https://systechitsolutions.co.uk/_next/static/chunks/pages/blog/sm…rnance-security-posture-d73fb5f34fa78807.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[3297],{97013:function(e,s,t){(window.__NEXT_P=window.__NEXT_P||[]).push(["/blog/small-business-it-governance-security-posture",function(){return t(77660)}])},77660:function(e,s,t){"use strict";t.r(s),t.d(s,{default:function(){return u},faqs:function(){return d},meta:function(){return c}});var a=t(85893),n=t(11151),r=t(50148),i=t(59569),o={pain:{id:"pain",section:"What does IT governance mean for a small business?",kind:"vignette",alt:"Illustration of a client security questionnaire asking whether MFA is enforced, who has admin rights, whether the business can recover from ransomware and how leavers are handled, each still waiting for evidence.",caption:"The questions are reasonable. What is usually missing is not the control but the record that shows it is on.",wide:{src:"/_next/static/media/blog-small-business-it-governance-security-posture-pain.310bb59c.webp",height:974,width:1760,blurDataURL:"data:image/webp;base64,UklGRjQAAABXRUJQVlA4ICgAAACwAQCdASoIAAQAAkA4JZwAAxZgs2AwAP78I6LIem86nGyQWkLgAAAA",blurWidth:8,blurHeight:4},narrow:{src:"/_next/static/media/blog-small-business-it-governance-security-posture-pain-narrow.897bc3b4.webp",height:1458,width:1e3,blurDataURL:"data:image/webp;base64,UklGRjgAAABXRUJQVlA4ICwAAADQAQCdASoFAAgAAkA4JaQAAxedEeqvAAD+/CTBQKE5DY3R8NTIvt4C0AAAAA==",blurWidth:5,blurHeight:8}},plan:{id:"plan",section:"The first 30 days: close the doors attackers use most",kind:"process",alt:"Timeline of tightening security posture: the first 30 days on MFA, admin accounts, patching, old accounts and a tested restore; the next 90 on devices, email, leavers, suppliers and awareness; then quarterly evidence.",caption:"Close the commonest routes in first, then make each control consistent and leave a record that it is.",wide:{src:"/_next/static/media/blog-small-business-it-governance-security-posture-plan.318ae332.webp",height:550,width:1760,blurDataURL:"data:image/webp;base64,UklGRiwAAABXRUJQVlA4ICAAAABwAQCdASoIAAMAAwA4JZQCdAF1AAD+9R8p5rJ3o1coAA==",blurWidth:8,blurHeight:3},narrow:{src:"/_next/static/media/blog-small-business-it-governance-security-posture-plan-narrow.4b2b1cfd.webp",height:858,width:1e3,blurDataURL:"data:image/webp;base64,UklGRi4AAABXRUJQVlA4ICIAAABwAQCdASoIAAcAAkA4JZQCdAGIQAD+9OnppxDD5s7SIIAA",blurWidth:8,blurHeight:7}}};let c=(0,t(86256).zQ)("small-business-it-governance-security-posture"),d=[{q:"Does a small business need formal IT security policies?",a:"Not necessarily a thick policy manual. The ICO says an information security policy is an example of an appropriate organisational measure, but that you may not need a formal policy document or a set of policies in specific areas, depending on your size and the amount and nature of the personal data you process. It also says that having a policy does enable you to demonstrate how you are complying with the security principle. In practice, a short written set that people actually follow, covering access, devices, passwords, backups and incidents, is what a client questionnaire or insurer is looking for."},{q:"Is Cyber Essentials enough to meet UK GDPR security requirements?",a:"It is a good starting point, not a guarantee. The ICO says a good starting point is to be in line with the requirements of Cyber Essentials, but that you may have to go beyond them depending on your processing, because Cyber Essentials is only intended to provide a base set of controls and will not address the circumstances of every organisation. UK GDPR also expects things the scheme does not assess, such as being able to restore access to personal data after an incident and regularly testing that your measures work. If you are unsure what applies to your processing, take advice from a data protection specialist or solicitor."},{q:"What should we do first to improve our security posture?",a:"Start with the controls that stop the most common attacks and that Cyber Essentials now treats as automatic fails. Turn on multi-factor authentication for every cloud service where it is available, separate administrator accounts from everyday accounts, install high-risk and critical updates within 14 days, remove accounts that are no longer needed, and prove that your backups can actually be restored. Those five can usually be done inside a month for a business of 5 to 50 people, and they are the same things a client or insurer will ask about first."}],l=function(e){let{children:s}=e;return(0,a.jsx)(r.Bf,{slug:c.slug,title:c.title,seoTitle:c.seoTitle,category:c.category,excerpt:c.excerpt,publishedAt:c.publishedAt,updatedAt:c.updatedAt,readTime:c.readTime,heroImage:c.heroImage,faqs:d,ctaOffer:"security",children:s})};function h(e){let s={a:"a",details:"details",h2:"h2",h3:"h3",li:"li",nav:"nav",ol:"ol",p:"p",strong:"strong",summary:"summary",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("p",{className:"lede",children:"Most businesses of 5 to 50 people do not have a security team. They have someone who knows where the router is, a Microsoft 365 tenant that grew up alongside the business, and a client questionnaire on the desk asking for evidence nobody has written down."}),"\n",(0,a.jsxs)("p",{className:"answer",children:[(0,a.jsx)("strong",{children:"In short:"})," IT governance at this size is four things: a named person who owns IT risk, a short set of written policies peo

