Clear checks for Microsoft 365, Google Workspace, Cyber Essentials, backups and common business fraud.
2 November 2026
This guide sets out what a UK manager should do in the first 60 minutes after ransomware is suspected. It covers safe containment without powering machines off, preserving evidence, contacting your insurer and cyber incident helpline, and notifying Action Fraud, the NCSC and the ICO where required.
31 October 2026
Some businesses run a line-of-business application that only works on an old Windows computer. Once Microsoft stops issuing security updates, that machine is an unsupported device. This guide covers how to isolate it, restrict who and what can reach it, record a replacement date and understand why compensating controls reduce risk without making the device compliant for Cyber Essentials.
31 October 2026
A lost or stolen laptop is a routine event for a business with 5 to 50 staff, and encryption decides whether it is a replacement cost or a personal data breach. This guide covers how to confirm BitLocker on Windows and FileVault on Mac, where to keep recovery keys, how to prove it to an insurer or assessor, and what to do when someone leaves.
29 October 2026
A backup that has never been restored is an assumption, not a control. This guide sets out a monthly spot check and a quarterly full restore for a business of 5 to 50 staff, with the named evidence to keep so a manager, assessor or insurer can see the routine is real.
28 October 2026
OneDrive and Google Drive keep files available across devices, but sync, recycle bins and version history do not amount to an independent backup. This guide explains how deletions spread, where retention runs out, what a compromised administrator account can destroy, and how to build a protected copy you have actually tested.
27 October 2026
The 3-2-1-1-0 model means three copies of your data, on two types of storage, one copy off-site, one copy offline or immutable, and zero errors proven by a restore test. It is a practical model rather than a UK regulatory requirement, but it matches NCSC advice on isolated backups and regular restore testing. This guide shows how to build it for a business with 5 to 50 staff and how to run a quarterly restore test.
26 October 2026
Cloud platforms keep their own services running, but that does not give every business an independent copy of deleted, encrypted or maliciously altered files.
25 October 2026
Staff in a small business rarely need administrator rights for daily work, but removing them overnight causes blocked installs and angry messages. This guide sets out a staged route for Windows and macOS: find out who has admin rights and why, pilot with a few people, move administration to a separate support account, and set up a quick exception process so work continues while risk falls.
25 October 2026
Cyber Essentials expects every in-scope device to sit behind a correctly configured firewall, whether that is a router in the office or the software firewall on a home worker's laptop. This guide explains where the line falls for home routers, what a compliant configuration looks like, and which records an assessor is likely to ask for.
23 October 2026
Cyber Essentials requires in-scope software to be updated within 14 days of release when the fix is rated critical or high risk, scores CVSS v3 7 or above, or has no published severity. This guide explains which updates qualify, what falls outside the rule, and the records that show an assessor when each patch was released and installed.
22 October 2026
Enforcing 2-Step Verification in Google Workspace is done from the Admin console under Security, Authentication. This guide covers the admin path, choosing an organisational unit or group, staging the rollout so staff can enrol, protecting administrator accounts first, and handling recovery codes and lost devices before enforcement begins.
21 October 2026
Two critical flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, named PHP2Shell) permit unauthenticated remote code execution across servers running PHP. This emergency guide sets out affected versions, discovery commands, vendor update steps and immediate containment measures for UK organisations.
21 October 2026
For most businesses with 5 to 50 staff, the quickest route to MFA for every Microsoft 365 user is Security Defaults in the Microsoft Entra admin centre. This guide gives the admin path, the checks to run before enabling it, when Conditional Access is the better fit, and the accounts that deserve extra attention.
20 October 2026
Cyber Essentials sets rules for password quality and brute-force protection, not a single fixed length. This guide sets out the current wording, how to separate accounts, where a password manager fits, and what to configure for lockout so a small UK business can write a policy that passes assessment and works for staff.
20 October 2026
Most failed assessments start with ordinary settings that nobody has checked: old software, excessive administrator access, weak sign-in controls, exposed routers and incomplete malware protection.
