Monday morning. Someone in finance notices a payment went somewhere it should not have.

That is how a meaningful proportion of cyber incidents actually begin for SMEs. Not a dramatic system failure, not a ransom note on every screen, but a quiet, unsettling discrepancy that someone happens to notice. A supplier chasing an invoice you are sure you paid. A bank account detail that does not look quite right. An email in a sent folder that nobody remembers writing.

What happens in the hours immediately afterwards shapes every consequence that follows: how much money is recovered, whether the insurer pays, whether the regulator gets involved, and how much damage is done to relationships with customers and suppliers. Yet most SMEs have never thought through what those hours should look like until they are living through them.

How these incidents usually start

Payment diversion fraud is one of the most common ways a cyber incident first shows itself in a business. In an invoice or mandate scam, a business tries to pay a genuine supplier, but a criminal intervenes and persuades it to send the money to an account they control instead. In a CEO scam, the criminal impersonates a director or senior manager to request an urgent payment.

The scale is significant. According to UK Finance’s latest annual fraud report, invoice and mandate scams alone caused £41.3 million of losses across 2,305 cases in 2025. These are rarely opportunistic. UK Finance warns that criminals may target a business over several months, building a picture of who authorises payments, and can even use information on company websites about genuine suppliers.

Here is the part that matters most for the first hours. A redirected payment is very often a symptom, not the incident itself. If a criminal knew exactly when an invoice was due, which supplier to impersonate and how your finance team writes its emails, there is a good chance they have had access to a mailbox, possibly for weeks. The missing money is what you noticed. The compromised account is what you need to investigate.

The instinctive first call is often the wrong one

The instinct for most businesses is to ring the MSP. That is understandable: they run the systems, they know the environment, and they are the people you call when something goes wrong.

But it is often the wrong first call. An MSP may well have a role to play, but they are also, in many cases, part of the environment being investigated. If the attacker got in through a misconfigured system, a missing control or an unmanaged account, the MSP’s own work is part of the question. That creates a potential conflict between their commercial relationship with you and an impartial assessment of what went wrong. This is not a criticism of MSPs. It is the same reason you would not ask the builder to sign off his own structural survey.

There is also a practical risk. A well-meaning engineer who resets passwords, wipes a laptop or “cleans up” a mailbox can destroy exactly the evidence an investigator or insurer needs. Speed matters, but the wrong kind of speed makes things worse.

The first calls should do three things: establish containment, preserve evidence, and get an accurate picture of scope, before anyone starts making changes that could complicate a later investigation or insurance claim.

What the first hours should actually look like

Every incident is different, but the sequence for a suspected payment diversion or account compromise usually looks something like this.

In the first hour

Call your bank immediately. Use the number on the back of your card or your bank’s official fraud line, not one from an email. Report the payment as fraud and ask the bank to contact the receiving bank. The chances of recovering money fall quickly once it has moved on, so this call cannot wait for an internal meeting.

Call your cyber insurer’s incident line, if you have one. Many policies require you to notify them promptly and to use their appointed incident response specialists. Calling them early protects your claim and often gets you expert help faster than you could arrange yourself. Keep that number somewhere you can find it without access to your email.

Stop further payments to any supplier whose bank details have changed recently until they have been verified by phone using a number you already hold.

Do not start deleting or rebuilding anything. Change passwords on the obviously affected accounts if you need to stop ongoing access, but leave investigation and remediation to people who know how to preserve evidence.

In the first day

Understand scope. Which mailboxes were accessed? Were forwarding rules set up? Were other suppliers or customers emailed from your accounts? Was personal data viewed or downloaded? This is where independent incident response expertise earns its keep.

Bring in the right people: the insurer’s panel, your MSP under direction rather than in charge, and legal advice if personal data or significant sums are involved.

Start a written log of what was found, when, by whom and what was done. This becomes the backbone of any insurance claim, regulatory notification or police report.

Report it. In England, Wales and Northern Ireland, fraud and cybercrime are now reported through Report Fraud, the City of London Police service that replaced Action Fraud on 4 December 2025.

Within 72 hours

Decide whether a regulatory notification is required. This is where the clock becomes critical.

The regulatory clock is already running

Under UK GDPR, a personal data breach that is likely to result in a risk to people’s rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it.

