Free ai generated artificial intelligence typography vector

How Graphene Technologies in Houston Eliminates Microsoft 365 Copilot License Waste

by with No Comment AI

Artificial Intelligence continues to reshape how businesses operate. As a result, many organizations rush to adopt tools that promise higher productivity and faster output. Microsoft 365 Copilot stands out because it integrates directly into the Office tools employees already use every day.

However, enthusiasm often leads to overbuying. Many companies license Copilot for every employee without validating real demand. Consequently, unused AI licenses pile up as expensive shelfware.

That is why Graphene Technologies Houston IT security recommends regular Microsoft 365 Copilot audits. You cannot optimize what you do not measure. A proper audit reveals who actually uses Copilot, who benefits from it, and where licensing costs can be reduced without hurting productivity.

Why AI License Waste Hurts Your Bottom Line

At first glance, buying licenses in bulk feels efficient. Procurement becomes simple, and everyone has access. However, this approach ignores how employees actually work.

Not every role needs AI assistance:

  • A receptionist may never use advanced Copilot features

  • A field technician may not open Microsoft 365 desktop apps

  • Some users may only log in once and never return

When licenses sit unused, costs add up quickly. Over time, AI shelfware drains budgets that could support higher-value initiatives. Therefore, identifying unused Copilot licenses becomes a critical cost-control measure.

By contrast, Graphene Technologies Houston IT security helps businesses align licensing with real usage so every dollar delivers value.

Step 1: Review Microsoft 365 Copilot Usage Reports

Microsoft provides built-in reporting tools that make usage analysis straightforward. The Microsoft 365 admin center offers detailed visibility into Copilot adoption.

From the dashboard, you can track:

  • Enabled users

  • Active users

  • Usage trends over time

  • Feature engagement

This data quickly highlights inactive users and low-engagement accounts. As a result, IT teams can distinguish power users from employees who never open Copilot.

Microsoft 365 usage reporting overview

Step 2: Turn Usage Data into Cost-Saving Decisions

Once waste becomes visible, action should follow. Start by reclaiming licenses from inactive users. Then, reassign those licenses to employees who actually need AI support.

In addition, establish a formal request process for Copilot access. When employees must justify their need, license sprawl slows immediately. This step alone often reduces AI subscription costs significantly.

Because IT budget optimization is ongoing, Graphene Technologies recommends reviewing Copilot usage monthly or quarterly. Regular audits prevent waste from creeping back in.

Step 3: Improve Adoption with Targeted Training

Low Copilot usage does not always mean low value. In many cases, employees avoid the tool because they lack training or confidence.

Instead of cutting licenses immediately, assess why usage is low. Surveys and interviews often reveal skill gaps rather than resistance.

Effective adoption strategies include:

  • Lunch-and-learn demonstrations

  • Short task-based tutorials

  • Internal success stories from power users

  • Department-level Copilot champions

When employees understand how Copilot fits their daily work, adoption improves quickly. As a result, previously wasted licenses often become productivity multipliers.

Step 4: Establish a Clear AI Governance Policy

Governance prevents AI sprawl before it starts. A formal Copilot policy defines who qualifies for a license and how usage is reviewed.

Effective policies typically:

  • Assign licenses automatically to high-impact roles

  • Require approval for optional roles

  • Define regular review cycles

  • Set expectations for ongoing usage

Clear communication matters. When employees understand how decisions are made, accountability improves. Over time, this structure eliminates the “everyone gets a license” mindset.

Step 5: Audit Before Renewal, Not After

The worst time to review Copilot usage is right before renewal. Instead, audits should occur at least 90 days in advance.

Early reviews provide:

  • Time to right-size licenses

  • Data for vendor negotiations

  • Flexibility to adjust contracts

Armed with real usage data, organizations avoid another year of paying for shelfware. This preparation strengthens negotiating power and protects long-term budgets.

Smarter AI Management Starts with Graphene Technologies

Subscription-based AI tools demand active oversight. Without regular review, costs escalate while value stagnates. Microsoft 365 Copilot audits ensure spending aligns with real business impact.

Graphene Technologies Houston IT security helps organizations audit Copilot usage, reclaim wasted licenses, improve adoption, and build governance frameworks that scale.

Contact Graphene Technologies to audit your Microsoft 365 Copilot licenses

Free button icon symbol vector

How Graphene Technologies in Houston Secures Guest Wi-Fi with Zero Trust

by with No Comment Cybersecurity

Guest Wi-Fi is something visitors expect. However, it is also one of the most exposed parts of your network. A shared Wi-Fi password that has circulated for years offers almost no protection. Worse, one compromised guest device can become a launch point for attacks against your entire business.

That is why Graphene Technologies Houston IT security recommends a Zero Trust approach for guest Wi-Fi. Instead of assuming devices are safe, Zero Trust enforces one rule: never trust, always verify.

With the right setup, you can protect your network while still delivering a smooth, professional guest experience.

Why Zero Trust Guest Wi-Fi Is a Smart Business Decision

Zero Trust guest Wi-Fi is not only about security. It is also about financial protection and reputation management. When guest traffic shares space with business systems, the risk multiplies quickly.

A single breach can lead to:

  • Business downtime

  • Data exposure

  • Compliance penalties

  • Loss of customer trust

For example, the Marriott data breach demonstrated how attackers exploited third-party access to move laterally through internal systems

Although the breach was not caused by guest Wi-Fi directly, it showed how unsecured entry points create massive downstream damage. By contrast, a Zero Trust guest network isolates traffic completely, stopping threats at the perimeter.

As a result, Graphene Technologies Houston IT security helps businesses reduce risk while maintaining excellent customer service.

Step 1: Fully Isolate Guest Wi-Fi from Business Systems

The foundation of Zero Trust guest Wi-Fi is isolation. Guest traffic should never touch corporate resources.

This is achieved by:

  • Creating a dedicated guest VLAN

  • Assigning a separate IP range

  • Blocking all access to internal networks at the firewall

Only outbound internet access should be allowed. Nothing else.

Because of this segmentation, even if a guest device becomes infected, it cannot reach servers, file shares, or internal applications. This containment strategy dramatically reduces exposure.

Step 2: Replace Shared Passwords with a Captive Portal

Shared Wi-Fi passwords create immediate risk. They spread easily, never expire, and cannot be traced back to a specific user.

Instead, Graphene Technologies deploys professional captive portals. These portals act as the front door to your guest network.