1ple actually follow, a register of your devices and who has access to what, and evidence you could show a client or insurer. To tighten your posture, spend the first 30 days on multi-factor authentication, separate admin accounts, 14-day patching, removing old accounts and a tested restore. Spend the next 90 on device management and encryption, email authentication, joiners and leavers, supplier access and staff awareness. Cyber Essentials covers much of that, but not all of it."]}),"\n",(0,a.jsx)(s.nav,{className:"pageNav pageNav--inline","aria-label":"On this page",children:(0,a.jsxs)(s.details,{className:"pageNav__details",children:[(0,a.jsx)(s.summary,{className:"pageNav__title",children:"On this page"}),(0,a.jsxs)(s.ol,{className:"pageNav__list",children:[(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#what-does-it-governance-mean-for-a-small-business",children:"What does IT governance mean for a small business?"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#the-first-30-days-close-the-doors-attackers-use-most",children:"The first 30 days: close the doors attackers use most"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#the-next-90-days-make-it-managed-and-provable",children:"The next 90 days: make it managed and provable"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#which-compliance-obligations-apply-to-a-small-business",children:"Which compliance obligations apply to a small business?"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#how-do-you-show-your-security-posture-to-clients-insurers-and-auditors",children:"How do you show your security posture to clients, insurers and auditors?"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#what-are-the-most-common-mistakes",children:"What are the most common mistakes?"})}),(0,a.jsx)(s.li,{children:(0,a.jsx)(s.a,{className:"pageNav__link",href:"#where-to-start",children:"Where to start"})})]})]})}),(0,a.jsx)(s.h2,{id:"what-does-it-governance-mean-for-a-small-business",children:"What does IT governance mean for a small business?"}),"\n",(0,a.jsx)(s.p,{children:"Governance sounds like a board-level framework. At 5 to 50 people it is much simpler, and it fits on a page."}),"\n",(0,a.jsx)(i.d,{figure:o.pain}),"\n",(0,a.jsxs)(s.ul,{children:["\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"A named owner for IT risk."})," One person, usually a director or the operations lead, who decides what good looks like and signs off exceptions. Your IT provider can run the controls; they should not own the risk."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"A short set of written policies."})," Acceptable use, access and passwords, devices, backups, and what to do in an incident. A few pages people have read beats a template pack nobody has opened."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"An asset and access register."})," Every laptop, phone and server, who uses it, and which systems each person can reach. You cannot secure, patch or offboard what you have not listed."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Evidence."}),' Screenshots, reports and records that show the controls are on. This is what turns "we take security seriously" into an answer a client can accept.']}),"\n"]}),"\n",(0,a.jsxs)(s.p,{children:["The ICO makes the same point about scale. Its ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/",children:"guide to data security"})," says you may not need a formal policy document, depending on your size and the personal data you hold. It adds that having one does help you demonstrate you are meeting the security principle."]}),"\n",(0,a.jsxs)(s.p,{children:["The NCSC's ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/collection/small-business-guide",children:"small organisations guide"}),' is blunter about why this matters. It says 1 in 2 small businesses suffer a cyber incident every year, and warns against leaving security with a single person, because "cyber security is everyone\'s business".']}),"\n",(0,a.jsx)(s.h2,{id:"the-first-30-days-close-the-doors-attackers-use-most",children:"The first 30 days: close the doors attackers use most"}),"\n",(0,a.jsxs)(s.p,{children:["These five controls close the commonest routes in, and two of them, MFA and patching, are now automatic fail

