Our Security Standards
Security at ROI Technology is not a product we sell on top of our services. It is the foundation everything else is built on. Every client gets the same security baseline — no tiers, no “basic” packages, no optional add-ons. We build environments that are defensible by default, and we enforce standards without exception.
This page describes how we approach security for the businesses we manage. If you want to understand what your IT provider should be doing — and whether they actually are — this is a good place to start.
Zero-Trust Architecture
We do not trust any device, user, or application by default — even inside your network. Every access request is verified against identity, device health, location, and context. A compromised workstation on your network cannot reach your file server just because it is on the same subnet. This model eliminates the “hard outside, soft inside” approach that most small business networks still use.
Infrastructure-Level Defense
We do not rely on a single product or software layer to keep you safe. Security is implemented across your entire infrastructure — firewalls with active threat intelligence, network segmentation, DNS filtering, endpoint detection and response, and identity management. A layered defense means that if any single control fails, the next one catches it. This is the difference between “we have antivirus” and “we have a security posture.”
Network Segmentation & Access Control
Your guest Wi-Fi, employee workstations, servers, and IoT devices should never share the same network. We segment your network so that a compromised device in one zone cannot reach resources in another. Access controls are enforced at every boundary — between network zones, between cloud applications, and between on-premises and remote access paths. We review and tighten these controls continuously.
Multi-Factor Authentication Everywhere
MFA is enforced on every account — email, VPN, cloud applications, admin portals, remote access tools. No exceptions. Compromised passwords are the leading attack vector, and MFA stops the vast majority of credential-based attacks. We use phishing-resistant MFA methods wherever supported.
Endpoint Protection
Every managed workstation and server runs next-generation endpoint protection with behavioral analysis and endpoint detection and response (EDR). Signature-based antivirus alone has not been sufficient for years. Our endpoint tools detect suspicious behavior, isolate compromised machines, and alert our team in real time.
Email Security
Email is the primary attack vector for business email compromise, phishing, and malware delivery. We secure email at every layer — from filtering and authentication to encryption-in-transit and continuous monitoring.
Threat filtering. Advanced email filtering with impersonation detection, attachment sandboxing, and malicious link rewriting. Threats are neutralized before they reach your inbox.
Authentication (SPF, DKIM, DMARC). We configure SPF records to authorize which servers can send on your behalf, DKIM to digitally sign your outbound mail so recipients can verify it has not been tampered with, and DMARC policies that tell receiving servers to reject spoofed messages — not just flag them. Together, these prevent attackers from impersonating your domain.
Encryption in transit (MTA-STS, DANE). Authentication stops spoofing, but it does not guarantee your email is encrypted on the wire. We deploy MTA-STS and DANE to enforce TLS encryption between mail servers, preventing man-in-the-middle interception and downgrade attacks. Without these, a determined attacker between your server and your recipient’s server could read your messages in plain text — even if both sides support encryption.
Reporting and monitoring (TLS-RPT, DMARC reports). Configuring security records is not enough — you need to know when something fails. We configure TLS-RPT so your domain receives daily reports from external mail servers about any TLS connection failures or encryption problems encountered during delivery. Combined with DMARC aggregate reports, we have continuous visibility into authentication failures, delivery issues, and potential abuse of your domain. We monitor these reports actively, not just collect them.
Forwarding integrity (ARC). When your email is legitimately forwarded — through mailing lists, shared mailboxes, or multi-hop routing — SPF and DKIM checks can break, causing valid messages to be rejected. We implement ARC (Authenticated Received Chain) to preserve authentication results across forwarding hops, so your email stays trusted even when it takes an indirect path.
DNS Filtering
Malicious domains are blocked at the DNS level before a connection is ever established. This catches malware callbacks, phishing sites, command-and-control traffic, and newly registered domains that are overwhelmingly malicious. DNS filtering works on and off your network.
Security Awareness Training
Technology alone does not stop every attack. Your employees are the last line of defense. We run continuous phishing simulations and training — not an annual video, but an ongoing program that keeps your team alert and gives us data on who needs additional coaching.
Patch Management
Unpatched software is the second-most exploited attack vector after compromised credentials. We patch operating systems, firmware, and third-party applications on a rigorous schedule. Patches are tested before deployment to prevent compatibility issues. Critical vulnerabilities are patched within 24 hours of release.
Dark Web Monitoring & Incident Response
We actively monitor the dark web for your company’s compromised credentials. When leaked credentials are found, affected accounts are flagged and remediated before they can be exploited. If a security incident does occur, our incident response plan is documented, rehearsed, and ready — not something we figure out in the moment.
The Result
Zero ransomware events across our entire client base. zero voluntary churn. These numbers are not aspirational targets — they are our track record, built on the standards described on this page.
Learn more about our cybersecurity services or contact us to discuss your security posture.