Permissions and sharing
Review selected sites, groups, guests, sharing links, and ownership. Prioritize access that no longer fits the business need.
Data protection & permissions
Give people and AI the access they need. Make the boundaries clear.
Cocha helps your team reduce oversharing, classify sensitive information, and put data-loss controls into operation. Start with how information is actually used, then validate the permissions and policies around those workflows.
Free starting point · Written findings · No obligation to purchase
Controls built around the work your team needs to do.
Classification and protection
Build practical sensitivity-label and protection decisions around the information your teams use and the ways they collaborate.
DLP and connected AI
Select controls for the channels, devices, and AI workflows in scope. Test their behavior and make coverage limits explicit.
Start with the next data-access decision.
If Claude or Copilot is planned or already in use, the free AI Readiness Snapshot is the starting point. Its five-area review includes data security and access, monitoring coverage, Shadow AI exposure, and a Microsoft Secure Score baseline.
A working session
60 minutes with your IT or security lead around the tools, sensitive information, and controls relevant to your AI plans.
Agreed evidence
A read-only SharePoint exposure script output and a live Secure Score review, with additional evidence agreed in advance.
Written findings and review
Findings within five business days after the session and required inputs, followed by a 30-minute review. No obligation to purchase.
The free AI Snapshot is a bounded diagnostic, not a full permissions or DLP audit. Discovery and control coverage depend on repositories, licenses, configuration, and connectors. Labels and DLP complement access controls; their presence alone does not establish that every AI workflow is protected.
What you take away
Access priorities
Evidence-supported questions about sharing, group membership, external access, and ownership of remediation.
Control gaps
What is configured, what was observed, and where coverage or policy behavior still needs testing.
A clearer next step
Priorities for your team and a basis for scoping deeper permissions, classification, or DLP work.
Know what to prepare.
Your administrator reviews the SharePoint exposure script and required permissions, runs it in your environment, and shares the output securely. Bring an administrator who can show Secure Score and relevant recommendations. The script’s M365 Group view is not a complete permissions analysis of every SharePoint site.
Senior practitioners, alongside your team.
Steven R. Combs brings 30 years in IT and 15 years working with law firms. We work with your internal IT and security teams or MSP, with responsibilities agreed before implementation.
Gabriella San Miguel coordinates project activity, scheduling, and business operations.
We aim to respond within 4–8 business hours, Monday–Friday, 8 AM–5 PM Central.
When you need help acting on the findings.
The free Snapshot helps establish priorities. Paid assessment, implementation, and ongoing advisory are separate engagements, with scope, deliverables, and responsibilities agreed in advance.
1. Discover and agree
Identify the repositories, users, sensitive information, and business workflows in scope. Confirm available tooling and licenses.
2. Configure and validate
Scope permission remediation, labels, and DLP policies. Pilot the agreed workflows and review exceptions before broadening enforcement.
3. Operate and review
Assign data owners, review access changes and alerts, and document control coverage as tools and workflows evolve.
Already have a defined project? Request a project conversation.
Questions before you begin
Can DLP replace a permissions review?
No. Access and data-loss controls serve different purposes. We scope and validate both against the workflows your team needs.
Can you help with a data project unrelated to AI?
Yes. Use the project conversation link to discuss permissions, classification, DLP, or data-governance work. We will agree on a relevant scope.
Will this validate every site or ethical wall?
No. The Snapshot reviews selected evidence. Comprehensive site, matter-boundary, or repository testing requires a separately agreed scope.
Can we use the tools we already own?
We start with your existing environment and licensing. We identify what can be configured now and where additional capabilities or deeper testing may be needed.
Read before you book.
Start with the controls that need attention.
Questions? 281-607-0616 · info@cochatechnology.com