“Becoming aware” has a specific meaning. You are considered aware when you have a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. You can carry out a short initial investigation to establish that, but the clock starts when that certainty is reached, not when the investigation is finished.

That distinction matters enormously in practice. If a criminal has been inside a finance mailbox, that mailbox will almost certainly contain personal data about staff, customers or suppliers. The question of whether you are notifying the ICO is therefore one you may need to answer while you are still working out what actually happened. And weekends do not pause the clock: if you become aware on a Friday evening, you should still aim to notify by Monday evening.

The good news is that you do not need all the answers within 72 hours. You can submit an initial notification with the information you have and follow up with more detail as it becomes available. What you cannot do is ignore the deadline. If you report late, you must explain why.

Don’t assume the bank will refund you

Many business owners have heard that banks now have to reimburse victims of authorised push payment fraud. That is true, but only for some.

Since 7 October 2024, mandatory reimbursement rules set by the Payment Systems Regulator cover individuals, micro-enterprises and smaller charities, up to a maximum of £85,000. A micro-enterprise means a business that employs fewer than 10 people and has annual turnover under £2 million.

A business with 25 or 35 staff is outside that scheme. Banks will still look at claims case by case, but there is no automatic right to a refund. For most growing SMEs, recovery depends on how quickly the bank is contacted, whether the money can be traced, and whether you have suitable insurance cover.

Why so many businesses get this wrong

The pattern is not a lack of competence. It is a lack of preparation. According to the government’s Cyber Security Breaches Survey, only a quarter of UK businesses have a formal incident response plan. Even the basics are patchy: assigned roles during an incident exist in 39% of businesses, and written guidance on who to notify in 34%.

Without a plan, decisions get made by whoever happens to be in the office, under pressure, with incomplete information. People call who they always call. Systems get “fixed” before anyone asks what they can tell you. Deadlines slip because nobody knew they existed.

Preparing for the first hours costs a conversation

Board-level awareness of what these first hours should look like, before an incident happens, is one of the most valuable and least expensive pieces of preparation an SME can do. In practice, it means agreeing a few simple things in advance:

None of this requires expensive technology. It costs a conversation. The alternative costs a great deal more.

If you are not sure who in your business would make the first call, or what that call should be, it is worth talking it through before you need to.

Your cyber insurance policy has conditions. Most SMEs have not read them.

A cyber insurance policy is not a blanket safety net. It is a contract with conditions attached, and those conditions typically require specific controls to be in place and evidenced before an incident occurs, not after. Multi-factor authentication on key systems. Patch management within a defined timeframe. Backups that are not just taken, but tested.

For many SMEs, the gap between what they assumed the policy covered and what it actually requires is only discovered at the worst possible moment: when a claim is being assessed.

Cyber insurance is growing fast, and so are claims

More UK businesses are buying cyber cover than ever. Among small businesses, take-up rose from 49% in 2024 to 62% in 2025, according to the government’s Cyber Security Breaches Survey. Across the wider market, the ABI reports that 17% more policies were taken out in 2024 than the year before.

Claims are rising sharply too. The ABI found that £197 million was paid out to help UK businesses recover from cyber incidents in 2024, a 230% increase on 2023. Malware and ransomware made up 51% of claims, up from 32% the year before. And those figures predate the major attacks on household-name retailers and manufacturers in 2025.

None of this is bad news for insurance. Most legitimate claims are paid, and a good policy brings more than money: access to incident response specialists, legal support and forensic experts at the moment you need them most. But as payouts climb, insurers are understandably scrutinising claims more closely, and asking harder questions at underwriting and renewal. That is where SMEs get caught out.

Why claims get declined

Declined claims are rarely about whether the incident was genuine. Nobody disputes that the ransomware happened or the invoice fraud was real. The question is whether the controls the policy required were actually in place, and whether you can prove it.

Most problems fall into a handful of categories.

1. The application form said one thing, reality said another

When you buy or renew cyber cover, you complete a proposal form or questionnaire about your security. Do you enforce MFA? Do you patch critical vulnerabilities promptly? Are your backups stored offline and tested? These answers form the basis on which the insurer agrees to cover you and sets your premium.

The trouble is that these forms are often filled in quickly, by someone in finance or operations, ticking “yes” in good faith based on what they believe to be true. If the insurer later finds the answer was inaccurate, it may treat that as misrepresentation.