1s in Cyber Essentials if they are missing. The right-hand column maps each one to the ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/cyberessentials/overview",children:"Cyber Essentials"})," control theme it belongs to."]}),"\n",(0,a.jsx)(i.d,{figure:o.plan}),"\n",(0,a.jsxs)(s.table,{children:[(0,a.jsx)(s.thead,{children:(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.th,{children:"Control"}),(0,a.jsx)(s.th,{children:"What good looks like"}),(0,a.jsx)(s.th,{children:"Cyber Essentials theme"})]})}),(0,a.jsxs)(s.tbody,{children:[(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Multi-factor authentication"}),(0,a.jsx)(s.td,{children:"On for every user and every cloud service where it is available, admins included"}),(0,a.jsx)(s.td,{children:"User access control"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Separate admin accounts"}),(0,a.jsx)(s.td,{children:"Admin rights on a separate account, never used for email or browsing"}),(0,a.jsx)(s.td,{children:"User access control"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Patching"}),(0,a.jsx)(s.td,{children:"High-risk and critical updates installed within 14 days; unsupported devices replaced"}),(0,a.jsx)(s.td,{children:"Security update management"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Removing old accounts"}),(0,a.jsx)(s.td,{children:"Leavers, old suppliers and unused admin accounts disabled"}),(0,a.jsx)(s.td,{children:"User access control and secure configuration"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Tested backup"}),(0,a.jsx)(s.td,{children:"A restore you have actually performed, from a copy not connected to live systems"}),(0,a.jsx)(s.td,{children:"Not a Cyber Essentials requirement"})]})]})]}),"\n",(0,a.jsx)(s.h3,{id:"multi-factor-authentication-everywhere",children:"Multi-factor authentication everywhere"}),"\n",(0,a.jsxs)(s.p,{children:["Since April 2026, IASME has confirmed that ",(0,a.jsx)(s.a,{href:"https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/",children:"not implementing MFA on a cloud service where it is available is an automatic fail"}),", whether MFA is free, included or a paid option."]}),"\n",(0,a.jsxs)(s.p,{children:["In Microsoft 365 there are two routes. ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults",children:"Security defaults"})," need no extra licence. They require everyone to register for MFA, require MFA for administrators, and block legacy authentication. Conditional Access needs at least Microsoft Entra ID P1 and lets you tailor the rules; our ",(0,a.jsx)(s.a,{href:"/blog/conditional-access-policies-smb",children:"Conditional Access baseline for SMBs"})," sets out the order to deploy them."]}),"\n",(0,a.jsx)(s.h3,{id:"separate-admin-accounts",children:"Separate admin accounts"}),"\n",(0,a.jsxs)(s.p,{children:["The ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf",children:"Cyber Essentials requirements"})," say to use separate accounts for administrative activities only, with no emailing, web browsing or other standard user activity. Microsoft gives the same advice in its security defaults guidance."]}),"\n",(0,a.jsx)(s.p,{children:"It also recommends two cloud-only emergency access accounts, so one bad policy cannot lock every administrator out."}),"\n",(0,a.jsx)(s.h3,{id:"patching-inside-14-days",children:"Patching inside 14 days"}),"\n",(0,a.jsx)(s.p,{children:"Two update questions became automatic fails in April 2026. High-risk or critical updates for operating systems, router and firewall firmware, and applications must be installed within 14 days of release."}),"\n",(0,a.jsxs)(s.p,{children:["The NCSC's ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/protecting-your-devices",children:"device guidance"})," adds the part people skip: if a device no longer receives updates, replace it."]}),"\n",(0,a.jsx)(s.h3,{id:"remove-accounts-nobody-uses",children:"Remove accounts nobody uses"}),"\n",(0,a.jsxs)(s.p,{children:["The NCSC notes that accounts created for staff, suppliers and contractors ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts",children:"often stay active after people leave"}),", with outdated passwords and settings. Disable them. Check finance, payroll, social media and the domain registrar as well as Microsoft 365."]}),"\n",(0,a.jsx)(s.h3,{id:"prove-the-backup-restores",children:"Prove the backup restores"}),"\n",(0,a.jsxs)(s.p,{children:["Backup is ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastru

