Cyber security for small business is no longer a concern limited to large organisations. Small and medium-sized businesses in London hold customer records, payment details and commercial contracts, yet many operate without a named person responsible for security. A single compromised mailbox or unpatched server can interrupt trading for days, and recovery often costs more than prevention. This guide sets out the controls that matter, explains how managed services fit alongside them, and describes how to choose a provider with confidence.
Table of Contents
- Quick Takeaways
- Why London SMEs Are Targeted
- Core Controls Every London Business Needs
- What Managed Cyber Security Services Include
- Choosing an Approach
- Selecting a Cyber Security Consultant in London
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Enforce multi-factor authentication on email and administrator accounts | Compromised passwords are a common route into Microsoft 365 environments. Enforcing a second sign-in step, starting with administrators, closes one of the most frequent gaps. |
| Test backups by restoring them | A backup that has never been restored is an untested assumption. Keep at least one copy separate from the primary environment so that ransomware cannot reach it. |
| Assign one accountable owner | Patching, leaver removal and access reviews stop happening when no individual is responsible for them. |
| Patch on a fixed schedule | Operating systems, browsers and line-of-business applications should be updated within a defined window rather than when someone has time. |
| Prepare a breach reporting process in advance | Under UK GDPR, certain personal data breaches must be reported to the Information Commissioner’s Office within 72 hours of becoming aware, where feasible. The process must exist before an incident occurs. |
| Write response times into the contract | Defined response and resolution targets allow performance to be measured, rather than relying on informal assurances. |
Why London SMEs Are Targeted
Criminals usually pursue the route of least resistance rather than the largest prize. Small firms often combine valuable data with limited security staffing, which makes them attractive targets. Professional services, property and hospitality firms, which handle client information and regular payments, are particularly exposed.
In practice, the most common entry points are rarely sophisticated. Phishing emails that imitate a supplier invoice, reused passwords and unmanaged personal devices account for a large share of the incidents small firms encounter. The National Cyber Security Centre publishes advice for small and medium-sized organisations that addresses these everyday risks directly.
Phishing and Invoice Fraud
Phishing messages are designed to look routine. An email requesting a changed bank account for a supplier, sent at the end of the month, can succeed where a technical attack would fail. Verification by telephone before any payment detail is changed is a simple control that many businesses do not formalise.
Reused Passwords and Unmanaged Devices
When staff reuse passwords across services, a breach at one provider can expose access to email and cloud storage. Personal laptops and phones that hold company email without any management or encryption extend the boundary of the business beyond its control.
Core Controls Every London Business Needs
Most small businesses do not need a complex security architecture to reduce their exposure significantly. A small number of controls, applied consistently, address most common attacks. The Northern Ireland Cyber Security Centre’s basic steps guide for small organisations focuses on backing up data, protecting against malware, securing mobile devices and managing passwords.
Multi-Factor Authentication on Email and Administrator Accounts
Multi-factor authentication requires a second confirmation, such as an app prompt, in addition to a password. For Microsoft 365 tenants, enforcement should begin with global administrator accounts and then extend to every user, because a compromised administrator account can give an attacker control of the whole environment.
Backups That Have Been Restored
A backup is only useful if it can be restored within an acceptable time. At least one copy should be kept separate from the primary environment, and a restore should be tested at a fixed interval, such as quarterly. Recovery time and the acceptable amount of data loss should be agreed in writing before an incident occurs.
Patching and Endpoint Protection
Unpatched operating systems and browsers remain a frequent route for malware. A defined patching window, with critical updates applied within days rather than months, reduces this exposure. Endpoint protection on laptops and mobile devices should be centrally managed so that coverage can be verified rather than assumed.
What Managed Cyber Security Services Include
Managed cyber security services provide the monitoring, maintenance and response capability that most small businesses cannot resource internally. Within an outsourced IT department model, security becomes a defined service with named responsibilities, regular reporting and agreed response times. It no longer depends on whoever has time that week.