A widely discussed 2025 case in Canada illustrates the point. Commentary on the case highlighted that the attack began through an exploited internet-facing server where MFA was missing, and affected 80% of the network. Analysts suggested the claim may have been declined either because the policy had a minimum security standards condition, or because the organisation had stated it enforced MFA for all remote access when it did not.

In the UK, the Insurance Act 2015 places a “duty of fair presentation” on businesses buying insurance. In plain terms, you must disclose what you know, or ought to know, about your risk. An insurer’s remedy depends on what it would have done had it known the truth, which can range from adjusting the premium to declining the claim entirely. “We thought MFA was on everywhere” is not a strong position.

2. MFA was on, but not everywhere

This is the single most common gap I see. MFA is switched on for Microsoft 365, but not for the VPN. Or it is on for staff accounts, but not for the admin accounts that matter most. Or it is enforced for everyone except the two directors who found it inconvenient.

Insurers increasingly expect MFA across email, remote access and privileged accounts as a baseline. If an attacker gets in through the one account without it, partial deployment offers little comfort.

It is worth knowing how common this gap is across UK businesses. The government’s latest survey found that only 47% of businesses use any form of multi-factor authentication. Many of those will be partial deployments.

3. Backups that exist but don’t restore

Almost every business believes it has backups. Far fewer have tested whether they can actually restore from them, how long it would take, and whether the backups would survive an attacker who has gained admin access to the network.

Policies often require backups to be taken regularly, stored separately from the main network, and tested. If your backups fail during an incident, or turn out to have been encrypted along with everything else, the insurer may question whether the conditions were met and whether your losses could have been reduced.

4. Patching that slipped

Many policies expect critical security updates to be applied within a defined timeframe. If an attacker exploits a vulnerability that was publicly known and patched by the vendor months earlier, expect questions about why the update was not applied.

In SMEs, patching usually sits with the MSP. That is fine, but it means you need visibility of what is being patched, how quickly, and what has been excluded. “The MSP handles it” is not evidence.

5. Breaking the rules during the incident itself

Some claims run into trouble not because of what happened before the incident, but during it. Common examples:

All of these are understandable reactions in a crisis. That is exactly why they need to be worked out in advance and written into an incident response plan. The government’s survey found only a quarter of UK businesses have a formal incident response plan. Without one, the first time anyone reads the claims procedure is often during the incident.

6. The cover was never there in the first place

Finally, some businesses discover that the loss they suffered simply was not covered. Common examples include business interruption cover that is too low or subject to a long waiting period, social engineering or invoice fraud being excluded or heavily sub-limited, and losses at a key supplier not being covered at all.

Cyber policies are rarely one single pot of cover. They are usually split into sections, such as incident response, data restoration, business interruption, extortion, fraud and third-party liability, each with its own limits, excesses and conditions. A claim can be paid under one section and declined under another.

The real gap is evidence

The common thread in all of this is evidence. A business that has MFA switched on for some systems but not others, or has never tested whether its backups genuinely restore, can find itself with a policy that looks comprehensive on paper and offers far less protection in practice than the premium suggested.

When a claim is assessed, the insurer or its appointed experts will want to see records. Screenshots or reports showing MFA enforcement. Patch reports. Backup logs and restore test results. Training records. Your incident response plan. If those records do not exist, it can be difficult to show the controls were in place, even if they mostly were.

This is also a governance issue. The government’s survey shows only 31% of UK businesses have someone at board or senior management level with explicit responsibility for cyber security. When nobody owns the question, nobody checks that what the proposal form says matches what is actually happening.

Treat the policy as a checklist, not a formality

This is not a reason to distrust cyber insurance. For most SMEs, it is a sensible part of managing risk. It is a reason to treat the policy as a checklist rather than a formality.

In practice, that means:

  1. Read the conditions and exclusions properly, not just the schedule and the headline limits. Look specifically for minimum security requirements, conditions precedent and claims procedures.
  2. Pull out the last proposal form and check every answer against reality. Where an answer was wrong, tell your broker before renewal, not after a claim.
  3. Map each required control against what is in place, across every system, user and location. Look for the exceptions, because that is where attackers and loss adjusters both look.
  4. Gather the evidence now: MFA reports, patching reports, backup restore tests, training records. Keep them somewhere you can reach if your systems are down.
  5. Check your MSP contract covers what the policy requires, and that your MSP knows what you have told the insurer.
  6. Write the claims process into your incident response plan, including the insurer’s emergency number, kept somewhere accessible offline.
  7. Make someone accountable at leadership level for keeping this aligned through the year, not just at renewal.

