CASE STUDY
BREAD N BUTTER
“We are grateful to the EXP team for working with us on this project. We are fully committed to protecting client personal data and this program is evidence of that.”
The Challenge
Meeting Microsoft’s Data Protection Mandate: A Compliance Challenge for Bread N Butter
Bread N Butter is a Seattle-based brand development firm specializing in creative strategy, development, and activation for a broad range of corporate clients, including Microsoft. As the strategic lead for Microsoft’s Cloud Marketing Social and Blog ecosystem, Bread N Butter plays a key role in helping Microsoft’s internal marketing team showcase the success of its cloud products.
To continue this critical relationship, Bread N Butter needed to comply with Microsoft’s newly introduced Supplier Data Protection Requirements (SDPR), also known as the Supplier Security and Privacy Assurance (SSPA). These requirements are aligned with European GDPR standards and NIST cybersecurity guidelines, mandating a robust approach to data protection and risk management. Meeting these standards presented both technical and operational challenges, particularly in an Apple-based (Mac) work environment.
The Solution
EXP Technical Leads The Way
To navigate the compliance landscape and meet Microsoft’s SDPR requirements, Bread N Butter partnered with us to lead its cybersecurity and compliance initiative. Our engagement focused on building a comprehensive, sustainable security program. The scope of work included:
-
Conducting an initial risk assessment to establish a security baseline
-
Developing and implementing a Security Plan of Action to address identified gaps
-
Formalizing a continuous improvement cybersecurity program tailored to the client’s Apple-based environment
With a customized approach, we worked closely with Bread N Butter to implement foundational cybersecurity and data protection controls.
Cybersecurity Expertise
Project Management
Collaborative Execution
The Results
Bread N Butter Experiences the EXP Technical Difference
Following the initial risk assessment, we executed a phased implementation of the security plan, delivering tangible cybersecurity improvements while ensuring alignment with Microsoft’s compliance standards. Key deliverables included:
-
A comprehensive IT Cybersecurity Policy
-
Personal Data Handling Procedures
-
A Cybersecurity Incident Response Plan
-
A Business Continuity and Data Recovery Plan
-
Annual Cybersecurity Awareness Training
-
Multi-factor Authentication for all email and personal data repositories
-
Full-device encryption across all systems
Bread N Butter now operates with a formalized, continuously evolving security program that meets Microsoft’s SDPR requirements, ensuring ongoing partnership eligibility and enhanced protection of sensitive data.
Expert IT Solutions
Precision IT Solutions for Your Growing Business
Comprehensive IT services with the same transparent pricing, collaboration, and customization as in-house IT teams.