How healthy is your Cyber Security?

You can’t protect everything in the same way. Start by understanding what matters most to your business, your data, systems, devices, applications and people. And where potential vulnerabilities exist.

Ask yourself:

• Do we know our most critical systems and data?
• Do we understand our biggest cyber risks?
• When did we last review them?

Our approach: Every business has different risks. Your systems, data, devices, suppliers and the way your people work can all create potential vulnerabilities. Understanding what matters most and where you’re most exposed gives you a much better starting point for protecting the business.

Having security measures in place is important. Knowing what happens when they fail is equally important. Who makes the decisions? Who needs to be contacted? How would you contain an attack? Can systems and data be recovered?

And crucially, has the plan actually been tested?

• Do we have a response plan?
• Does everyone know their role?
• Can we recover our systems and data?
• Have we tested the plan?

Our approach: Even with strong security in place, no organisation can assume an incident will never happen. Having a clear response plan means knowing who does what, how an incident will be contained and how you’ll get the business back up and running.

Technology can only go so far. Phishing, weak passwords, accidental data sharing and other human factors can introduce risk into even well-protected organisations.

The objective isn’t to make employees afraid of making mistakes. It’s to give them the knowledge and processes to recognise potential threats and respond appropriately.

• Do our people receive cyber training?
• Are we using MFA?
• Is access properly controlled?
• Do people know how to report a threat?

Our approach: Your people interact with email, systems, data and applications every day, making them an important part of your Cyber Security. Regular awareness, sensible access controls and a clear way to report something suspicious can all help reduce human-related risk.

Cyber Security doesn’t always have to start with complicated technology. Good foundations can make a significant difference. This is also where frameworks such as Cyber Essentials can provide businesses with a useful starting point.

Consider areas including:

• Are our systems securely configured?
• Are updates applied regularly?
• Are our firewalls properly managed?
• Is user access controlled?
• Do we have malware protection?

Our approach: It’s easy to focus on the latest cyber threats and security technology, but strong foundations still matter. Keeping systems updated, controlling access, configuring devices correctly and protecting against malware can help close some of the most common routes into a business.

Protection is only one side of cyber resilience. If systems became unavailable tomorrow, how quickly could your business get back to work? Think about backups, recovery procedures, business continuity and how dependent the organisation is on particular systems or suppliers.

• Is our critical data backed up?
• Do we test our backups?
• Do we have a recovery plan?
• Do we understand the impact of downtime?

Our approach: Cyber Security isn’t only about preventing an attack. It’s also about what happens afterwards. If important systems or data suddenly became unavailable, your ability to recover quickly could make a significant difference to the disruption and cost experienced by the business.