Common secure options include:

  • Time-limited access codes

  • Email-based authentication

  • One-time SMS passwords

Each method verifies identity before access is granted. Therefore, anonymous connections disappear, and every session becomes controlled and auditable.

Step 3: Enforce Security with Network Access Control (NAC)

A captive portal is a strong start. However, Zero Trust requires ongoing enforcement. That is where Network Access Control (NAC) comes in.

NAC evaluates each device before it connects. It can:

  • Check for active firewalls

  • Confirm basic security updates

  • Restrict outdated or risky devices

If a device fails inspection, NAC can redirect it to a restricted network or block access entirely. As a result, vulnerable devices never gain full connectivity.

Network Access Control overview

Step 4: Apply Time Limits and Bandwidth Controls

Zero Trust also limits duration and usage. Guests do not need unlimited access forever.

Using NAC or firewall rules, you can:

  • Force reauthentication every 8–12 hours

  • Automatically expire sessions

  • Throttle bandwidth for non-business traffic

For example, guests can browse the web and check email, but they cannot stream 4K video or download large files. These limits protect performance for your employees while aligning with least privilege principles.

Step 5: Deliver a Secure Yet Welcoming Experience

Security should never feel hostile. With the right design, Zero Trust guest Wi-Fi feels professional, not restrictive.

Visitors receive:

  • Clear instructions

  • Fast internet access

  • A branded login experience

Meanwhile, your business gains confidence that guest traffic stays isolated, monitored, and controlled.

Secure Your Guest Wi-Fi with Graphene Technologies

Zero Trust guest Wi-Fi is no longer reserved for large enterprises. It is now a baseline requirement for businesses of all sizes.

Graphene Technologies Houston IT security designs guest Wi-Fi networks that protect internal systems while maintaining a polished visitor experience. Through segmentation, verification, and continuous enforcement, we eliminate one of the most commonly exploited entry points.

Contact Graphene Technologies today to secure your guest Wi-Fi

shallow-focus-photography-of-macbook

How Graphene Technologies in Houston Automates Contractor Access with Microsoft Entra

by with No Comment IT Management

Managing contractor logins creates constant friction. On one hand, you need to grant access fast so work can start. On the other hand, speed often leads to shared passwords, over-permissioned accounts, and logins that never get removed. As a result, security usually loses.

However, Graphene Technologies Houston IT security solves this problem with automated contractor access using Microsoft Entra Conditional Access. Instead of relying on memory or manual cleanup, you can grant precise access and revoke it automatically. Even better, the setup takes about an hour.

This approach closes a major security gap while also making IT operations easier.

Why Automated Contractor Access Matters for Security and Compliance

Contractors introduce one of the highest forms of third-party risk. Most security failures happen after a project ends, when access stays active longer than intended. These forgotten logins, often called dormant or ghost accounts, provide attackers with quiet entry points.

Once compromised, these accounts rarely trigger alerts because no one actively monitors them. Therefore, attackers can move laterally without resistance.

A well-known example is the Target breach of 2013

Attackers entered through an HVAC contractor account that had far more access than required. Because least privilege was not enforced, attackers pivoted into payment systems and exposed millions of records.

By contrast, Graphene Technologies Houston IT security uses Microsoft Entra Conditional Access to automate revocation the moment a contractor is removed. This approach enforces least privilege by default, reduces the attack surface, and supports audit readiness for frameworks like HIPAA and GDPR.

Step 1: Create a Dedicated Contractor Security Group

Organization comes first. Managing contractor access user by user leads to mistakes. Instead, create a single security group in the Microsoft Entra admin center.

Name it clearly, such as:

  • External-Contractors

  • Temporary-Access

  • Vendor-Users

This group becomes your control plane. When a contractor starts, you add them once. When the engagement ends, you remove them once. Everything else happens automatically.

As a result, access stays consistent, scalable, and easy to audit.

Step 2: Build an Automatic Expiration Policy with Conditional Access

Next, you configure the policy that handles revocation for you. Conditional Access does the heavy lifting.

In the Entra portal:

  1. Create a new Conditional Access policy
  2. Assign it to the contractor security group
  3. Require multi-factor authentication

Then, under Session controls, set a sign-in frequency that matches your contract length, such as 60 or 90 days.

Because reauthentication becomes mandatory, contractors lose access immediately once removed from the group. There is no grace period, no cleanup task, and no lingering session.

Microsoft Conditional Access overview

Step 3: Restrict Contractors to Only Approved Applications

Contractors do not need access to everything. In fact, limiting access reduces risk dramatically.

Create a second Conditional Access policy for the same group. This time:

  • Select only approved cloud apps

  • Allow access to tools like Teams, SharePoint, or Slack

  • Block all other applications

This policy creates a narrow access lane for each contractor role. Writers access content tools. Developers access staging systems. Nobody touches HR or finance.

Because least privilege is enforced automatically, security improves without slowing work.

Step 4: Strengthen Authentication Without Managing Devices

You do not manage contractor laptops, and that is fine. However, you still control how users authenticate.

Graphene Technologies recommends:

  • Phishing-resistant MFA

  • Microsoft Authenticator app

  • Conditional rules using OR logic

For example, you can require a compliant device or a phishing-resistant sign-in method. This balance improves security while keeping onboarding smooth.

Phishing-resistant authentication guidance

Step 5: Let the System Revoke Access Automatically

Once configured, the system runs itself. When a contractor joins the group, access activates instantly with all controls applied. When the project ends, removal from the group revokes access everywhere, including active sessions.

There is no checklist to remember. There is no follow-up ticket. There is no forgotten account.

As a result, one of the highest-risk manual processes becomes predictable and safe.

Regain Control of Contractor Security with Graphene Technologies

Contractor access does not need to feel risky or chaotic. With the right Conditional Access policies, you can grant precise access for a fixed time and trust the system to clean up automatically.

Graphene Technologies Houston IT security helps businesses design, deploy, and manage Microsoft Entra controls that reduce risk without slowing growth.

Contact Graphene Technologies to automate contractor access today

Graphene Technologies Houston IT security team reviewing SaaS integrations

How Graphene Technologies in Houston Secures SaaS Integrations for Growing Businesses

by with No Comment Cybersecurity

Your business relies on SaaS tools to move fast. However, without the right controls, every new integration can introduce serious risk. That is why Graphene Technologies Houston IT security focuses on structured SaaS vetting that protects your data, your compliance posture, and your reputation.

