews of outstanding actions.
Terms agreed before work begins
- Written authorisation, technical scope, testing windows and an emergency contact for active interventions.
- Stop conditions, backups and rollback defined for sensitive changes. Operational impacts are reviewed before work begins.
- Confidentiality, transfer channel, report recipients and evidence retention period agreed in the mandate.
- Third-party systems, phishing simulations and OT interventions explicitly covered by the authorisation. No destructive testing in the standard engagement.
Prepare for the first conversation
Describe the issue, affected systems, number of sites, IT contact and timing constraints. You can start with an existing diagram or application list.
Credentials, configurations and sensitive reports are shared later through the agreed channel, outside the contact form.
Budget and duration
The proposal depends on scope, complexity, available access and expected checks. It separates assessment or testing, implementation of fixes and retesting. Licences and third-party work are specified separately.
Frequently asked questions
Do you work with SMEs that do not run a factory?
Yes. IT policy, access management, endpoints, web applications, backups and incident preparedness also apply to service companies and SMEs. Industrial work is included when the scope covers PLCs, supervisory systems or technical equipment.
What does an IT policy cover?
It covers acceptable use, account protection, data sharing, personal devices, remote work, cloud and AI tools, and incident reporting. We connect it to your company’s procedures. Management approves the rules; your HR or legal contacts review the clauses within their remit.
How does a penetration test work?
We record targets, test accounts, timing, exclusions and an emergency contact in a written authorisation. Tests may start from the internet, an internal network or a user account. The report describes demonstrated vulnerabilities, their impact and proposed fixes. Retesting covers the findings agreed in the proposal. Results describe the tested scope at a particular date; they do not guarantee the absence of all vulnerabilities.
Can testing disrupt production?
Yes, some tests or changes can disrupt a service. We start with documentation, configurations and observation suited to the site before active testing. On industrial networks, intrusive tests require a specific scope, operations approval and a suitable window. Denial-of-service tests and destructive actions are excluded from the standard engagement.
Will you work with our IT provider?
Yes. We agree who provides access, implements fixes and validates tests. We give your provider the technical findings and proposed fixes. Changes to a third-party hosted service also require the authorisations applicable to that service.
What documents do we receive?
Depending on the engagement: a management summary, technical findings and evidence, an action plan, the policies or procedures drafted and test records. The report distinguishes fixed, open and unverified findings. We agree formats and handling of sensitive information before work starts.
Do you provide round-the-clock monitoring or response?
We deliver assessment, testing, implementation and incident preparedness engagements. We do not operate a SOC or provide round-the-clock monitoring. Where that coverage is needed, we define responsibilities, alerts and the handoff to your monitoring and response provider.
Does an engagement provide certification or regulatory compliance?
An engagement can provide a gap assessment and technical evidence for your programme. It does not constitute certification. The framework, version and selected requirements are specified in the mandate. Regulatory applicability and contractual obligations must be confirmed for your activity, relevant countries and customers.
Frameworks and resources
The framework and selected controls are specified for each engagement. These resources do not constitute certification of Vanguard Systems.
Testing guidance for web applications and services. The selected checks are specified in the penetration testing mandate.
Framework for structuring cybersecurity risk management and organisational responsibilities.
Industrial system risk assessment, zone and conduit partitioning and target security level definition.
OT security guidance accounting for availability, reliability and process safety requirements.
Contact
Tell us what you need
IT policy, audit, penetration testing or industrial security: tell us which systems are involved, the issue to address and your deadlines.