Fixed scope, two weeks
Security Baseline Review
Two weeks to a clear answer on where your security stands and what to fix first. Keel checks your domain and mail setup, reads one of your systems, and maps what it finds to the frameworks your customers ask about. You keep everything we produce.
Domain and mail
- TLS Pass
- Security headers Fail
- SPF Pass
- DKIM Pass
- DMARC Fail
- MTA-STS Could not check
Other areas
- Connected system Pass
- Intake answers Fail
- Framework readiness Fail
What you keep
Four files, yours whether or not you continue with Keel.
-
Scorecard
Pass, Fail or Could not check for each area: your domain and mail, the system you connect, your intake answers, and readiness against the frameworks you pick.
-
Remediation log
Every finding in one spreadsheet, ranked by severity and effort, with an owner, how to fix it, and the controls it maps to.
-
Runbook
Who checks what, and how often, written for your systems. Monthly, quarterly and yearly tasks, and what to do when a check fails.
-
Dated baseline
The full set of results on the day of your readout, so every later review measures against the same starting point.
How the two weeks run
Kickoff (day 1)
A 30-minute call. You give us your domain, pick up to two frameworks, and connect one system with read-only access.
Checks and review (days 1–8)
Keel runs passive checks on your domain and mail, collects evidence from the connected system, and our team reviews every result.
Readout (day 10)
A 45-minute walk-through of the scorecard and the top fixes. You get all four files.
Re-check (day 40)
We run the checks again against your baseline and send an updated scorecard and log.
About two hours of your time in total.
What we check
-
Domain and mail
TLS, security headers, SPF, DKIM, DMARC and MTA-STS, plus the vendors your public DNS records point to. Passive checks only: nothing is scanned or probed.
-
One connected system
Your identity provider, cloud account, code host or another system from Keel’s integrations, read-only.
-
How you work
A short intake on people, devices, access, backups, vendors and incidents.
-
Your frameworks
Up to two, such as SOC 2, ISO 27001, HIPAA, NIST CSF or CIS Controls. Every finding is mapped to the controls it affects.
Who does what
| Keel | You |
|---|---|
| Sets up the workspace and runs the checks | Name one contact |
| Reviews every result by hand | Connect one system (about 10 minutes) |
| Writes the scorecard, remediation log and runbook | Answer the intake |
| Leads the readout and the 30-day re-check | Make the fixes, or have your IT provider make them |
Scope
Included: one domain, one connected system, up to two frameworks, the readout and the 30-day re-check.
Not part of the review: making changes to your systems, penetration testing, and audits or certifications. A licensed audit firm performs audits; the review tells you what to fix before you book one.
After the review
-
Keep going in Keel
Your results are already in a workspace. Turn it into your ongoing program and the checks keep running.
-
Go for SOC 2
The review becomes week one of the SOC 2 Readiness Sprint.
-
Take the files and go
They are yours.
For MSPs
Offer the Security Baseline Review under your brand
Give every new client a fixed-scope first engagement with a clear result. The scorecard, remediation log and runbook carry your name and logo, and the remediation log is written so you can quote the fixes.
-
Keel runs it, you present it
Keel does the checks and writes the files under your brand. You lead the readout.
-
You run it in Keel
Run it from your client console with Keel’s scorecard, log and runbook templates. Keel reviews the files before you hand them over.
What your client gets: the same four files, a 10-day turnaround, and a re-check at day 40.
Questions
- What does it cost?
- A fixed price, agreed in writing before kickoff. Ask for a quote and we will send a short proposal.
- Do I need to be a Keel customer?
- No. The review includes a Keel workspace for its length.
- Is anything run against our systems?
- Only passive checks on your public domain, and read-only access to the one system you choose to connect.
- Can our IT provider take part?
- Yes. They are often the ones making the fixes, so it helps to have them at the readout.
- Can an MSP offer this to its clients?
- Yes. MSPs resell the review under their own brand. See below.