Reading the conditions properly and mapping them against what is actually in place takes a few hours. It closes a gap that most SMEs do not know exists until it is too late to matter.

If nobody in your business has read your cyber policy’s conditions line by line in the last twelve months, that is worth putting right before the next renewal, not after a claim.

Speak to your broker if you have any concerns, they will be able to offer legal advice.

Most businesses only find out their MSP is underperforming when something goes wrong. A ransomware incident. A system outage that takes three days to resolve. A renewal that comes in thirty percent higher than expected with no explanation. By that point, the damage is already done.

The problem is that MSP underperformance rarely looks dramatic from the outside. Your systems are mostly working. The helpdesk is responding. Invoices are being paid. But underneath that surface-level normality, the governance, the accountability and the strategic value that a good MSP relationship should provide are quietly absent.

Here are five signs that your MSP is underperforming – and why they are so easy to miss.

1. You receive reports, but they don’t tell you anything useful

Most MSPs produce monthly reports. Ticket volumes, resolution times, uptime percentages. The numbers look reasonable and the traffic lights are mostly green.

But ask yourself: does that report tell your leadership team anything they could act on? Does it identify your three most significant IT risks? Does it say whether your backup and recovery position has been tested? Does it flag any supplier or licensing changes that affect your commercial exposure?

If the answer is no, if the report exists to demonstrate activity rather than to inform decisions, that is a governance failure. A well-run MSP relationship produces reporting that a non-technical board member can read and respond to. If yours does not, you are flying blind on IT risk.

2. Your MSP sets the agenda for renewal conversations

Renewal time is when the power dynamic in an MSP relationship becomes most visible. If your MSP leads the renewal conversation, presents the pricing, explains what has changed and why, and you largely accept it with minor negotiation, you are not managing the relationship, you are being managed by it.

A well-governed MSP relationship means you know, before renewal begins, what the contract covers, what it does not cover, what your actual usage has been, and what the market rate for comparable services looks like. You go into the conversation with your own position, not theirs.

Most SMEs do not have this. They accept the renewal because they do not have the internal expertise to challenge it, and because switching feels like too much disruption. That is an expensive position to be in, year after year.

3. Security is treated as a product, not a posture

If your MSP’s response to questions about cyber security is to sell you something, an EDR tool, a security awareness platform, an additional monitoring tier, that is not the same as managing your security posture.

Good MSP security management means understanding your actual risk profile, advising on proportionate controls, and being honest when something is outside their capability or remit. It means telling you when Cyber Essentials is the right starting point rather than overselling an enterprise solution to a business of your size. It means having an honest conversation about what your backup and recovery position actually looks like in practice, not just on paper.

Security as a product means the solution precedes the problem. Security as a posture means the controls match the risk. Most SMEs are sold the former and told it is the latter.

4. Incidents are resolved but never reviewed

Every IT incident, a phishing attempt that reached a mailbox, a system failure, an access control problem, contains information. It tells you something about your controls, your processes or your supplier’s capability.

A well-run MSP relationship treats incidents as data. There is a post-incident review, however brief. The root cause is identified. Any process or control change is documented and implemented. You, as the client, are told what happened and what has changed.

In an underperforming relationship, incidents are closed when the immediate problem is fixed. The ticket is resolved. The outage is over. The phishing email has been deleted. But no one asks why it happened, whether it will happen again, or what it reveals about the broader security position.

If your MSP closes tickets but does not close the loop, you are accumulating risk with every incident that goes unreviewed.

5. You do not know what you are paying for

This is the most common sign, and the hardest one for business leaders to admit. You receive an invoice each month. You pay it. You could not, without going back through the contract and the correspondence, tell someone exactly what is included, what is charged additionally, and what is genuinely outside scope.

This is not unusual, and it is not necessarily your fault. MSP contracts are often complex, and the scope of what is and is not included shifts over time as your business changes, as technologies are added, and as verbal agreements accumulate. But it creates a position where you cannot assess value, cannot benchmark cost, and cannot have an informed conversation about whether the relationship is working.

