Cyber Essentials preparation is easier when it is treated as a structured improvement project rather than a last-minute questionnaire. The scheme focuses attention on five practical control areas that reduce exposure to common internet-based attacks. For a small business, the most useful first step is to define the assessment scope and establish an accurate inventory.

Know what is in scope

Document internet-connected devices, cloud services, user accounts, home workers, routers and firewalls. Include Windows PCs, Macs, smartphones, tablets, servers and supported virtual infrastructure. Unknown devices and forgotten administrator accounts are common reasons for uncertainty during preparation.

Decide whether the whole organisation will be assessed and make sure any proposed boundary is defensible. The goal is not to hide difficult systems; it is to understand risk and apply the required controls consistently.

Work through the five control themes

• Firewalls and internet gateways: remove unnecessary services, review rules and change default credentials.
• Secure configuration: disable unused accounts and features, use supported software and apply sensible device settings.
• User access control: give people only the access they need, protect administrator accounts and use multi-factor authentication where required.
• Malware protection: use appropriate security controls and restrict untrusted software.
• Security updates: install high-risk updates within the required timescale and replace software that no longer receives fixes.

Gather evidence as you improve

Keep screenshots, configuration exports, asset lists and policy decisions in one place. Record how mobile devices and home networks are handled, how joiners and leavers are processed and who owns each action. Evidence makes the assessment more efficient and leaves the business with reusable operational documentation.

Do not confuse certification with permanent security. Controls can drift as users, devices and software change. MSP247’s all-platform RMM coverage helps monitor supported environments, raise alerts and maintain patch visibility after the initial preparation work.

Avoid overclaiming

Certification is a valuable baseline, not a guarantee that an organisation cannot be breached. It should sit alongside backups, phishing awareness, incident planning, supplier review and appropriate cyber insurance. Where questions touch legal or insurance obligations, take advice from the relevant professional.

Prepare with a clear action list

Our free business IT review can identify unsupported equipment, account weaknesses, backup gaps and device-management issues before you begin a formal Cyber Essentials submission. MSP247 can then help implement and document proportionate improvements across your Yorkshire business.

The UK government launched its Cyber Governance Code of Practice on 8 April 2025. It is aimed primarily at boards and directors because cyber security is not only a technical issue: an incident can stop operations, damage customer trust and create serious financial exposure.

The Code was designed for medium and large organisations, but its principles scale well to an SME. A small leadership team can apply them without creating a heavy governance process.

Give cyber risk a named owner

Someone at leadership level should own cyber risk and make sure it is considered alongside financial, operational and legal risks. Your IT provider can advise and operate controls, but the business must decide its priorities, acceptable risk and recovery expectations.

Know which services matter most

Identify the technology, information and suppliers that support essential activities such as taking orders, accessing customer records, paying staff and communicating with clients. Agree how long each activity can be unavailable and how much data loss the business could tolerate.

Ask for useful reporting

A long list of technical alerts is not board assurance. Leadership reporting should show trends and exceptions, including:

• unsupported devices and overdue critical updates;
• multi-factor authentication and endpoint-protection coverage;
• backup success and restore-test results;
• high-risk suppliers and outstanding remediation;
• security incidents, lessons learned and repeat problems;
• staff training completion and phishing-reporting behaviour.

Review the measures regularly and set clear tolerances. A red status should lead to an owner, action and deadline.

Include suppliers and cloud services

Most SMEs rely on external platforms and support partners. Record which suppliers can access sensitive data or administer systems, then confirm their security commitments, access controls, incident-notification process and exit arrangements. Remove third-party accounts when they are no longer required.

Practise the response

An incident plan is valuable only if people know how to use it. Run a short tabletop exercise based on a realistic scenario such as ransomware, a compromised mailbox or loss of the main internet connection. Include leadership, IT, communications and any critical suppliers. Record decisions and improve the plan after the exercise.

A quarterly leadership checklist

1. Have our critical services or suppliers changed?
2. Are our highest risks reducing at the agreed pace?
3. Can we recover essential data and operations within our target time?
4. Are serious incidents and near misses producing measurable improvements?
5. Do we have a funded plan for unsupported technology and known gaps?

MSP247 can translate technical evidence into a practical improvement plan and clear management reporting. Our IT consultancy, managed support and connectivity services cover the whole operating environment. Contact us to arrange a cyber governance review.

