This case study looks at how Techware helped a not-for-profit organisation move off an underperforming IT provider, migrate to the cloud, and reach a defensible security standard across a single 140-user site.
The Situation
Following a sustained period of poor service under an incumbent provider, this not-for-profit organisation went to open tender. It was looking for a partner able to migrate its IT systems to the cloud, deliver ongoing managed services, and lift organisational IT and security maturity to a defensible standard. Techware was appointed through that competitive process.
What Techware Delivered
The engagement covered migration, day-to-day management, and a structured security uplift:
- Migration of on-premises server infrastructure to Microsoft Azure
- Conditional access, MFA enforcement and privileged access separation across all administrative accounts
- Full Essential Eight uplift program to Maturity Level 2, with ongoing maintenance and attestation
- Application control implemented from discovery through audit mode to enforced allow-listing
- Continuous security posture reporting and monthly vulnerability assessment
- Operational and strategic governance cadence supporting Board and executive oversight
The Outcomes
The program reached and held a defensible standard, with the evidence to back it up:
- Essential Eight Maturity Level 2 achieved and maintained, including the three strategies most commonly left incomplete: application control, user application hardening and restriction of administrative privileges.
- Application control moved to full enforcement across 140+ endpoints, with allow-listing enforced in production rather than left in permanent audit mode.
- Supported the organisation to successful ISO/IEC 27001 certification, with Techware providing the technical control evidence, documentation and audit support that underpinned it. It reflects the same evidence discipline we apply to our own certified ISMS.
- Established a dual-cadence governance rhythm, separating operational service review from strategic roadmap and risk discussion, giving both the executive and the Board the level of detail each requires.
The Partnership Today
Since 2019, the relationship has continued on that footing: managed services day to day, the Essential Eight posture maintained and attested, and governance that keeps both operational delivery and longer-term risk in view.