A good MSP makes the scope visible. A good client governance process requires them to.

What to do about it

If two or more of these signs are familiar, it does not necessarily mean you need to change MSP. It means you need better oversight of the relationship you already have.

The right starting point is an independent review: someone who is not your MSP, does not have a commercial relationship with any supplier, and can look at the contract, the reporting, the security posture and the renewal history with fresh eyes and tell you honestly where you stand.

That is exactly what Northstar’s Board-Level IT & Cyber Risk Review provides. It is a one-off, independent assessment of your IT and cyber position, including your MSP relationship, written in plain English for business leaders, not a technical audience. If you would like to talk through what that looks like for your business, get in touch.

At 15 people, informal IT works fine. At 35, it starts costing you money you cannot see.

There is a specific point in a growing business where the IT setup that carried you from ten people to twenty-five simply stops working. Almost nobody sees it coming, because nothing dramatic happens to mark the moment. No system crashes. No single bad day. It is a slow build-up of friction that gets absorbed, mostly by the founder or MD, until it becomes normal.

I see the same pattern again and again. The business has grown well. Revenue is up, the team has doubled, maybe there is a second office or a hybrid workforce. But the way technology is run has not changed since the days when everyone sat round one table and the most technical person in the room “did the IT”.

Why it happens between 25 and 35 people

In the early days, informal IT is the right answer. Decisions are fast, everyone knows everyone, and the cost of getting something slightly wrong is small. The founder picks a few tools, an MSP handles the laptops and the email, and it works.

The problem is that complexity does not grow in a straight line with headcount. Every new person adds accounts, devices, permissions, data and another way for things to go wrong. Every new team tends to bring its own tools. Research from BetterCloud shows how quickly this happens: young companies of one to two years old typically start with around 29 SaaS apps, and by the time they are three to six years old that figure has jumped to about 103. Nobody sat down and decided to run a hundred systems. It just happened, one sensible decision at a time.

Around the 25 to 35 mark, the volume of change finally exceeds what one busy founder and a reactive support contract can absorb. The exact point varies depending on how technical the founding team is and how fast growth has been, but the symptoms are remarkably consistent.

The five warning signs

1. Onboarding takes days, not hours

When access provisioning is manual and undocumented, every new starter becomes a small project. Someone has to remember which systems they need, who has admin rights to each one, and what the laptop should have on it. Inevitably something is missed.

This is not unusual, but it is expensive. One industry study found that 43% of new hires waited more than a week for basic workstation logistics and tools, and 18% waited over two months for the tools they needed. Even a short delay adds up. As one estimate puts it, two days of onboarding delay for a well-paid employee means roughly two days of paid time with nothing to show for it, and across 20 hires in a growth year that becomes a significant direct loss, before you count the time spent by whoever is doing the provisioning.

For a business hiring steadily, that is real money leaking out every month. It also sends new starters the wrong message in their first week.

The flip side matters just as much. Offboarding is usually worse than onboarding. If you cannot say with confidence that every leaver lost access to every system on their last day, you have a security problem as well as an admin one.

2. Nobody has a complete list of your systems

Ask most growing businesses for an authoritative list of every system they run, who owns it, what data sits in it and what it costs, and you will get a pause. The list exists in pieces: in the finance system as card payments, in people’s heads, in an MSP’s asset register that only covers the hardware.

This matters for three reasons. First, cost: unused and duplicate subscriptions are common, and Zylo’s research found that 53% of licences go unused within 30 days. Second, risk: you cannot protect data you do not know you hold. Third, resilience: if a key person leaves, the admin rights and institutional knowledge for a critical system can leave with them.

3. The MSP has become reactive

Many MSP relationships start well. When the business is small and simple, tickets in and fixes out is exactly what is needed. But as the business grows, you need someone thinking ahead: planning for the next office move, the next 20 hires, the renewal of your main line-of-business system, the security controls your biggest customer is now asking about.

That forward-looking work is rarely in a standard support contract, and it is not the MSP’s job to set your technology direction. So it falls into a gap. The MSP waits to be asked, the business does not know what to ask, and the relationship drifts into pure break-fix. When something does go wrong, the MSP calls the founder.

4. Security gaps open up because nobody owns the question

This is the most serious sign, and the one most often hidden. In a growing business, security is everyone’s problem and therefore no one’s. The MSP assumes the business will tell them what it needs. The business assumes the MSP has it covered.