1cture-v3-3.pdf",children:"not a technical requirement of Cyber Essentials"}),", though the NCSC strongly recommends it. The ICO's ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/advice-for-small-organisations/information-security/data-security-advice/practical-ways-to-keep-your-it-systems-safe-and-secure/",children:"practical IT security steps"})," are direct: check your backup, and make sure it is not connected to your live data."]}),"\n",(0,a.jsx)(r.NT,{children:'"A backup nobody has restored from is a hope, not a control. The test restore is the evidence."'}),"\n",(0,a.jsx)(s.h2,{id:"the-next-90-days-make-it-managed-and-provable",children:"The next 90 days: make it managed and provable"}),"\n",(0,a.jsx)(s.p,{children:"With the doors shut, the next stage is making each control consistent across every device and person, and leaving a record that it is."}),"\n",(0,a.jsx)(s.h3,{id:"device-management-and-encryption",children:"Device management and encryption"}),"\n",(0,a.jsx)(s.p,{children:"Enrol every laptop and phone used for work into a device management platform such as Microsoft Intune. Then enforce a PIN or password, screen lock and encryption from policy rather than trust."}),"\n",(0,a.jsxs)(s.p,{children:["Cyber Essentials requires a credential before anyone can use a device. It also requires protection against guessing, either throttling or locking after no more than 10 failed attempts. The ICO says it has for years considered encryption an appropriate technical measure for personal data. Intune can ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/encrypt-bitlocker-windows",children:"enforce BitLocker on Windows devices"})," and provides an encryption report across managed devices, which doubles as your evidence."]}),"\n",(0,a.jsxs)(s.p,{children:["Our ",(0,a.jsx)(s.a,{href:"/blog/intune-management-and-reporting-managed-device-service",children:"Intune management and reporting guide"})," covers what that looks like as an ongoing service."]}),"\n",(0,a.jsx)(s.h3,{id:"malware-protection-and-firewalls",children:"Malware protection and firewalls"}),"\n",(0,a.jsx)(s.p,{children:"Both are Cyber Essentials themes. Malware protection must be active and up to date on every in-scope device. On routers and firewalls, change default admin passwords and remove rules nobody can explain."}),"\n",(0,a.jsx)(s.h3,{id:"email-security",children:"Email security"}),"\n",(0,a.jsxs)(s.p,{children:["Phishing is the front door for most attacks. The NCSC's guide says ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/spotting-cyber-attacks",children:"85% of cyber attacks against businesses start with a scam email"}),"."]}),"\n",(0,a.jsxs)(s.p,{children:["Two things help. First, publish SPF, DKIM and DMARC records for every domain you send from. Microsoft describes these as ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about",children:"interdependent building blocks"})," and says anything less than all of them gives substandard protection against spoofing. Second, use the filtering your mail platform already offers. Email authentication is not among the Cyber Essentials requirements, which is exactly why it gets missed."]}),"\n",(0,a.jsx)(s.h3,{id:"joiners-movers-and-leavers",children:"Joiners, movers and leavers"}),"\n",(0,a.jsx)(s.p,{children:"Cyber Essentials expects a process to create and approve accounts. It also expects you to remove or disable accounts when they are no longer needed, and to remove special privileges when someone changes role. Write it down as a one-page checklist that HR or the office manager triggers, and keep the completed copies."}),"\n",(0,a.jsx)(s.h3,{id:"supplier-access",children:"Supplier access"}),"\n",(0,a.jsx)(s.p,{children:"Every account your organisation owns is in scope for Cyber Essentials, including those your IT provider or other suppliers use. If a provider administers your systems, you must be able to confirm the controls are met."}),"\n",(0,a.jsx)(s.p,{children:"The ICO adds that any data processor you use must also have appropriate measures. List each supplier with access, what they can reach, and how they sign in."}),"\n",(0,a.jsx)(s.h3,{id:"staff-awareness",children:"Staff awareness"}),"\n",(0,a.jsx)(s.p,{children:"Short, regular sessions on spotting phishing and reporting mistakes quickly, not an annual slideshow. The ICO says staff should understand the importance of protecting personal data and know your security policy. Record who attended."}),"\n",(0,a.jsx)(s.h2,{id:"which-compliance-obligations-apply-to-a-small-business",children:"Which compliance obligations apply to a 