Many teams discover a promising SaaS tool, install it quickly, and worry about security later. While this approach feels efficient, it often creates hidden exposure. Each SaaS integration acts as a bridge between systems. As a result, sensitive data can move far beyond your visibility.

Therefore, learning how to properly vet SaaS integrations is no longer optional. It is a core part of modern IT security in Houston.

Why SaaS Integration Security Matters More Than Ever

Third-party risk continues to rise. In fact, a single weak integration can trigger compliance violations, financial loss, or long-term brand damage. Because modern systems are deeply interconnected, attackers rarely need to breach your core infrastructure directly.

For example, the T-Mobile data breach demonstrated how third-party complexity expands the attack surface.


Although the initial issue involved a vulnerability, the aftermath revealed how vendor sprawl complicates containment and response. Consequently, organizations without a clear vendor vetting process struggle to regain control.

By contrast, Graphene Technologies helps Houston businesses reduce exposure through disciplined SaaS risk management that emphasizes visibility, least privilege, and verified controls.

5 Proven Steps Graphene Technologies Uses to Vet SaaS Integrations

1. Evaluate the Vendor’s Security Foundation First

Before approving any SaaS tool, Graphene Technologies reviews the vendor behind the product. Features alone never determine approval. Instead, security maturity drives the decision.

We look for:

  • SOC 2 Type II reports

  • Transparent breach disclosure policies

  • Proven operating history

  • Clear security documentation

SOC 2 explains how vendors protect data across confidentiality, availability, and integrity

Because weak vendors introduce unnecessary risk, this step eliminates unsafe options early.

2. Map Data Access and Information Flow

Next, we identify exactly what data the SaaS tool touches. We ask direct questions about permissions, access scope, and storage locations.

Graphene Technologies enforces the principle of least privilege, which means:

  • No global read/write access

  • No unnecessary API scopes

  • No undocumented data transfers

Additionally, our team diagrams data flow end to end. This process clarifies where data travels, how it is encrypted, and where it resides geographically. As a result, businesses gain full visibility before deployment.

3. Confirm Compliance and Legal Alignment

Compliance obligations do not stop at your firewall. If your business follows GDPR, HIPAA, or other regulations, your vendors must follow them too.

Therefore, Graphene Technologies carefully reviews:

  • Privacy policies

  • Data Processing Addendums (DPAs)

  • Data residency locations

  • Vendor liability language

We also verify that vendors do not store data in regions with weak privacy laws. Although legal review takes time, it prevents expensive disputes later.

4. Require Secure Authentication Standards

Authentication methods matter. SaaS tools must integrate securely without sharing credentials.

Graphene Technologies prioritizes:

  • OAuth 2.0 authentication

  • Role-based access controls

  • Admin dashboards with instant revocation

OAuth allows secure authorization without exposing passwords

Because credential sharing creates unnecessary exposure, we reject vendors that rely on outdated login methods.

5. Plan the Exit Before You Onboard

Every SaaS relationship ends eventually. Therefore, we plan offboarding before approval.

We verify:

  • Data export options

  • Standard file formats

  • Certified data deletion processes

Clear exit procedures prevent data orphaning and maintain ownership. As a result, businesses stay in control long after a contract ends.

Build a Safer SaaS Ecosystem with Graphene Technologies

Modern businesses cannot operate in isolation. Data flows constantly between internal systems and third-party platforms. However, connecting blindly increases risk.

That is why Graphene Technologies Houston IT security focuses on repeatable, documented SaaS vetting. These five steps reduce exposure, strengthen compliance, and protect long-term growth.

If you want confidence in every SaaS integration, our Houston-based team is ready to help.

Contact Graphene Technologies today to secure your SaaS environment

Free Colleagues celebrate success with a fist bump over financial charts depicting teamwork and unity. Stock Photo

How Smart IT Improves Employee Morale and Retention

by with No Comment IT Management

Why the Digital Employee Experience Matters More Than Ever

Picture this for a moment. Someone is in the middle of an important presentation. The room—or the Zoom call—is fully engaged. Then, suddenly, their laptop freezes. You can almost hear the collective groan. The momentum is gone, the tension lingers, and the presenter is left flustered.

While moments like this may seem small, they add up quickly. Over time, repeated technology failures don’t just derail meetings—they quietly erode how people feel about their work.

That’s why IT is no longer just about servers, software, or “keeping the lights on.” Instead, it plays a central role in the everyday experience employees have every time they log in, open an application, or try to collaborate with a teammate. When those interactions are smooth, morale improves. When they’re not, the impact shows up in productivity, engagement, and retention.

The data supports this shift. According to Deloitte, organizations with strong digital employee experiences see a 22% increase in engagement, and employees are four times more likely to stay. Likewise, Gallup consistently finds that higher engagement drives better performance and lower turnover.

So the real question becomes this: If technology could be one of your strongest tools for keeping great people, how would you design it?

The Link Between Smart IT and Employee Morale

At its core, digital employee experience (DEX) is simply the quality of every technology interaction your employees have at work. In other words, it’s not just about whether a laptop boots quickly. It also includes how intuitive tools are, how responsive IT support is, and whether systems actually make work easier instead of harder.

When technology works the way it should, employees can focus on meaningful tasks. However, when tools are clunky or unreliable, frustration builds. Research from Ivanti shows that 57% of employees feel stressed by the number of tools they must use, while 62% feel overwhelmed learning new ones. Over time, that constant friction quietly drains morale.

This challenge has only intensified with hybrid and remote work. Without quick desk-side help or hallway conversations, technology becomes the primary bridge connecting teams. If that bridge is strong, collaboration thrives. If it’s unstable, engagement begins to crack.

How Smart IT Builds a High-Morale, High-Retention Workforce

Smart IT isn’t about chasing every new platform or trend. Rather, it’s about shaping technology so it genuinely supports how people work—often in ways they notice immediately.

Here’s where the biggest impact happens.

1. Make Reliability and Usability Non-Negotiable

First and foremost, reliability matters. Ask yourself how many minutes employees lose each day to slow applications, dropped connections, or frozen systems. Over weeks and months, those minutes turn into hours of lost productivity and growing frustration.

Devices and applications should be fast, stable, and configured for real-world workloads. At the same time, usability is just as critical. When tools are intuitive, employees spend less time figuring out how to work and more time actually doing it. When technology fades into the background, morale naturally improves.