Monitoring and Incident Response
Continuous monitoring identifies unusual sign-ins, malware detections and unexpected administrative changes. The greater value lies in the response. A written incident procedure, with defined escalation contacts and a rehearsed set of first actions, prevents a contained event from becoming a prolonged outage.
Compliance and Access Reviews
Access to customer data should be reviewed regularly, particularly when staff join, change roles or leave. A managed provider can maintain a current register of accounts and devices, which supports the evidence expected under UK GDPR and helps with Cyber Essentials certification, a scheme backed by the National Cyber Security Centre.
Pro tip: Ask any provider to show the most recent restore test completed for a client of similar size. A dated, specific answer indicates a managed process, while a vague one suggests that backups have not been verified.
Staff Awareness Training
Training is most effective when it is short, regular and linked to real examples, such as the invoice fraud emails staff actually receive. Simulated phishing exercises can show where additional guidance is needed, but they should support technical controls rather than replace them.
Choosing an Approach
Most London SMEs choose between three broad models. Each carries a different cost profile, level of accountability and suitability for a given stage of growth. The comparison below sets out the practical trade-offs.
| Approach | Strengths | Limitations |
|---|---|---|
| Full-time in-house IT or security hire | Detailed knowledge of the business and an immediate presence on site | Creates a single point of dependence, and cover during leave or illness is difficult to arrange |
| Ad hoc break-fix support | Low commitment, with payment only when a problem arises | No proactive monitoring, incidents are often discovered late, and no response times are defined |
| Managed cyber security service within an outsourced IT department | Defined responsibilities, monitoring, reporting and service levels, with access to a team of engineers | Requires a clear contract and scope, and the quality of outcomes depends on onboarding and regular review |
For businesses without a dedicated IT lead, the managed model usually offers the most predictable outcome. It spreads specialist skills across cloud, identity and security without the cost of several full-time hires. Further detail on how an outsourced IT department operates is available at iTO.London.
Security controls that are not reviewed regularly tend to drift out of date, even when they were configured correctly at the outset.
Selecting a Cyber Security Consultant in London
A cyber security consultant can assess your current position and recommend priorities, but ongoing protection requires operational support. When comparing options, the distinction between advice and delivery should be clear in every proposal. Ask who carries out the work after the report is delivered.
Questions to Ask Before Signing
Ask who responds to an alert outside office hours, what the target response time is, and how monitoring coverage is reported. Clear answers indicate that a provider can support a business in practice, rather than only in a planning document.
Contract Terms and Service Levels
Service level agreements should define response and resolution targets for each priority level, the devices and accounts in scope, and the arrangements for exit. Pricing should be itemised so that additional services, such as penetration testing, are visible rather than hidden within a monthly fee.
Pro tip: Request a sample monthly report before signing. A useful report lists alerts, patch status, backup results and open actions, which allows you to confirm that the service is delivered as contracted.
Frequently Asked Questions
How much should a small business in London spend on cyber security?
No single figure applies, because cost depends on headcount, the number of devices and the cloud platforms in use. A more reliable approach is to compare the scope of services included in each proposal, including monitoring, backups, patching and reporting.
Is Cyber Essentials required for small businesses?
Some public sector contracts require Cyber Essentials, and it provides a recognised baseline for businesses that handle customer data. Certification is assessed through bodies authorised under the National Cyber Security Centre’s scheme, and it is a sensible first milestone for most SMEs.
What is the first step for a business with no security policy?
Start by listing user accounts, devices, cloud services and the main categories of data held. Then assign an accountable owner, enforce multi-factor authentication on email and administrator accounts, and confirm that backups can be restored.
Do I need a cyber security consultant or a managed service?
A consultant is suited to a one-off assessment or a specific project. A managed service is more appropriate when a business needs continuous monitoring, patching and response, because these tasks must be performed every week rather than once.
What should a business do if it suspects a breach?
Isolate affected devices, avoid deleting evidence, and contact the IT provider or internal owner immediately. Record the timeline of events and assess whether personal data has been affected, since reporting to the Information Commissioner’s Office may be required within 72 hours where feasible.
We welcome feedback from London business owners and managers on the security challenges they have faced and which controls have proved most practical in their own organisations.