Connect. Secure. Manage.
Cisco ISE Posture Assessment
Assess endpoint posture with Cisco ISE where supported, defining checks, remediation paths and the operational impact on network access.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco ISE posture assessment can make a network-access decision depend on selected checks of an endpoint's condition, rather than identity alone. It may help distinguish a managed device that meets an agreed baseline from one needing attention. MCI Network Services designs posture workflows around checks that the customer can support, explain and remediate. The aim is not to create an impressive list of tests that leaves legitimate users unable to work.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Choose a baseline with an operational owner
We begin with the customer's endpoint-security requirements and the teams responsible for enforcing them. A posture rule might concern an approved protection component, an operating-system condition or another supported attribute. The exact check must be suitable for the endpoint platform and the selected ISE and client releases.
Each requirement needs a response when it fails. If the helpdesk cannot explain or correct a condition, automatic restriction can create an unresolved queue rather than better security. We agree the severity, exception process and remediation owner before turning a check into an access condition. Not every useful inventory observation should immediately become a blocking rule.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Verify the assessment method
Agent-based and supported agentless workflows have different prerequisites and limitations. We review the operating systems, client components, administrative permissions and network paths involved. The term posture does not mean the same inspection can be performed on every workstation, phone or specialist device.
The design identifies what the assessment actually proves. A successful check for a particular setting is not a complete declaration that the endpoint is uncompromised. We avoid broad statements such as healthy or compliant unless the underlying criteria are defined. The customer should be able to see the specific conditions assessed and the cases that remain outside the mechanism's visibility.
A useful starting point
Tell us what is happening.
A short description of the problem is enough for an initial discussion.
Design a usable remediation path
A restricted endpoint may still need access to update services, certificate enrolment, endpoint management or a support portal. We map those dependencies and ensure that remediation does not require the unrestricted network access being withheld. Otherwise the user is caught in a loop: access is denied because an update is missing, but the update cannot be obtained without access.
Permissions in the remediation state should be no broader than the task requires. We verify the actual destinations and their ownership, including external services whose addresses may change. A blanket internet allowance introduced for convenience can undermine the intended containment. The chosen policy needs a maintenance process as well as an initial list of exceptions.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Separate assessment timing from user disruption
We agree when checks occur and how a changed result affects an established session. First connection, periodic reassessment and reconnection after sleep can produce different user experiences. A laptop starting a presentation should not receive an unexplained disconnection because a transient condition was mistaken for a persistent failure.
Where the platform supports grace periods or staged enforcement, we assess their suitability against the risk. Such settings are not automatically safe or unsafe; their purpose and effect need to be understood. We test normal transitions and record what a user sees, what the service desk can diagnose and how the endpoint returns to its intended access state.
Pilot the difficult cases
The pilot includes representative operating systems, security-product versions and devices with realistic update states. We test an endpoint that passes, one that genuinely fails and one whose posture cannot be determined. Unknown should not be silently treated as compliant, nor should it automatically be confused with a confirmed security defect.
We also test the dependencies behind the posture service. Client provisioning, policy downloads and update services may fail independently of RADIUS authentication. The acceptance record distinguishes those conditions so that an outage in the assessment workflow does not lead engineers to make unnecessary changes to passwords or wireless settings.
Handle information proportionately
Posture records can reveal details about a person's device and activity. We document the information collected, who can access it and how it is used in the support process. The customer's privacy and security owners decide the applicable handling requirements; the technical project supplies a clear description of the data flow rather than inventing a retention policy.
Reports should support action without exposing unnecessary endpoint detail. We identify trends such as a failing client version or an inaccessible remediation service, and separate those from individual exception cases. Diagnostic exports are protected and limited to the investigation rather than retained casually by every team involved.
Deliver an enforceable, maintainable policy
The handover includes the posture criteria, supported endpoint combinations, state transitions, remediation permissions and exception ownership. MCI can introduce posture within an existing Cisco ISE estate or review a deployment that is causing repeated access problems. The proposal makes clear which checks are included and how their effectiveness will be demonstrated, without treating a posture result as a substitute for wider endpoint-security controls.
Technical references
- Cisco ISE overview — Cisco / Cisco Meraki
- Cisco ISE compliance and posture — Cisco / Cisco Meraki
Talk to a specialist
Need a specialist view?
Tell us what is affected, what changed and what your team has already checked. A short outline is enough to start.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.