Shared Administrative Access Policy

Revised: 31/04/2026

Black Swan Cyber Security Solutions delivers managed security services using structured configuration control to preserve platform integrity and reduce risk.

Our Managed Control Model

Where we retain administrative control of a security platform, we are responsible for:

• Secure baseline configuration
• Policy management in line with agreed scope
• Alert monitoring
• Remediation actions triggered by active policies

Security platforms operate most effectively when configuration integrity is maintained. Where we manage a platform on your behalf, that management is provided under a separate written managed services agreement which sets out the scope, obligations and service standards that apply.

Shared Administrative Access

At a client’s request, administrative access may be granted. Where this occurs, the platform becomes a shared-control environment.

Shared administrative access does not constitute a managed service. Ongoing security monitoring and configuration oversight are not provided under a shared-control arrangement unless separately agreed in writing.

In shared-control environments:

• Clients may independently modify configuration settings
• Protection levels, exclusions, alert thresholds, or logging may be altered
• Monitoring operates based on the configuration state active at the time alerts are generated
• Configuration changes may impact protection performance

Black Swan Cyber Security Solutions cannot validate, approve, or continuously audit client-initiated configuration changes in real time. Our retained access to a platform for licence or administrative purposes does not create any obligation on us to monitor, review, or notify you of security events or risks unless a managed services agreement is in place.

Responsibility and Risk

Security platforms reduce risk but do not eliminate it. Configuration integrity is critical to maintaining effective protection.

Where administrative access is shared:

• Clients are responsible for all changes made by their personnel, administrators, or any other individuals granted access using client credentials
• Changes may affect cyber insurance eligibility, compliance status, or certification outcomes
• Liability is limited in accordance with the applicable service agreement, including the time limits for bringing claims set out in our Terms of Sale

Clients requesting administrator-level access are required to sign a Client-Managed Service Election Form before access is granted. This confirms acceptance of operational responsibility for configuration changes made outside our direct management and takes effect from the point at which administrative access is granted.

Access Levels and Alternatives

We understand that some organisations require visibility or internal oversight without needing full administrative control.

Where full administrative access is not essential, we can provide:

• Enhanced reporting
• Audit access
• Role-based visibility
• Scheduled configuration review

These options allow you to maintain oversight of your security environment without moving to a shared-control model. If you would like to discuss access levels, reporting options, or governance requirements, please contact us.