Version 3.2 of the Cyber Essentials requirements, known as Willow, took effect on 28 April 2025. It keeps the familiar five technical controls but updates the wording to reflect passwordless sign-in, remote work and the different ways vendors now fix security vulnerabilities.

The official NCSC Cyber Essentials resources remain the definitive reference. The practical message for SMEs is that security management must cover the complete working environment, not only computers inside the office.

The five controls have not changed

Cyber Essentials still focuses on firewalls, secure configuration, security update management, user access control and malware protection. These controls block many common attacks when they are implemented consistently across devices, cloud services and users.

What Willow added or clarified

Passwordless authentication

The guidance now explicitly recognises passwordless methods such as biometrics, physical security keys, one-time codes and push approvals. Passwordless does not mean authentication-free: the method must still provide strong assurance and be managed throughout the user lifecycle.

Vulnerability fixes are broader than patches

A vendor may fix a serious vulnerability with a configuration change, script, registry adjustment or another approved mechanism rather than a conventional software update. Willow makes it clear that these fixes are part of security update management. High-risk fixes still need prompt action, normally within the scheme’s 14-day window.

Software has a wider meaning

Operating systems and desktop applications are only part of the picture. Browser extensions, scripts, libraries, network software and router or firewall firmware can all be in scope. An accurate asset and software inventory is therefore essential.

Remote working is normal working

The updated terminology reflects hybrid organisations. Corporate and bring-your-own devices that access business data are generally in scope, wherever they are used. If the organisation does not control the network, the endpoint needs its own correctly configured firewall and appropriate security controls.

Prepare before starting the assessment

1. Confirm the scope, including cloud services, mobile devices and remote workers.
2. Remove unsupported software and record vendor support dates.
3. Verify that critical vulnerability fixes are applied within policy.
4. Review administrator accounts, third-party access and multi-factor authentication.
5. Check firewall rules and remove services that no longer have a business purpose.
6. Collect evidence as you work rather than immediately before submission.

Cyber Essentials is not a one-off tidy-up. The strongest approach is to make its controls part of normal managed IT operations.

MSP247 can assess your environment, close technical gaps and help maintain the controls across Windows, macOS, mobile devices, cloud services and networks. Explore our managed IT support or contact us to discuss Cyber Essentials readiness.

Microsoft 365 provides resilient cloud services, but resilience is not the same as a complete business backup strategy. Retention, recycle bins, version history and independent backup all solve different problems. The gap becomes obvious only when someone needs an older file, a departed user’s mailbox or a clean copy from before an incident.

What Microsoft 365 retention does

Retention policies help an organisation keep or delete content according to business and compliance rules. They can protect messages and files from ordinary deletion for a defined period, and they are valuable for records management. However, policy design can be complex and coverage varies by workload, licence and configuration.

Recycle bins and version history are helpful operational features, but they have limits. They may not meet a long recovery window, provide simple cross-user restore or preserve every item in the way the business assumes. Retention is principally about governance; backup is principally about recoverability.

Why an independent backup can matter

A separate backup creates another recovery copy outside the normal day-to-day user workflow. It can reduce dependence on a single administrator account or configuration and give the helpdesk a clearer restore process for mailboxes, OneDrive, SharePoint and collaboration data.

• Accidental or malicious deletion discovered late
• Ransomware or mass file corruption
• A user account removed before data was preserved
• Retention settings changed incorrectly
• A need to restore selected items quickly without disrupting current data

Questions to ask about your current protection

Start with outcomes, not product names. Which services are protected? How often is data copied? How long is it retained? Can individual emails, folders, sites and permissions be restored? Who receives failure alerts? Most importantly, when was a real restore last tested?

Backups that are never checked can create false confidence. Recovery tests should use representative data, record the time taken and confirm that the recovered information is usable. The result then feeds into your wider business continuity plan.

Retention and backup should work together

A sensible design often uses both: retention to meet governance requirements and an independent backup to provide operational recovery. The settings should reflect contractual duties, legal advice and how long the business can tolerate data loss. MSP247 can review this alongside identity security, device protection and continuity rather than treating it as an isolated product.

Find the gaps before a recovery is urgent

MSP247’s free business IT review includes Microsoft 365 security, backup and recovery arrangements, unsupported equipment, connectivity resilience and current supplier gaps. We can document what is protected today and recommend proportionate improvements for your Yorkshire business.