Getting this right
from the start
costs far less.

You must be registered with the ICO, hold only the data you need, protect it with appropriate security, and be able to notify the ICO within 72 hours of a breach. There is no small business exemption.

• Encryption of personal data at rest and in transit
• Access controls limiting who can reach client and staff records
• A documented process for responding to a breach — including who to notify and when
• ICO registration current and accurate

• All UK government contracts involving personal data require Cyber Essentials as a minimum
• Supplier questionnaires from larger private sector clients increasingly ask for the certificate number
• Several cyber insurers require it at renewal — or apply exclusions without it
• It demonstrates to investors and acquirers that your infrastructure is not a liability

• MFA enforced on all email, remote access, and cloud accounts — universally, not selectively
• Immutable backups tested and isolated from the primary network
• Patch currency — all systems within the 14-day critical patch window at the time of the incident
• Endpoint protection active and monitored on all devices accessing business data

The ICO can pursue individuals — not just the company — where a breach results from failure to take reasonable precautions. In small businesses, the director is usually the person who made the IT decisions. If you chose not to implement basic security and a breach occurs, that decision is yours personally.

• A documented assessment of your data protection risks
• Evidence that basic security controls were implemented and maintained
• Staff awareness of data handling responsibilities
• A record of the decisions you made about your IT and security arrangements

• Cyber Essentials certificate number and expiry date
• Description of your backup and recovery process
• Confirmation that MFA is enforced on all relevant systems
• Your process for responding to a personal data breach
• Your ICO registration number

The question is not whether you have a backup. Almost everyone has something running. The question is: if everything was wiped tonight, could you be operational by Monday? Most small businesses, when they answer honestly, say no.

• A backup covering all business data — including email, cloud files, and locally stored documents
• The backup is isolated — ransomware cannot reach it from your main network
• Recovery has been tested — you know how long it takes because you have done it
• A basic written plan for who does what during an outage

A director on £75,000 has an effective hourly cost — with employment overhead — of around £52/hour. One hour per day of IT friction costs approximately £8,700 per year in direct salary waste alone. The opportunity cost — what that hour would have generated in client work, decisions, or revenue — is typically 2–3× higher for senior or revenue-generating roles.

• Waiting for systems that are slow, unpatched, or poorly configured
• Troubleshooting access issues, password resets, and device problems
• Managing a supplier relationship that should be managed by someone else
• Chasing unresolved issues that a properly managed infrastructure would prevent

• Employment load: Employer NI, pension contributions, and office overhead typically add 30% to the gross salary — £65,000 per year at the 1.3× multiplier
• Tools and software: Endpoint protection, monitoring, backup subscriptions, and licensing — commonly £100–£200/month on top
• Efficiency gap: Industry data consistently shows internal IT staff spend 60–80% of their time reactively. You are paying for a full-time resource but getting 20–40% in proactive value
• Coverage gap: 27 days per year of zero IT cover — holiday entitlement plus average sick leave. No managed service has this gap

• MFA enforced on every account — not most accounts, every account — with logs to prove it
• Patch currency maintained within 14 days of a critical update, with a documented record
• Backups tested and isolated from the primary network — tested meaning a recovery was actually performed
• An asset register showing every device that connects to business systems, its status, and its owner

A skilled IT person can implement these controls. But without a managed framework that documents, tests, and produces audit-ready evidence on demand, there is still no proof. The insurer's forensic auditor does not ask "do you have an IT person?" — they ask "can you evidence that MFA was enforced on all accounts at the time of the incident?"