2. Personalize the Experience with AI and Automation

Next, it’s important to recognize that one-size-fits-all technology rarely works well. This is where AI-driven tools can make a real difference.

Personalized dashboards, automated help responses, and targeted learning recommendations can support employees based on their roles, goals, and challenges. Instead of searching through endless documentation, people receive guidance when and where they need it.

That kind of support sends a powerful message: “We see you, and we want you to succeed.” As a result, engagement and confidence grow.

3. Strengthen Communication and Collaboration

Strong morale is closely tied to strong relationships. Collaboration tools like Microsoft Teams, Slack, Zoom, and integrated project platforms help maintain those connections across offices, homes, and time zones.

However, the real value appears when systems work together. For example, when updating a project automatically syncs calendars and notifies teammates, employees avoid unnecessary manual work. Fewer disconnected tools mean fewer frustrations—and more time for meaningful collaboration.

4. Support Flexibility Without Encouraging Burnout

Flexibility has become one of the most powerful morale boosters modern IT can deliver. The ability to work from different locations gives employees greater control over their schedules and lives.

That said, flexibility without boundaries can quickly lead to burnout. Smart IT helps strike the balance by enabling focus time, clear status indicators, and notification controls outside working hours. Productivity matters—but so does the ability to truly disconnect.

5. Use Technology to Recognize and Reinforce Great Work

Finally, recognition plays a major role in morale, and technology can make it timely and visible. Digital recognition platforms, internal shout-outs, and feedback tools help reinforce positive contributions.

Just as importantly, when employees see their feedback lead to real improvements—better tools, smoother workflows, clearer processes—trust grows. Over time, that trust becomes a major reason people choose to stay.

Turning IT into a Morale-Boosting Advantage

Many IT investments are justified using metrics like efficiency, cost savings, or scalability. All of those matter. However, they often miss a bigger truth: the way employees experience technology shapes how they experience the company itself.

If you’re evaluating your current environment, consider a few simple questions:

  • Are you asking employees what’s working—and what isn’t?

  • Are you measuring satisfaction alongside uptime?

  • Are you streamlining tools instead of stacking them?

  • Are rollouts supported with training and follow-up?

  • Are you revisiting decisions as needs evolve?

Smart IT isn’t about having the most tools. It’s about building an ecosystem that works together, works reliably, and works for people. When you do that, you create a workforce that’s engaged, capable, and genuinely happy to log in each day.

So here’s the final question: If your technology could be the reason people love working for you, what’s standing in the way?

At Graphene Technologies in Houston, TX, we help organizations design IT strategies that improve productivity and employee experience. Contact us today to explore how smarter IT can help you retain your best people.

white-laptop-computer-on-white-table

Turning Data Into Action

by with No Comment Productivity

How Houston Businesses Can Use Microsoft Forms for Smarter Decision-Making

In today’s digital-first economy, data has become the lifeblood of every organization—regardless of industry or size. More than ever, a business’s ability to collect, analyze, and act on data is no longer just a competitive advantage. Instead, it is essential for long-term survival.

When organizations rely on data-driven decision-making, they can respond faster to market changes, uncover new opportunities, and improve operational efficiency. As a result, decisions supported by accurate, timely data tend to deliver both immediate impact and sustainable strategic value.

Whether insights come from customer surveys, employee feedback, transactional records, or operational metrics, data provides the foundation for smarter, more confident business strategies. With the right tools and processes in place, organizations can streamline workflows, enhance customer experiences, optimize resource allocation, and maintain a competitive edge in an increasingly complex business landscape.

One solution that stands out for modern businesses is Microsoft Forms. As part of the Microsoft 365 ecosystem, Forms offers a secure, compliant, and easy-to-use platform for collecting and analyzing data. More importantly, it enables organizations to turn raw information into actionable insight.

Why Microsoft Forms Is a Powerful Business Tool

At its core, Microsoft Forms is designed to simplify data collection without sacrificing flexibility or security. Because of this, it is well suited for organizations that want quick insights without complex development or third-party tools.

Some of the most valuable benefits include:

  • Ease of use: Thanks to a drag-and-drop interface, even non-technical users can create professional forms quickly.

  • Microsoft 365 integration: Forms works seamlessly with Teams, SharePoint, Excel, and Power Automate, allowing data to flow naturally into decision-making processes.

  • Real-time insights: Responses are collected instantly and automatically visualized through charts and graphs.

  • Mobile-friendly design: Since Forms is fully responsive, users can complete surveys on any device, anytime.

Taken together, these features make Microsoft Forms an accessible yet powerful tool for businesses of all sizes.

Business-Focused Features That Drive Results

Beyond basic functionality, Microsoft Forms includes several features specifically designed with business users in mind. Consequently, it can support everything from HR initiatives to operational tracking.

Customizable Form Templates

To begin with, Microsoft Forms offers a wide selection of built-in templates. These templates allow organizations to quickly launch:

  • Customer satisfaction surveys

  • Event registration forms

  • Employee engagement and feedback surveys

As a result, teams can save time while maintaining consistency and professionalism.

Flexible Question Types

In addition, Forms supports a wide range of question formats, allowing organizations to gather both qualitative and quantitative data. Available options include:

  • Multiple-choice questions

  • Short and long text responses

  • Rating and Likert scales

  • Date and time selectors

  • Secure file uploads

This flexibility ensures that data collection aligns with specific business objectives.

Secure Sharing Options

Equally important, Microsoft Forms allows organizations to control how data is shared. Forms can be distributed internally or externally, depending on user permissions. Furthermore, they can be embedded into emails or webpages for broader reach.

Built-In Data Analysis

Perhaps most importantly, every Microsoft Form automatically connects to Excel. Because of this, collected data can be quickly analyzed, filtered, and visualized to support informed policy and operational decisions.

Practical Use Cases Across the Organization

Microsoft Forms is not limited to a single department. On the contrary, it provides value across nearly every function within an organization.

Common use cases include:

  • Human Resources: Employee surveys, onboarding feedback, exit interviews

  • Marketing: Customer satisfaction surveys, campaign feedback, event evaluations

  • Training: Knowledge assessments, course registration, certification tracking

  • IT and Operations: Help desk requests, asset inventories, internal requests

By centralizing data collection, organizations gain better visibility and faster insight across teams.

