Real security, right-sized for small business
ASON's security practices are built on the CIS Critical Security Controls — a proven, industry-recognized framework designed specifically for organizations like yours. Not enterprise overkill. Not a checklist we ignore. A practical set of controls we actually implement and maintain for every client.
What are the CIS Controls?
The CIS Critical Security Controls are a set of prioritized security best practices maintained by the Center for Internet Security, a nonprofit organization. They're used globally by organizations of every size — from Fortune 500 companies to local nonprofits.
The framework is broken into three Implementation Groups based on organization size and complexity. Implementation Group 1 (IG-1) — what the CIS calls "essential cyber hygiene" — is the foundational tier. It consists of 56 specific safeguards designed to defend against the most common attacks that hit real businesses every day. It's built specifically for small to mid-sized organizations that don't have a dedicated security team on staff.
Why IG-1 and not a bigger framework?
Frameworks like SOC 2, ISO 27001, and NIST CSF are designed for enterprises with dedicated security teams and compliance budgets. They're important — but for a 5-person office or a 20-seat nonprofit, they're overkill. The cost and complexity of implementing them would dwarf the actual security benefit.
CIS IG-1 is different. It's designed for organizations that don't have a full-time security person. It focuses on the controls that actually stop the attacks that actually happen. Every safeguard is actionable, implementable with standard business tools, and doesn't require your team to change how they work. IG-1 is the baseline; our 24/7 security operations center sits on top of it.
We chose IG-1 because it matches the reality of our clients. It gives them a real, measurable security posture without bogging them down in compliance paperwork or tooling they'll never use.
What this looks like for your business
Asset inventory & control
We maintain a complete inventory of every device and software title in your environment. Nothing unknown runs on your network.
Data protection
Encryption, access controls, and backup policies to protect your business data at rest and in transit.
Secure configuration
Every device we manage is built to a hardened baseline. No default passwords, no unnecessary services, no open doors.
Account & access management
MFA enforcement, role-based access, and regular access reviews so only the right people have the right access. Admin access control (privileged access management) grants admin rights only when needed and removes them automatically. Account takeover protection (ITDR) detects and stops compromised logins.
Vulnerability management
Automated patching and regular vulnerability scanning to close gaps before they're exploited.
Audit log management
We maintain logs of security-relevant activity so that if something does happen, we can trace it.
Email & browser protections
Phishing filtering, safe link scanning, and web filtering to block the #1 attack vector for small businesses.
Malware defense
Endpoint detection and response (EDR) monitored by a 24/7 security operations center. Active monitoring for threats, not passive scanning.
Data recovery
Managed device backup with monthly recovery testing, so a ransomware event or hardware failure doesn't end your business.
Security awareness training
Short training plus simulated phishing so your team learns to spot attacks before they click.
Incident response
A documented plan for what happens when something goes wrong, so we're not figuring it out in the middle of a crisis.
IG-1 is the foundation. 24/7 detection and response is on top.
IG-1 sets the hygiene. A 24/7 security operations center watches for and responds to what gets through.
24/7 threat detection and response (MDR)
A security operations center watches your devices, accounts, and network around the clock and responds to threats as they happen.
Account takeover protection (ITDR)
Detects and stops compromised logins and suspicious account activity.
Endpoint protection (EDR)
Next-generation antivirus on every managed device.
Email security
Real-time phishing and impersonation protection.
Security awareness training
Short training plus simulated phishing so your team learns to spot attacks.
Backup
Managed device backup with monthly recovery testing.
Admin access control (privileged access management)
Admin rights are granted only when needed and removed automatically.
Security that comes standard
All of this is included in every CompleteCare plan. It's not an add-on. It's not a premium tier. Every ASON client gets a security posture built on a real framework, maintained by a team that actually implements and monitors it. The 24/7 monitoring and response layer is included in every plan, at every tier.
Ready for real security?
Get a free IT assessment and see how CIS-aligned security works for your business.