Support

Cyber Security FAQs for UK Small Businesses

The questions we get asked most often, answered directly. If yours is not here, call +44 7424 967568 and ask.

Book a Free Consultation → Call +44 7424 967568
TOPICS
Assessment, Certification, GDPR, IT
AUDIENCE
UK Small Business Owners
STYLE
Plain English, No Sales Pitch
ASK US
support@cipherknights.com
In short

What is the single most effective cyber security control for a small business?

Multi-factor authentication on email and remote access, with legacy authentication protocols blocked so it cannot be bypassed. It prevents the large majority of account compromises, is included in most licences you already pay for, and can usually be rolled out in a week.

Start here if you are not sure what you need

If nobody has ever assessed your security, start with a vulnerability assessment. It is the cheapest way to replace guesswork with facts, and it tells you which of everything else on this site is actually relevant to you.

If a customer has sent you a security questionnaire or a contract requires it, start with Cyber Essentials — it answers most questionnaires in one document. If something has already gone wrong, call us rather than reading further.

What you receive

Included in every engagement

Fixed scope, agreed in writing before we start. If the scope changes, we stop and re-quote rather than invoicing the difference.

01
Answers about assessment, testing and what the difference actually is
02
Answers about Cyber Essentials, ISO 27001 and which you need
03
Answers about UK GDPR duties and breach reporting
04
Answers about IT support, cost and how engagements run
Frequently asked questions

Frequently Asked Questions — your questions answered

What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and prioritises known weaknesses across everything in scope. A penetration test goes deeper on a narrower target, with a tester actively exploiting weaknesses to prove real impact. Most small businesses should do the assessment first.
Does my small business really need cyber security?
Attacks are overwhelmingly automated and untargeted — they find exposed systems, not famous companies. Small businesses are hit constantly, and are less likely to survive the disruption. The baseline controls are not expensive; not having them is.
Do we need Cyber Essentials?
You need it if a contract requires it — common for UK central government work and increasingly for corporate supply chains — or if your insurer asks. Even where it is not required, it is a sensible baseline and often replaces bespoke customer security questionnaires.
How much does cyber security cost for a small business?
Our assessment and project work is quoted as a fixed price after a free scoping call, and support is a fixed monthly fee per user. Cost is driven by user and device count, sites, and how many internet-facing systems you run.
What should we do first if we think we have been hacked?
Disconnect affected devices from the network without powering them off, reset passwords and revoke sessions, stop pending payments, and preserve logs rather than rebuilding. Then call +44 7424 967568.
Do we have to report a data breach to the ICO?
Within 72 hours of becoming aware, if the breach involves personal data and poses a risk to the individuals affected. Even where it is not reportable, you must record it internally along with the reasoning.
Can you work with our existing IT provider?
Yes, and we frequently do. Security assessment and IT support are different disciplines, and having them separate is generally preferred by auditors. We write findings so your provider can act on them directly.
How often should we reassess our security?
A full assessment at least annually, and after any significant change such as an office move, a migration or a new internet-facing application. Quarterly is the practical standard for businesses handling health, financial or payment data.
Is Microsoft 365 data backed up automatically?
Not in the way most businesses assume. Microsoft provides limited retention and recycle-bin recovery, and its service agreement places responsibility for backup on the customer. A separate third-party backup is needed.
Do you work outside Leicester?
Yes. On-site work covers Leicestershire, Nottingham, Derby, Coventry, Birmingham and Northampton. Assessment, cloud and compliance work is delivered remotely across the UK.

Question not answered here? Call +44 7424 967568 or email support@cipherknights.com.

Related

You might also need

Services
Cyber Security Services
Most UK small businesses need four things: a vulnerability assessment to find what is exposed, Cyber Essentials to prove a baseline to customers and insurers, hardened networks and cloud accounts, and a tested plan for when something goes wrong. Cipher Knights delivers all four from Leicester, priced for SMEs.
 Compliance
Cyber Essentials
Cyber Essentials is a UK government-backed certification scheme, delivered by IASME on behalf of the NCSC, that verifies an organisation has five fundamental technical controls in place: boundary firewalls, secure configuration, security update management, user access control and malware protection. Certification is renewed annually.
 Get Started
Book a Free Consultation
A 30 to 60 minute conversation about what your business runs, what data it holds and what is worrying you. You leave with a clear view of your three or four highest priorities and a rough sense of effort and cost. There is no obligation and no charge.
 Support
Help Centre
Email support@cipherknights.com or call +44 7424 967568 during business hours, Monday to Friday 9am to 6pm. For a suspected security incident, always call rather than email so it can be triaged immediately.

Ready to talk about frequently asked questions?

Book a free, no-obligation consultation with our Leicester team, or call us and we will point you in the right direction whether or not you become a client.

Book a Free Consultation → Contact Us