When you're being asked a question
For most established SMEs, the trigger to think hard about cyber isn't a fear of what could go wrong — it's a question from outside. A customer wants evidence. An insurer wants a form filled in. The board wants a quarterly view. M&A is on the horizon. Pick the one that fits and you'll find the right page, in the right order, with a credible answer.
Customer
Likely from a larger or public-sector buyer. They want a credible evidence pack, not perfection.
Where to start
Insurer
Premiums depend on what you have in place. Five or six controls answer most of the application questionnaire.
Where to start
Board
They don't want a technical report. They want trends, named owners, decisions to make.
Where to start
M&A / investor
IT and data are usually the costliest unknowns in a deal. Clean answers compress diligence and protect valuation.
Where to start
Procurement
Public-sector buyers and many larger commercial customers now require it. Achievable in 4–8 weeks.
Where to start
Regulator
Usually triggered by a breach, a subject access request, or a complaint. The 72-hour clock starts when you become aware.
Where to start
Staff & candidates
Increasingly common at interview and at induction. Show them a staff privacy notice and the basics.
Where to start
Auditor
Annual financial audit, SOC2 prep, or ISO 27001 stage 1. They want documentation, tested controls, and walk-throughs.
Where to start
A pattern that helps
Most stakeholder questions overlap. The same evidence answers a customer questionnaire, an insurer's renewal form, a board update, a procurement check, and most of an M&A IT data room. Build the pack once — signed policies, an incident response plan, a data map, a tools register, MFA / backup / training evidence — and your answer time drops from a week to an afternoon.
See Policies & starters for the building blocks, or Your role for who in the business owns each.