Seamless Integration Across Microsoft 365

One of the greatest strengths of Microsoft Forms is its native integration within Microsoft 365. As a result, data collected through Forms can immediately fuel collaboration and automation.

Excel Integration

For every Form created, an associated Excel workbook is automatically generated. This allows teams to analyze trends, create reports, and share insights without manual data entry.

Power Automate Workflows

Additionally, Microsoft Forms integrates directly with Power Automate. Because of this, organizations can trigger workflows such as notifications, approvals, or follow-up tasks based on form responses.

SharePoint and Microsoft Teams

Finally, Forms can be embedded directly into SharePoint pages or Microsoft Teams tabs. This enhances collaboration by keeping data collection and analysis within the tools employees already use every day.

Best Practices for Maximizing Microsoft Forms

While Microsoft Forms is easy to use, following a few best practices can significantly increase its value.

To start:

  • Define clear objectives: Every question should serve a purpose tied to a specific outcome.

  • Use branching logic: Remove unnecessary questions based on previous responses to improve completion rates.

  • Protect privacy: When appropriate, allow anonymous responses to encourage honest feedback.

  • Limit open-ended questions: Too many free-text responses can make data difficult to analyze at scale.

By applying these practices, organizations can collect cleaner, more actionable data.

Security and Compliance Considerations

Importantly, Microsoft Forms benefits from the broader Microsoft 365 security and compliance framework. As a result, organizations gain enterprise-grade protection without additional complexity.

Key protections include:

  • Encryption for data at rest and in transit

  • Audit logs to support accountability and compliance requirements

This makes Microsoft Forms a strong choice for organizations operating in regulated industries.

Turning Data Into a Competitive Advantage

In conclusion, Microsoft Forms enables organizations to unlock the true value of their data by making it easy to collect, analyze, and act on insights. Whether improving onboarding processes, gathering employee feedback, or tracking customer satisfaction, Forms supports faster, more informed decision-making.

When combined with automation and analytics within Microsoft 365, organizations can build end-to-end workflows that improve efficiency and responsiveness. With the right guidance and configuration, Microsoft Forms becomes more than a survey tool—it becomes a strategic asset.

At Graphene Technologies in Houston, TX, we help businesses optimize Microsoft 365 tools to drive smarter decisions and measurable results. Contact us today to learn how Microsoft Forms can help transform your data into a lasting competitive advantage.

Free cloud storage icon vector

Cloud Compliance Is Not Optional

by with No Comment Cloud

How Houston Businesses Can Stay Secure and Meet Regulatory Requirements

As digital transformation continues to accelerate, more organizations across Houston are migrating to cloud-based environments. On the surface, the reasons are clear. Cloud solutions offer scalability, flexibility, and cost efficiency while supporting modern workflows and remote operations. However, alongside these benefits comes a growing and often underestimated challenge: compliance.

In today’s regulatory climate, cloud compliance is no longer optional. In fact, small and mid-sized businesses are now facing the same regulatory expectations as large enterprises. Regulations such as HIPAA, PCI DSS, and GDPR impose strict data protection requirements. As a result, organizations that fail to comply may face financial penalties, legal consequences, and reputational harm.

Simply put, moving to the cloud does not eliminate compliance obligations. On the contrary, it often makes them more complex.

What Cloud Compliance Really Means

To begin with, cloud compliance refers to the process of meeting legal, regulatory, and industry standards related to data security, privacy, and protection in cloud environments. Unlike traditional on-premises systems, cloud environments introduce additional layers of complexity. Specifically, data is often distributed across regions, shared infrastructure is common, and third-party vendors play a larger role.

Because of this, organizations must take a more deliberate approach. At a minimum, cloud compliance requires businesses to:

  • Secure data both at rest and in transit

  • Maintain strict access controls and detailed audit trails

  • Ensure proper data residency and sovereignty

  • Demonstrate compliance through ongoing assessments and documentation

If any of these areas are overlooked, an organization can quickly fall out of compliance—even if its cloud provider is secure.

For additional context on how compliance ties into overall risk, see our related article:
https://graphenetechs.net/blog/cyber-risk-management-for-small-businesses-in-houston/

Understanding the Shared Responsibility Model

Equally important is understanding the Shared Responsibility Model, which defines how compliance responsibilities are divided between the cloud service provider (CSP) and the customer.

On one hand:

  • Cloud Service Providers are responsible for securing the underlying infrastructure, including physical data centers, hardware, and core networking.

On the other hand:

  • Customers are responsible for securing their data, user access, identity management, configurations, and compliance controls.

Unfortunately, many organizations assume that compliance responsibility transfers to the provider once workloads move to the cloud. In reality, this assumption leads to misconfigurations and compliance gaps.

Major cloud providers, including AWS, clearly define this responsibility split:
https://aws.amazon.com/compliance/shared-responsibility-model/

Key Compliance Regulations Affecting Cloud Environments

Because compliance requirements vary by industry and geography, it is essential to understand which regulations apply to your organization. Below are the most common frameworks impacting cloud-based environments.

General Data Protection Regulation (GDPR) – European Union

First, GDPR remains one of the most comprehensive data privacy laws globally. It applies to any organization that processes personal data belonging to EU residents—regardless of where the organization operates.

In cloud environments, GDPR requires organizations to:

  • Store data in GDPR-compliant regions

  • Support data subject rights, such as access and deletion

  • Encrypt personal data at rest and in transit

  • Maintain breach detection and notification procedures

More details from the European Commission:
https://commission.europa.eu/law/law-topic/data-protection_en

Health Insurance Portability and Accountability Act (HIPAA) – United States

Similarly, HIPAA governs how protected health information (PHI) is handled in the U.S. Therefore, any cloud system that stores or transmits electronic PHI must meet HIPAA security and privacy requirements.

Key cloud-related HIPAA considerations include:

  • Using HIPAA-compliant cloud providers

  • Executing Business Associate Agreements (BAAs)

  • Encrypting ePHI in storage and transmission

  • Maintaining detailed access logs and audit trails

Official HIPAA guidance:
https://www.hhs.gov/hipaa/index.html

Payment Card Industry Data Security Standard (PCI DSS)

Likewise, organizations that process or store payment card data must comply with PCI DSS. Importantly, hosting payment systems in the cloud does not reduce these obligations.

