NCSC: Small & Medium Organisations hub ↗
Plain-English advice from the UK's National Cyber Security Centre.
https://www.ncsc.gov.uk/section/information-for/small-medium-sized-organisations
Resources
Links worth keeping.
A curated list of UK SME cyber and IT guidance. All free. No affiliate links.
Government & official guidance
NCSC: Cyber Essentials overview ↗
The UK government's baseline cyber standard.
https://www.ncsc.gov.uk/cyberessentials/overview
NCSC: Cyber Aware ↗
Six basic actions for individuals and small businesses.
https://www.ncsc.gov.uk/cyberaware
NCSC: 10 Steps to Cyber Security ↗
The full framework.
https://www.ncsc.gov.uk/collection/10-steps
NCSC: report a phishing email ↗
Forward suspicious emails to report@phishing.gov.uk.
https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email
NCSC: Exercise in a Box ↗
Free table-top exercises.
https://www.ncsc.gov.uk/information/exercise-in-a-box
NCSC: Logging Made Easy ↗
Free, open-source logging stack.
https://www.ncsc.gov.uk/information/logging-made-easy
NCSC: Mobile device guidance ↗
Advice on phones and tablets at work.
https://www.ncsc.gov.uk/collection/mobile-device-guidance
ICO: Guide to Data Protection ↗
The UK regulator's plain-English GDPR guide.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
ICO: report a personal data breach ↗
Where to notify the regulator (72-hour clock).
https://ico.org.uk/for-organisations/report-a-breach/
ICO: SME web hub ↗
Plain-English data protection for small businesses.
https://ico.org.uk/for-organisations/sme-web-hub/
Action Fraud ↗
Where to report cyber crime in the UK. 0300 123 2040.
https://www.actionfraud.police.uk/
OFSI: financial sanctions list ↗
UK sanctioned entities list. Pay close attention if considering ransom — payments to listed entities are a strict-liability criminal offence.
https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
UK government: AI regulation ↗
Current UK approach to AI regulation. Worth bookmarking for any SME using or selling AI tools.
https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach
Self-assessment
IASME Cyber Essentials self-assessment ↗
Read the questionnaire free.
https://iasme.co.uk/cyber-essentials/
NCSC: Cyber Action Plan ↗
Free online tool. Twelve questions; produces a personalised action plan.
https://www.ncsc.gov.uk/cyberaware/actionplan
Microsoft Secure Score ↗
Benchmarks your M365 tenant against best practice.
https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score
ICO self-assessment toolkit ↗
Short questionnaires that highlight data-protection gaps.
https://ico.org.uk/for-organisations/sme-web-hub/checklists/
Free tools
Have I Been Pwned ↗
Type an email address. See if it's in a known breach.
https://haveibeenpwned.com
Security Headers ↗
Free website security header check.
https://securityheaders.com
SSL Labs SSL Test ↗
Tests your website's TLS configuration.
https://www.ssllabs.com/ssltest/
UptimeRobot ↗
Free uptime monitoring.
https://uptimerobot.com
MXToolbox SPF / DKIM / DMARC checker ↗
Tests your domain's email authentication.
https://mxtoolbox.com/dmarc.aspx
NCSC Mail Check ↗
Free email security check.
https://www.mailcheck.service.ncsc.gov.uk
OWASP ZAP ↗
Free automated security scanner for websites.
https://www.zaproxy.org/
Standards & certification
IASME ↗
Certification body for Cyber Essentials.
https://iasme.co.uk
BSI: ISO 27001 ↗
Information-security management standard.
https://www.bsigroup.com/en-GB/iso-27001-information-security/
CIS Controls v8 ↗
Free prioritised list of cyber controls.
https://www.cisecurity.org/controls
OWASP: Top 10 (2021) ↗
The original web-application security risk list.
https://owasp.org/Top10/
OWASP: ASVS ↗
What to ask developers and pen-testers to check.
https://owasp.org/www-project-application-security-verification-standard/
PCI DSS official ↗
Required if you take card payments — usually handled by your payment processor, but check.
https://www.pcisecuritystandards.org/