Start with the map. Not with the rebuild.

The usual reaction is to commission rebuilds. It is the most expensive order to work in: you rebuild on ground you have no plan of, and the estate fragments again within two years. Here is the order we follow, and what each step covers.

1. 0

   Reconnaissance

   five working days · no access to your systems

   What is publicly attributed to you, set against what you believe you own. Domains, subdomains, hosts, certificates and platforms visible from the outside.

   You receive two things: a number, and the list. It is often the first time the two have been put side by side. None of it requires access, a confidentiality agreement, or the consent of an incumbent supplier.

2. 1

   The map

   three weeks · up to 15 domains and 10 live sites

   The full register, status and routing, the search and brand surface, triage of public exposures, migrations and inherited domains, the graph linking parent company, brands, countries and networks, drift in content and legal data, and the concentration of platforms and suppliers.

   Then what follows from it: ranked control gaps, a ninety-day plan, and a briefing for the board. Every finding is marked confirmed, estimated or unresolved, with what is needed to reproduce it.

   Beyond those volumes the quote follows the reconnaissance: we do not price a map without knowing what it has to cover.

3. 2

   The registers

   quoted · contractable one at a time

   Seven registers to keep. A group that will not buy a programme will often buy the first two:

   • The asset register — domains, DNS, certificates, hosting, platforms, access, renewal dates.
   • Who answers for what — executive owner, operational owner, escalation path.
   • Identity — the parent domain, the source of record, where brands and countries sit.
   • The migration rule — mappings, redirects, email, monitoring, retirement criteria.
   • Platform controls — versions, extensions, backups, release testing.
   • The data of record — legal notices, entities, points of sale, contact details.
   • Holding suppliers to account — responsibilities, access, evidence format, independent acceptance.
4. 3

   The watch

   monthly · according to the size of the estate

   Without it, the map ages. Domains renew, suppliers change, a site is launched without anyone mentioning it. Availability, certificates, DNS, newly discovered subdomains, staging exposure, brand results, legal drift, migration regressions.

   Up to 10 domains and 5 live sites

   Up to 30 domains and 15 live sites

   Up to 80 domains and 40 live sites

   Beyond that

   The monthly fee follows these bands. It is settled on the real count of domains and sites established by the map, not on an estimate made before knowing.

   Alerts as events occur, a monthly control report, a quarterly review for the board, an annual re-baselining.

5. 4

   Interventions

   quoted · contracted separately

   Contain an exposure, restore routing or a certificate, run a migration, clarify an entity architecture, correct legal data and points of sale, open a properly held site for a subsidiary that has none, or verify work delivered by another supplier.

   Heavy development and formal incident response are not ours to do. On those we set the acceptance criteria and verify the result: a more useful role, and a more honest one, than claiming to do everything.

What the order spares you

A rebuild commissioned before the register is paid for twice: once to do it, once to repair what it broke unseen — a forgotten redirect, an interrupted mailbox, years of accumulated standing lost on a domain everyone assumed was dead.

The other order costs less, because you finally know what you are rebuilding.

The order is not only a defence: what is of record at home is also what an assistant looks to confirm elsewhere. Two versions of yourself do not make a source.