1small business?"}),"\n",(0,a.jsx)(s.p,{children:"Two come up for almost every organisation of this size. Neither is legal advice: if you process special category data, work in a regulated sector, or have had an incident, take advice from a data protection specialist or solicitor."}),"\n",(0,a.jsx)(s.h3,{id:"uk-gdpr-as-the-ico-describes-it",children:"UK GDPR, as the ICO describes it"}),"\n",(0,a.jsxs)(s.ul,{children:["\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Security."}),' You must process personal data securely using "appropriate technical and organisational measures", which the ICO calls the security principle. Its ',(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/",children:"checklist"})," includes basic technical controls such as Cyber Essentials. It also covers encryption where appropriate, being able to restore access after an incident, and regular testing of your measures."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Breaches."})," Reportable personal data breaches go to the ICO ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/advice-for-small-organisations/personal-data-breaches/72-hours-how-to-respond-to-a-personal-data-breach/",children:"without undue delay and within 72 hours"}),". The clock starts when you discover the breach, not when it happened, and the ICO suggests keeping a log even if you do not end up reporting."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"The data protection fee."})," The ICO says it is ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-fee-what-you-need-to-do/",children:"the law to pay the fee unless you are exempt"}),", and provides a fee checker if you are unsure."]}),"\n"]}),"\n",(0,a.jsx)(s.p,{children:"The ICO notes that some of this guidance is under review following the Data (Use and Access) Act, so check the live pages rather than a copy saved last year."}),"\n",(0,a.jsx)(s.h3,{id:"cyber-essentials-and-what-it-does-and-does-not-prove",children:"Cyber Essentials, and what it does and does not prove"}),"\n",(0,a.jsxs)(s.p,{children:["The NCSC describes Cyber Essentials as the minimum standard of cyber security the Government recommends, aimed at the most common internet-based threats. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Our ",(0,a.jsx)(s.a,{href:"/resources/cyber-essentials-checklist",children:"Cyber Essentials checklist"})," walks through each one."]}),"\n",(0,a.jsxs)(s.table,{children:[(0,a.jsx)(s.thead,{children:(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.th,{children:"It does show"}),(0,a.jsx)(s.th,{children:"It does not show"})]})}),(0,a.jsxs)(s.tbody,{children:[(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"The five technical controls were in place on the date the certificate was issued"}),(0,a.jsx)(s.td,{children:"That they are still in place today; IASME defines the point in time as the issue date"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"A board member signed a declaration that the answers are true"}),(0,a.jsxs)(s.td,{children:["That anyone tested your systems, at the basic level, which ",(0,a.jsx)(s.a,{href:"https://iasme.co.uk/cyber-essentials/frequently-asked-questions/",children:"IASME says"})," includes no test or scan"]})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Independent technical testing of a sample of devices, for Cyber Essentials Plus"}),(0,a.jsx)(s.td,{children:"That backups, email authentication or staff training are in place, none of which are scheme requirements"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"A defined scope"}),(0,a.jsx)(s.td,{children:"That the scope covers the whole business, so read the scope description"})]})]})]}),"\n",(0,a.jsxs)(s.p,{children:["Certificates ",(0,a.jsx)(s.a,{href:"https://iasme.co.uk/cyber-essentials/frequently-asked-questions/",children:"expire after 12 months"}),". The ICO is clear that the scheme is only intended to provide a base set of controls, and that you may 

1need to go further depending on what you process."]}),"\n",(0,a.jsx)(s.h2,{id:"how-do-you-show-your-security-posture-to-clients-insurers-and-auditors",children:"How do you show your security posture to clients, insurers and auditors?"}),"\n",(0,a.jsx)(s.p,{children:"Questionnaires ask the same things in different words. The answers that satisfy them are records, not reassurance."}),"\n",(0,a.jsxs)(s.table,{children:[(0,a.jsx)(s.thead,{children:(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.th,{children:"They ask"}),(0,a.jsx)(s.th,{children:"Evidence that satisfies"})]})}),(0,a.jsxs)(s.tbody,{children:[(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Do you enforce MFA?"}),(0,a.jsx)(s.td,{children:"MFA registration report, plus the security defaults or Conditional Access settings"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Are devices patched and encrypted?"}),(0,a.jsx)(s.td,{children:"Device management compliance and encryption reports, dated"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Who has admin rights?"}),(0,a.jsx)(s.td,{children:"Current list of admin role holders, each with a separate admin account"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Can you recover from ransomware?"}),(0,a.jsx)(s.td,{children:"Date and result of your last test restore"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"How do you handle leavers?"