Cloud-specific PCI requirements include:

  • Tokenization and encryption of cardholder data

  • Network segmentation within cloud environments

  • Regular vulnerability scanning and penetration testing

PCI Security Standards Council overview:
https://www.pcisecuritystandards.org/

Federal Risk and Authorization Management Program (FedRAMP)

In addition, organizations supporting U.S. government agencies must meet FedRAMP requirements. As such, cloud providers and vendors must undergo rigorous assessments and continuous monitoring.

FedRAMP applies when:

  • Supporting federal agencies or contractors

  • Handling government-controlled data

  • Operating within regulated public-sector environments

Learn more:
https://www.fedramp.gov/

ISO/IEC 27001

Finally, ISO/IEC 27001 provides an internationally recognized framework for managing information security. While not legally required, it is often used to demonstrate strong compliance and governance practices.

Cloud-focused ISO requirements include:

  • Ongoing risk assessments

  • Documented policies and procedures

  • Formal access control and incident response plans

ISO overview:
https://www.iso.org/isoiec-27001-information-security.html

Best Practices for Maintaining Cloud Compliance

At this point, it is important to recognize that cloud compliance is not a one-time task. Rather, it requires continuous oversight, proactive governance, and regular improvement.

Conduct Regular Audits

First and foremost, regular audits help identify compliance gaps before they become regulatory violations. By addressing issues early, organizations reduce both risk and remediation costs.

Enforce Strong Access Controls

Next, applying the principle of least privilege (PoLP) ensures users only access what they need. When combined with MFA, access controls dramatically reduce unauthorized access risks.

Related reading:
https://graphenetechs.net/blog/credential-theft-prevention-for-houston-businesses/

Encrypt Data Everywhere

Equally important, sensitive data must be encrypted both at rest and in transit using industry-standard protocols such as TLS and AES-256. In most cases, encryption is a baseline compliance requirement.

Implement Comprehensive Monitoring

Additionally, centralized logging and real-time monitoring provide visibility into user activity and compliance events. As a result, organizations can respond faster to incidents and audits.

Ensure Proper Data Residency

Furthermore, understanding where data resides is critical. Jurisdictional laws vary, and failure to comply with data residency requirements can lead to violations even when security controls are strong.

Train Employees Regularly

Finally, no compliance strategy is complete without employee training. After all, human error remains a leading cause of compliance failures.

For more on security awareness:
https://graphenetechs.net/blog/security-awareness-training-for-employees/

Cloud Compliance Is a Business Imperative

In conclusion, as organizations continue adopting cloud technologies, compliance becomes more complex—and more critical. Regulatory expectations are rising, enforcement is tightening, and attackers actively exploit compliance gaps.

At Graphene Technologies in Houston, TX, we help businesses navigate cloud compliance with practical, real-world strategies. From assessments and access controls to audit readiness and ongoing governance, we help reduce risk while maintaining compliance.

If you’re ready to strengthen your cloud compliance posture, contact us today for expert guidance and clear next steps—before compliance gaps become business liabilities.

Free phishing scam website vector

Credential Theft Is the Front Door to Modern Cyberattacks

by with No Comment Cybersecurity

How Houston Businesses Can Strengthen Authentication and Reduce Risk

As digital transformation accelerates across Houston, data and security have become core business priorities. Cloud platforms, remote work, automation, and connected devices have dramatically improved efficiency—but they have also expanded the attack surface. As a result, cybercriminals are no longer forcing their way into systems. Instead, they are logging in.

Credential theft has become one of the most effective and damaging cyberattack methods facing businesses today. Through phishing, malware, and social engineering, attackers steal legitimate usernames and passwords, allowing them to bypass traditional defenses and access sensitive systems unnoticed.

According to the Verizon 2025 Data Breach Investigations Report, more than 70% of data breaches involve stolen credentials, making identity-based attacks the most common entry point for modern breaches
https://www.verizon.com/business/resources/reports/dbir/

For small and mid-sized businesses in Houston, the consequences are severe—financial loss, operational downtime, regulatory exposure, and long-term reputational damage. Simply put, passwords alone are no longer enough. To stay secure, organizations must modernize how they protect business logins and user identities.

Understanding How Credential Theft Really Works

Credential theft is rarely a single event. Instead, it is a staged process that often unfolds quietly over time. Attackers gather information, test access, and escalate privileges until they can move laterally across systems.

Common credential theft methods include:

  • Phishing emails, which impersonate trusted brands or internal staff to lure users into entering credentials on fake login pages

  • Keylogging malware, which silently records keystrokes to capture usernames and passwords

  • Credential stuffing, where attackers reuse leaked credentials from previous breaches across multiple platforms

  • Man-in-the-middle (MitM) attacks, which intercept login data on unsecured or compromised networks

Because these attacks frequently rely on legitimate credentials, they often evade traditional security tools until damage has already occurred.

Why Password-Only Security Fails Modern Businesses

For years, usernames and passwords served as the primary line of defense. However, this model is fundamentally broken in today’s threat landscape.

Passwords fail because:

  • Users frequently reuse them across work and personal systems

  • Many passwords are weak, predictable, or shared

  • Phishing attacks can easily steal valid credentials

Even strong passwords offer little protection once they are compromised. This is why modern security frameworks now emphasize identity-first protection.

For a deeper look at how identity security fits into broader cyber risk management, see our related article:
https://graphenetechs.net/blog/cyber-risk-management-for-small-businesses-in-houston/

Advanced Strategies to Secure Business Logins

To effectively combat credential theft, businesses should adopt a layered security strategy that combines prevention, monitoring, and enforcement. Below are the most effective methods organizations should implement today.

Multi-Factor Authentication (MFA)

Multi-factor authentication is one of the simplest and most impactful ways to stop credential-based attacks. Even if a password is stolen, MFA prevents attackers from logging in without a second verification factor.

Common MFA methods include:

  • One-time passcodes sent to a trusted device

  • Push notifications via authentication apps

  • Biometric verification such as fingerprint or facial recognition

Hardware security keys and app-based authenticators provide even stronger protection and are recommended for executives and administrators.

CISA strongly recommends MFA as a baseline security control:
https://www.cisa.gov/mfa

Passwordless Authentication

To further reduce risk, many organizations are moving toward passwordless authentication models. Instead of relying on static credentials, these systems use:

  • Biometrics for secure, user-friendly authentication

  • Single Sign-On (SSO) through enterprise identity providers

  • Mobile push approvals that verify login attempts in real time

By eliminating passwords entirely, businesses remove one of the most exploited attack vectors.

