Offices.

The office itself, tested rather than assumed: whether somebody can walk in, what a device inside the building can reach once it is connected, and what the wireless networks give away. The things nobody thinks of as computers are in scope too — door controllers, cameras, printers and meeting-room screens. Delivered to published methodology, including PTES and OWASP Wireless.

• the front door, not only the perimeter firewall
• what a device inside the building can actually reach
• door controllers, cameras, printers and meeting-room screens in scope
• the wireless networks tested to published methodology

A guest network where the compliance position comes first. Visitors see clear terms and must actively agree, then register with an email address; the notice states what is collected, why, how long it is kept and that it is not shared. Certificates renew themselves, so the portal never warns visitors that the connection is untrusted — and nobody at the front desk has to read a password aloud across the lobby.

• consent that is explicit and recorded
• a stated purpose and a defined retention period — 30 days on the site we built it for
• each session attributable to a registered visitor
• terms in more than one language where the site needs it