}),(0,a.jsx)(s.td,{children:"The leaver checklist and two or three completed examples"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Do suppliers have access?"}),(0,a.jsx)(s.td,{children:"Supplier access register with sign-in method and review date"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Are you certified?"}),(0,a.jsx)(s.td,{children:"Cyber Essentials certificate number, expiry date and scope description"})]}),(0,a.jsxs)(s.tr,{children:[(0,a.jsx)(s.td,{children:"Have staff been trained?"}),(0,a.jsx)(s.td,{children:"Attendance record from the last awareness session"})]})]})]}),"\n",(0,a.jsxs)(s.p,{children:["Keep these in one folder and refresh them quarterly. Our ",(0,a.jsx)(s.a,{href:"/blog/quarterly-tenant-health-check",children:"30-minute quarterly tenant health check"})," is a good rhythm for it, and our ",(0,a.jsx)(s.a,{href:"/services/compliance-packs",children:"compliance packs"})," turn the policies and evidence into a set you can hand over."]}),"\n",(0,a.jsx)(s.h2,{id:"what-are-the-most-common-mistakes",children:"What are the most common mistakes?"}),"\n",(0,a.jsxs)(s.ul,{children:["\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"MFA on most accounts."})," The shared mailbox, the old admin account and the finance system nobody thought of are where it is missing."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Daily work on an admin account."})," One malicious attachment then runs with full rights."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Treating the certificate as the finish line."})," It is a snapshot on one date; the declaration commits you to keeping the controls in place all year."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Backups that have never been restored."})," Or backups connected to the systems ransomware would encrypt."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"Templates nobody follows."})," A policy that does not match what people do is worse than none in an audit."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"No supplier list."})," The provider with standing admin access is part of your attack surface."]}),"\n",(0,a.jsxs)(s.li,{children:[(0,a.jsx)(s.strong,{children:"One person holding everything."})," Passwords, registrar logins and recovery codes in one head is a continuity risk as well as a security one."]}),"\n"]}),"\n",(0,a.jsx)(s.h2,{id:"where-to-start",children:"Where to start"}),"\n",(0,a.jsxs)(s.p,{children:["If you have a named owner and nothing else, the 30-day list is your plan. For a business without an internal IT function, this is the core of what our ",(0,a.jsx)(s.a,{href:"/it-support-small-business",children:"small business IT support"})," and ",(0,a.jsx)(s.a,{href:"/services/security",children:"security services"})," provide. If certification is the goal, our ",(0,a.jsx)(s.a,{href:"/services/cyber-essentials",children:"Cyber Essentials service"})," takes you through it."]}),"\n",(0,a.jsxs)(s.p,{children:["The quickest way to know where you stand is a ",(0,a.jsx)(s.a,{href:"/book/security-posture",children:"free security posture review"}),". We check your Microsoft 365 and identity setup against the controls above and tell you which gaps to close first."]}),"\n",(0,a.jsxs)(s.p,{children:["Sources, checked 2 October 2026: ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/collection/small-business-guide",children:"NCSC small organisations guide"}),", ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/cyberessentials/overview",children:"NCSC Cyber Essentials overview"}),", ",(0,a.jsx)(s.a,{href:"https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastru

1cture-v3-3.pdf",children:"Cyber Essentials requirements v3.3"}),", ",(0,a.jsx)(s.a,{href:"https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/",children:"IASME April 2026 changes"}),", ",(0,a.jsx)(s.a,{href:"https://iasme.co.uk/cyber-essentials/frequently-asked-questions/",children:"IASME Cyber Essentials FAQ"}),", ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/",children:"ICO guide to data security"}),", ",(0,a.jsx)(s.a,{href:"https://ico.org.uk/for-organisations/advice-for-small-organisations/personal-data-breaches/72-hours-how-to-respond-to-a-personal-data-breach/",children:"ICO 72-hour breach guide"}),", ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults",children:"Microsoft Entra security defaults"}),", ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/encrypt-bitlocker-windows",children:"Intune BitLocker encryption"})," and ",(0,a.jsx)(s.a,{href:"https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about",children:"Microsoft 365 email authentication"}),"."]})]})}function u(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};return(0,a.jsx)(l,{...e,children:(0,a.jsx)(h,{...e})})}}},function(e){e.O(0,[9707,2728,738,3796,7829,9396,8077,6379,9774,2888,179],function(){return e(e.s=97013)}),_N_E=e.O()}]);