Do we really need a CISO?
Almost certainly not, for a typical SME. A “virtual CISO” (fractional — a few hours a month) is plenty for most businesses under ~100 staff.
FAQ
The questions every owner asks.
Is Cyber Essentials enough?
It's a sensible floor — not a ceiling. Achievable, defensible, and increasingly required. But it doesn't address backup testing, incident response, AI use, supplier security, or training.
How often should we change passwords?
Less often than people think, if you have MFA. NCSC moved away from forced rotation. Current advice: long passwords, unique per account, password manager, MFA on top.
Should we ban USB sticks?
Most SMEs should at least restrict them. Disable unknown USB mass-storage; allow through an approval process.
BYOD or company devices?
Company devices are easier to secure. If you do BYOD, you must have MDM and a clear policy. Many SMEs end up with company laptops, BYOD phones with MDM.
Is our antivirus enough?
Probably not on its own. Modern threats bypass signature-based antivirus. The current category is EDR. Microsoft Defender for Business (bundled with M365 Business Premium) is good enough for most SMEs.
Can we just back up to OneDrive / SharePoint?
No. They sync files; they don't back them up. If ransomware encrypts the originals, the encrypted versions sync to the cloud. Use a dedicated 3-2-1 backup tool that covers M365.
Should we let staff use personal Gmail or Dropbox for work?
No. Creates data-protection, security, and continuity problems.
Is cyber insurance worth it for a £2m turnover business?
For most businesses at that scale, yes — with caveats. The biggest value is usually the incident-response retainer bundled in.
When does a 5-person business need a ‘real’ IT person?
Almost never as an employee. What you need is: someone in the business who owns IT decisions and a reliable MSP for execution.
What's the difference between Microsoft 365 Business Standard, Premium, and Enterprise?
Business Standard is the core productivity suite. Business Premium adds the security tooling almost every SME should have. Enterprise tiers are for >300 users or specific compliance needs.
Is two-factor by text message OK?
Better than nothing, much worse than an authenticator app. SMS is vulnerable to SIM-swap attacks.