The UK data backs this up. According to the government’s latest Cyber Security Breaches Survey, 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Crucially, the rate climbs with size: 65% of medium businesses reported a breach, compared with 42% of micro and 46% of small businesses. A business crossing from 25 to 50 people is moving directly into that higher-risk bracket, often without changing how it manages security at all.

Yet ownership remains thin. Only 31% of businesses have someone at board or senior management level with explicit responsibility for cyber security. Only a quarter have a formal incident response plan, meaning most businesses that suffered a breach responded without a defined approach. And just 5% of UK businesses hold Cyber Essentials certification, while fewer than half use two-factor authentication.

Supplier risk is a growing blind spot too, and highly relevant when you depend on an MSP and dozens of SaaS providers. The survey found only 22% of small businesses review risks from their immediate suppliers, and 10% review their wider supply chain.

The consequences are getting more serious. The proportion of businesses reporting loss of revenue or share value after a breach rose from 2% to 5%. Increasingly, the question is not just about attacks either. Larger customers, insurers and investors now ask pointed questions about your controls during procurement, renewals and due diligence. A business that cannot answer them loses deals, pays more for cover or takes a hit on valuation.

5. The founder is still the IT department

Underneath all of this sits the most expensive symptom of all. The founder or MD is still the person who gets pulled into IT decisions, often several hours a week. Approving a new tool. Chasing the MSP. Resetting the admin password on the website. Answering the security questionnaire from a prospective customer at 10pm.

Individually, each of these takes a few minutes. Together, they take a real slice of the most valuable time in the business, and they pull attention away from sales, people and strategy at exactly the point where growth demands it most. Because the cost never appears on an invoice, it rarely gets challenged.

This is a governance problem, not a technology problem

The instinct at this point is often to buy something: a new platform, a bigger support contract, another tool. Sometimes that helps. But the root cause is almost never a lack of technology. It is a lack of ownership, visibility and decision-making structure around the technology you already have.

The businesses that navigate this stage well do a few simple things:

None of this requires a full-time IT director on a large salary. For most businesses at this size, fractional or part-time oversight is enough to set direction, hold suppliers to account and take the founder out of the loop.

The key is timing. Bringing in oversight before the friction becomes a crisis is far cheaper than doing it after a breach, a failed audit or a lost contract.

Is this you?

A quick self-check. If you answer “no” or “not sure” to more than a couple of these, you are probably at the inflection point:

If new starters are waiting days for access, or you are still the person the MSP calls when something breaks, it is worth a conversation.

Governance reviews are standard practice for finance, HR and legal matters in most well-run businesses. IT and cyber governance rarely gets the same treatment. The result is that significant risks accumulate unnoticed until something goes wrong and the board asks why nobody flagged it earlier.

This post provides a practical annual IT governance checklist for SME boards. It is not a technical audit. It is a set of questions that a non-technical board member can ask and expect a clear, honest answer to. If the answers are not clear and honest, that is itself a finding worth acting on.

Section 1 – IT supplier and service delivery

Are we receiving regular, structured service reports from our IT supplier and are we reading them?

A service report that nobody reads is not governance. If your MSP sends a monthly report, someone on the leadership team should be reviewing it, understanding what it contains, and asking questions where the answers are not clear.

When did we last conduct a formal service review with our IT supplier?

A quarterly service review – a structured meeting with a documented agenda, agreed performance metrics and tracked actions, is the minimum standard for any significant IT supplier relationship. If the last formal review was more than six months ago, the relationship is being managed informally.

Are we confident our MSP contract still reflects how the business operates?

Businesses change. Contracts do not update themselves. If your headcount, systems, working practices or locations have changed significantly since the contract was signed, the scope may no longer be appropriate.

Do we know what our IT supplier is contractually obligated to deliver and are they delivering it?

Most SME leaders cannot answer this question accurately because they have never read the contract in detail. If you do not know what you are entitled to, you cannot identify when you are receiving less than that.

Section 2 – Cyber security

Do we know the three most likely ways our business could be compromised?

Phishing, business email compromise and ransomware via an unpatched system account for the majority of cyber incidents in UK SMEs. Your IT supplier should be able to tell you specifically which of these represent the most significant risk for a business of your type, size and sector.

