For SME owners and leadership teams
A plain-English reference on the technology, security and supplier decisions SME owners face.
Free. No sign-up. Written for the person paying the bills, not the person fixing the servers. Risks, scenarios, policy starters, an OWASP-based guide to website security, a glossary, and more.
Four ways to find what you need
25 topics
Topics
The patterns that matter in an SME — backups, suppliers, AI, customer trust, phishing, mobile, patching. Most businesses need to look at 3–5 of the 25, not all of them.
10 playbooks
Scenarios
Step-by-step playbooks: phishing clicked, ransomware day, leaver access, customer questionnaire, choosing MSP.
15 starters
Policies & starters
Ready-made information security, acceptable use, password, AI, BYOD, remote-working, data retention, incident response policies. Edit and use.
Top 10 questions
Website security
If you have a website or customer portal: ten questions to put to your developer, based on the recognised OWASP standard.
A few popular starting points
Some pages people tend to read first.
If you want the destination
What good looks like
A short description of a well-set-up SME. Not a checklist.
If you want a sequence
Budget priorities
What to do for £0, £1k, £3k, £10k or £30k a year. Sequenced.
If a technical report has landed
Translation
16 worked examples: what a technician says → what it means.
A customer is asking
Responding to a security questionnaire
90-minute playbook with templated answers.
The single biggest gap
Are your backups real?
The thing most SMEs assume is working that isn't.
If you have an IT team
Decide, delegate, escalate
What an owner decides personally vs delegates to IT vs escalates to the board.
Reference library
The rest of the site.
80+ terms
Glossary
Jargon-buster, deep-linkable.
For your team
Flashcards
Hand to your IT manager or use in team meetings. Printable PDF too.
Who's asking?
Stakeholder questions
Customer, insurer, board, M&A, regulator — how to answer well.
UK ranges
Typical costs
What M365 Premium, EDR, Cyber Essentials, MSPs actually cost.
12 answers
FAQ
Do we need a CISO? Is Cyber Essentials enough?
Curated
Resources
NCSC, ICO, OWASP, IASME, free tools.
A free reference site by Andrew Rea & Associates. Need a person? →