Privileged Access Management (PAM)

Not all users pose the same level of risk. Privileged accounts—such as IT administrators and executives—are prime targets due to their elevated access.

Privileged Access Management solutions protect these accounts by:

  • Enforcing just-in-time access

  • Monitoring privileged sessions

  • Storing credentials securely in encrypted vaults

This significantly reduces the damage attackers can cause even if credentials are compromised.

Behavioral Analytics and Anomaly Detection

Modern authentication platforms now use AI-driven behavioral analytics to detect suspicious activity. These tools monitor for:

  • Logins from unfamiliar locations or devices

  • Access attempts at unusual times

  • Repeated failed login attempts

Continuous monitoring allows organizations to detect and respond to threats before attackers can escalate access.

Zero Trust Architecture

Zero Trust security operates on a simple principle: never trust, always verify. Unlike traditional network-based trust models, Zero Trust continuously validates users, devices, and context for every access request.

This approach aligns closely with NIST Zero Trust guidance:
https://www.nist.gov/zero-trust

Zero Trust is especially effective for organizations with remote workforces, cloud environments, and third-party access.

Why Employee Training Still Matters

Even the strongest security controls can be undermined by human error. In fact, user behavior remains one of the leading contributors to data breaches.

Effective training should teach employees how to:

  • Identify phishing and social engineering attempts

  • Use password managers properly

  • Avoid credential reuse

  • Understand why MFA is mandatory

An informed workforce dramatically reduces the success rate of credential theft attacks.

For more on building a human-focused security strategy, read:
https://graphenetechs.net/blog/security-awareness-training-for-employees/

Credential Theft Is No Longer a Question of “If”

Today, credential theft is inevitable. The only real question is whether your defenses are strong enough to stop attackers once credentials are exposed.

Organizations that continue relying on password-only security are leaving the front door open. However, by implementing MFA, adopting Zero Trust principles, securing privileged access, and educating employees, businesses can significantly reduce their risk.

At Graphene Technologies in Houston, TX, we help organizations modernize authentication, strengthen identity security, and protect critical systems against credential-based attacks.

If you want to understand where your business stands—or how to close security gaps—contact us today for a practical assessment and clear next steps.

a computer keyboard with a padlock on top of it

Your 2025 Privacy Compliance Checklist and What You Need to Know About the New Data Laws

by with No Comment IT Management

Privacy regulations are evolving rapidly, and 2025 could be a pivotal year for businesses of all sizes. With new state, national, and international rules layering on top of existing requirements, staying compliant is no longer optional. A basic policy won’t suffice; you need a comprehensive 2025 Privacy Compliance Checklist that clearly outlines the latest changes, from updated consent protocols to stricter data transfer standards.

This guide will help you understand what’s new in privacy regulations and give you a way to navigate compliance without getting lost in legal terms. 

Why Your Website Needs Privacy Compliance

If your website collects any kind of personal data, such as newsletter sign-ups, contact forms, or cookies, privacy compliance is necessary. It’s a legal obligation that’s becoming stricter each year.

Governments and regulators have become much more aggressive. Since the GDPR took effect, reported fines have exceeded €5.88 billion (USD$6.5 billion) across Europe, according to DLA Piper. Meanwhile, U.S. states like California, Colorado, and Virginia have introduced their own privacy laws that are just as tough.

Compliance isn’t just about avoiding penalties; it’s about building trust. Today’s users expect transparency and control over their information. If they sense opacity in how their data is used, they may leave or raise concerns. A clear and honest privacy policy fosters trust and helps your business stand out, especially in the digital age, where misuse of data can damage a reputation within hours.

Privacy Compliance Checklist 2025: Top Things to Have

Meeting privacy requirements isn’t just about compliance; it’s about giving your users confidence that their information is safe with you. Here’s what your 2025 privacy framework should include:

  1. Transparent Data Collection: Be clear about what personal data you collect, why you collect it, and how you use it. Avoid vague generalities such as “we might use your information to enhance services.” Be specific and truthful.
  2. Effective Consent Management: Consent must be active, recorded, and reversible. Users should be able to opt in or out at will, and you should have records that show when consent was given. You need to refresh user consent whenever you change how their data is used.
  3. Full Third-Party Disclosures: Be honest about what third parties process user data, from email automation tools to payment systems, and how you evaluate their privacy policies. 
  4. Privacy Rights and User Controls: Clearly outline users’ rights, such as access, correction, deletion, data portability, and the ability to object to processing, and make it simple for them to exercise these rights without endless email back-and-forth.
  5. Strong Security Controls: Apply encryption, multi-factor authentication (MFA), endpoint monitoring, and regular security audits. 
  6. Cookie Management and Tracking: Cookie popups are changing and give users more control over non-essential cookies. Don’t rely on default “opt-in” methods or confusing jargon. Clearly disclose tracking tools and refresh them on a regular basis.
  7. Global Compliance Assurance: If you serve international customers, ensure compliance with GDPR, CCPA/CPRA, and other regional privacy laws. Keep in mind each region has its own updates, such as enhanced data portability rights, shorter breach notification timelines, and expanded definitions of “personal data.”
  8. Aged Data Retention Practices: Avoid keeping data indefinitely “just in case.” Document how long you retain it and outline how it will be securely deleted or anonymized. Regulators now expect clear evidence of these deletion plans.
  9. Open Contact and Governance Details: Your privacy policy should have the name of a Data Protection Officer (DPO) or privacy contact point. 
  10. Date of Policy Update: Add a “last updated” date to your privacy policy to notify users and regulators that it is actively maintained and up-to-date.
  11. Safeguards for Children’s Data: If you are collecting data from children, have more stringent consent processes. Some laws now require verifiable parental consent for users under a specified age. Review your forms and cookie use for compliance.
  12. Automated Decision-Making and Use of AI: Disclose the use of profiling software and AI platforms. When algorithms influence pricing, risk assessments, or recommendations, users should understand how they operate and have the right to request a human review.

What’s New in Data Laws in 2025

In 2025, privacy regulations are expanding, with stricter interpretations and stronger enforcement. Here are six key privacy developments to watch and prepare for:

International Data Transfers

Cross-border data flow is under scrutiny again. The EU-U.S. Data Privacy Framework faces new legal challenges, and several watchdog groups are testing its validity in court. Moreover, businesses that depend on international transfers need to review Standard Contractual Clauses (SCCs) and ensure their third-party tools meet adequacy standards.

