Lee F.
Christchurch, New Zealand · IAM & GRC Consultant | Identity Governance, Access Control & Security Design
Massey University
20 followers
About
I help organisations get clear control over identity, access, and governance.
In many environments, access ownership, accountability, and documentation are not as clear as people think. There is often an assumption that MSPs or internal teams have this covered, but that is not always the case. This creates real risk across security, privacy, and compliance.
My work focuses on building practical, structured environments where identity and access are visible, controlled, and aligned with organisational obligations.
This includes identity and access management, governance frameworks, and security design across Microsoft 365 and related systems.
I build frameworks that are:
• clearly documented
• aligned to how the organisation actually operates
• owned internally rather than dependent on external providers
My work aligns with recognised frameworks and regulatory expectations, including ISO 27001, the NIST Cybersecurity Framework, and privacy obligations in New Zealand and Australia.
Earlier in my career, I worked in enterprise IT across Australia, New Zealand, and the UK, including Telstra, Sky, British Telecom, Air New Zealand, and the University of Sydney.
I am currently completing postgraduate cybersecurity studies at the University of Canterbury.
If you are not completely sure who has access to your systems, or how that aligns with your obligations, it is worth asking the question.
www.purelayer.co.nz
Specialties
- Governance & Compliance
- IAM
- ISO 27001
- NIST Framework
- Policy & Standards
Education
-
Massey University
BBS, Information Systems
Feb 1997 — Nov 2000
Recent posts
I keep seeing the same gap in schools.
Cyber safety is not being taught in a structured way.
What exists tends to be reactive or one off, without building year by year.
One year it is “be kind online”
The next year it is something completely different
No continuity. No progression.
But the risks do not reset each year. They build.
That is what led me to create this
https://www.cybersafenz.co.nz
A simple programme that builds from Year 0 through to Year 8
Based on how kids in New Zealand actually use technology today
No generic content
No overseas assumptions
Just something schools can pick up and use straight away
Four weeks ago a client terminated their MSP contract. Their independent security advisor, me, is still waiting for the handover.
No Microsoft 365 admin access. No firewall credentials. No network documentation. No backup system access.
Just silence.
This is not unusual. It happens more than most business owners realise and it exposes something that rarely gets talked about.
Most organisations do not actually control their own IT environment. Their provider does. The admin accounts, the credentials, the documentation, it all lives with the MSP. When the relationship ends, so does your visibility into your own systems.
The organisation in this case is doing everything right. They terminated properly, they are chasing it up, and they have a new provider ready to go. But they are sitting in a gap right now where nobody has full visibility of what is running, who has access, or whether anything has changed.
This is exactly why access governance and documentation needs to exist independently of whoever manages your IT day to day. Not because your MSP is malicious. Most are not. But because your business should own the picture of its own environment at all times regardless of who is managing it.
If you do not know who holds admin access to your Microsoft 365 tenant right now that is worth finding out before you ever need to ask someone else for it back.
#ITGovernance #Cybersecurity #Microsoft365
I looked at a small organisation’s Microsoft 365 setup last month.
Before admin access was even available, a quick review pointed to around $3,850 to $5,450 a year in potential licensing waste.
5 former staff still had active accounts.
12 Power Automate licences assigned but never used.
Shared mailboxes running full licences they did not need.
Nothing unusual.
The IT provider was doing their job. Systems were running. Backups were in place. Support was there when needed.
But no one had ever stepped back and asked the bigger questions.
Who still has access.
Whether that access is still appropriate.
Whether the setup actually reflects how the organisation operates today.
That usually sits outside what IT providers are engaged to do.
So it often goes unchecked.
If you are running on Microsoft 365 with around 10 to 50 staff and no dedicated internal IT or security role, it is worth taking a proper look.
A short independent review can surface things quickly.
📰 Your Next Breach Will Look Like Business as Usual
https://www.darkreading.com/identity-access-management-security/your-next-breach-business-as-usual
via Dark Reading · 🛡️ Powered by Cyberr Threat Intelligence — cyberr.ai/?tab=news
Most organisations think access is under control.
It isn’t.
Accounts stay active long after people leave.
Access is added but rarely removed.
Credentials get shared just to keep things moving.
Over time, no one actually knows who has access to what.
Not the business.
Not the MSP.
Not even IT.
Everything looks fine until something goes wrong.
And when it does, the first question is always the same:
Who had access to this?
That is when the gap becomes visible.
This is not a tooling issue.
It is a lack of ownership, structure, and governance around identity and access.