How it works

1. Outside-in public domain check (free). We read only public DNS records anyone can see: MX, SPF, DMARC and common DKIM selectors. No port scanning, no login attempts, no vulnerability testing.
2. Windows check script. Easiest way: the 3-step Windows check page. You run the read-only script wisp-check.ps1 (current version 0.2.2-draft) on each office PC. You run it yourself, following the written steps; we never see or control your PC. It runs 16 checks, W01–W16, such as disk encryption, antivirus, updates, screen lock, local accounts, backups, remote-access software and SMBv1. It changes nothing and sends nothing. Results are saved as a file on that PC. The download launcher then opens the results page, which reads that file inside your browser (nothing is uploaded) and turns it into your binder: an action list, a records checklist, a change log and a yearly review pack. The binder stays in a file you save on your own computer. See verifying the script below.
3. Microsoft 365. Microsoft 365 checks: coming later. In the current phase we run the Windows check and the outside domain check only. WISP sections about Microsoft 365 (for example MFA or mailbox settings) are written from your answers on our intake form and are marked in the plan as client statements, not as checked results.
4. WISP + fix guides + staff training. We prepare a Written Information Security Plan from your answers and the check results, with plain-English fix guides and short phishing-awareness training with completion records.
5. Recheck. After you make the fixes you rerun the script yourself and open the new file on the results page, which shows what changed and marks fixed items as done (Starter: one recheck within 60 days). Yearly and quarterly packages add a recheck before PTIN renewal or every quarter. We update the plan and deliver a dated before/after evidence pack to you to keep.

Verifying the script

Download /downloads/wisp-check.ps1, then compare its SHA256 hash with the value published in /releases.json. In PowerShell:

Get-FileHash .\wisp-check.ps1 -Algorithm SHA256

For version 0.2.2-draft the hash is 931000792D9D047B76EC41B938F3F68F0D03A721FAC855E3507A377E49CB0877. If /releases.json shows a different value, trust releases.json and do not run a file that does not match it.