Consent and Transparency

Consent is evolving from a simple ‘tick box’ to a dynamic, context-aware process. Regulators now expect users to be able to easily modify or withdraw consent, and your business must maintain clear records of these actions. In short, your consent process should prioritize the user experience, not just regulatory compliance.

Automated Decision-Making

If you use AI to personalize services, generate recommendations, or screen candidates, you’ll need to explain how those systems decide. New frameworks in many countries now require “meaningful human oversight.” The days of hidden algorithms are coming to an end.

Expanded User Rights

Expect broader rights for individuals, such as data portability across platforms and the right to limit certain types of processing. These protections are no longer limited to Europe, several U.S. states and regions in Asia are adopting similar rules.

Data Breach Notification

Timelines for breach reporting are shrinking. Certain jurisdictions now require organizations to report breaches to authorities within 24 to 72 hours of discovery. Missing these deadlines can lead to higher fines and damage your reputation.

Children’s Data and Cookies

Stricter controls around children’s privacy are being adopted globally. Regulators are cracking down on tracking cookies and targeted ads aimed at minors. If you have international users, your cookie banner may need more customization than ever.

Do You Need Help Complying with New Data Laws? 

In 2025, privacy compliance can no longer be treated as a one-time task or a simple checkbox. It’s an ongoing commitment that touches every client, system, and piece of data you manage. Beyond avoiding fines, these new laws help you build trust, demonstrating that your business values privacy, transparency, and accountability.

If this feels overwhelming, you don’t have to face it alone. With the right guidance, you can stay on top of privacy, security, and compliance requirements using practical tools, expert advice, and proven best practices. Our step-by-step support from experienced professionals who understand the challenges businesses face will give you the clarity and confidence to turn privacy compliance into a strategic advantage in 2025. Contact us today.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

a-close-up-of-a-keyboard-with-a-blue-button

AI Security for Small Businesses in Houston TX | Graphene Technologies

by with No Comment New Technology

Most organizations now understand that AI is not a sentient threat trying to take over the world. Instead, it has become an invaluable tool for improving productivity. Adoption has surged as more companies use AI to automate repetitive tasks and create richer insights from their data. Although this boost in efficiency is impressive, it also introduces new concerns involving data security, privacy, and cyber risk.

Because of these challenges, businesses must learn how to embrace AI without exposing themselves to unnecessary threats. Striking this balance allows you to remain competitive while staying secure.

The Rise of AI

AI is no longer reserved for massive enterprises. Thanks to cloud platforms and accessible machine learning APIs, small and medium-sized businesses can now integrate AI into daily operations. As a result, AI has become a familiar part of business workflows in areas such as:

• Email and meeting scheduling
• Customer service automation
• Sales forecasting
• Document generation
• Invoice processing
• Data analytics
• Cybersecurity threat detection

These tools help teams work faster and reduce errors. However, organizations must also take steps to limit cybersecurity risks that come with widespread AI adoption. To understand broader national guidance, review CISA’s AI Security Best Practices.

AI Adoption Risks

Although AI improves productivity, it also expands the potential attack surface for cybercriminals. Therefore, organizations must consider the risks associated with new technology and plan accordingly.

Data Leakage

AI tools require large datasets to function. Some of this data may include sensitive customer information, financial records, or proprietary content. When information is sent to third-party AI services, companies must understand how that data will be stored, processed, and protected. Without proper handling, data can be exposed, reused for training, or even leaked publicly.

Shadow AI

Employees often turn to unapproved AI tools to increase productivity. Unfortunately, this can create compliance issues and increase the chances of data exposure. Even a simple copy-and-paste into an online chatbot can reveal confidential information.

Overreliance and Automation Bias

Although AI tools feel accurate, they are not perfect. Users may trust results without verifying them, which leads to poor decisions. Because of this, human oversight is essential.

Secure AI and Productivity

Despite the risks, securing AI use is completely achievable. With the right guardrails, businesses can enjoy AI-driven efficiency without compromising their data.

Establish an AI Usage Policy

Start by setting clear guidelines before deploying any AI tools. A strong policy defines:

• Approved AI vendors
• Acceptable use cases
• Restricted data types
• Data retention practices

Training employees on these guidelines is equally important. Clear expectations reduce accidental misuse and protect sensitive information.

For help structuring policies and controls, explore Managed IT Services in Houston.

Choose Enterprise-Grade AI Platforms

Next, select AI platforms that meet strict security requirements. Look for solutions that are:

• GDPR, HIPAA, or SOC 2 compliant
• Equipped with data residency controls
• Transparent about not using customer data for model training
• Built with encryption for data in transit and at rest

Reliable vendors reduce risk and strengthen your cybersecurity posture.

Segment Sensitive Data Access

Using role-based access control (RBAC) prevents AI tools from accessing unnecessary information. Because access is limited, both exposure risk and internal misuse decrease significantly.

Monitor AI Usage

Ongoing monitoring helps you understand how AI is being used across your organization. Ideally, you track:

• Which employees use which AI tools
• What data is being processed
• Alerts for unusual or risky behavior

These insights help you respond quickly to potential threats. For additional security strategies, visit Cybersecurity and Exposure Management.

AI for Cybersecurity

Interestingly, AI is also one of the strongest tools available for defending against cyber threats. Many security platforms now use AI to:

• Detect intrusions
• Stop phishing attempts
• Strengthen endpoint protection
• Automate incident response

Solutions such as SentinelOne, Microsoft Defender for Endpoint, and CrowdStrike all use AI to identify suspicious behavior in real time. Reports such as the Verizon Data Breach Investigations Report further highlight how AI-driven detection reduces response time and increases accuracy.

Train Employees About Responsible Use

Human error remains the biggest security risk in any organization. Even the strongest defenses can be undone by a single careless click. Because of this, employees should be trained regularly on responsible AI usage.

Effective training includes:

• Risks of entering company data into AI tools
• Recognition of AI-generated phishing attacks
• Identifying misleading or inaccurate AI-generated content

When employees understand these risks, the entire organization becomes safer.

AI With Guardrails

AI tools have the power to transform how organizations operate. They can streamline tasks, improve decision-making, and reduce overhead. However, productivity without protection is a risk no business should take.

If your organization wants to use AI safely and confidently, connect with us today through Contact Graphene Technologies. Our experts can help you build secure policies, choose the right tools, and implement guardrails that allow your business to innovate without compromise.