When did we last test our backup and recovery process?

A backup that has never been tested is a backup you cannot rely on. Annual testing of the recovery process, not just confirmation that the backup is running, is a minimum standard.

Are all staff accounts and access permissions current?

This means leavers’ accounts fully deactivated, access permissions reviewed to ensure they reflect current roles, and administrator privileges limited to those who genuinely require them.

Do we hold Cyber Essentials certification and is it current?

Cyber Essentials certification lasts twelve months. If you hold it, when does it expire? If you do not hold it, is it required by any of your clients, insurers or contracts?

Section 3 – Data and compliance

Do we know what personal data we hold and where it lives?

UK GDPR requires you to know what personal data your organisation processes, where it is stored, who has access to it and how long you retain it. If you cannot answer these questions, your data register either does not exist or is not current.

Are all our key IT suppliers covered by Data Processing Agreements?

Where a supplier processes personal data on your behalf, cloud platforms, SaaS tools, your MSP, there should be a Data Processing Agreement in place. Most SMEs have not checked whether these exist for all relevant suppliers.

Do we have a documented process for responding to a data breach within 72 hours?

The ICO reporting obligation begins when you become aware that a breach may have occurred. Without a documented process, the 72-hour window will pass before you have even worked out who needs to be involved.

Section 4 – AI and emerging technology

Do we know which AI tools our staff are using for work purposes?

This includes tools they have adopted independently as well as those provided by the business. The answer is almost always more extensive than leadership expects.

Do we have an AI policy that defines acceptable use and data handling boundaries?

If staff are using AI tools without a policy in place, that use is ungoverned. An AI policy does not need to be lengthy, it needs to exist, be understood, and be enforced.

Section 5 – IT spend and value

Do we have a consolidated view of all IT spend across all suppliers and licences?

If nobody in the business can produce a complete list of IT suppliers, contracts, licences and associated costs within 48 hours, you do not have adequate visibility of your IT spend.

When did we last benchmark our IT costs against current market rates?

IT pricing – particularly connectivity, telephony and cloud services, changes significantly over time. A contract that represented good value three years ago may now be significantly above market.

Are there any IT contracts approaching renewal in the next six months?

Renewal windows – typically 30 to 90 days before contract expiry, are your highest-leverage moment for renegotiation. Missing them locks you in for another term at existing rates.

Using this checklist

Work through these questions annually as a board agenda item. Assign responsibility for providing answers to a specific person, ideally someone with independent IT oversight rather than the IT supplier themselves. Where answers are unclear, incomplete or absent, those are your priority actions for the following quarter.

If you do not have anyone in the business who can provide independent, informed answers to these questions, that is itself the most significant governance finding  and the one most worth addressing first.

IT governance is one of those phrases that sounds corporate and abstract until the moment it becomes very real. A supplier goes offline and nobody knows who the contract is with. A key employee leaves and takes their access credentials with them. A cyber insurer declines a claim because there was no documented security policy. A client audit reveals your data handling practices don’t meet their requirements.

These are governance failures. And they happen to small businesses every day.

What IT governance actually means

IT governance is simply the set of policies, processes and oversight mechanisms that ensure your IT systems and technology investments are aligned with your business objectives, managed responsibly, and operating within acceptable risk parameters.

For a large enterprise, that might mean a formal IT governance framework, a dedicated CIO, and quarterly board-level reporting. For a 30-person professional services firm, it means something more proportionate – but the principles are identical.

Good IT governance for an SME covers:

– **Strategic alignment** – are your technology investments actually supporting what the business is trying to do?

– **Risk management** – do you understand the operational and cyber risks associated with your IT systems?

– **Supplier oversight** – are your IT suppliers performing to the standard your contracts require?

– **Compliance** – are you meeting your legal and regulatory obligations around data, security and continuity?

– **Value** – are you getting appropriate return on your IT spend?

Why most SMEs have a governance gap

The honest answer is structural. In most businesses below 50 or 100 people, there is no single person with both the technical understanding to evaluate IT decisions and the seniority to challenge suppliers, set policy and report to the board.

The MD is focused on the business. The Finance Director trusts that IT costs are reasonable. The Office Manager coordinates with the MSP on day-to-day issues. And the MSP – however capable – is not paid to govern. They are paid to keep things running.

The result is a gap between IT delivery and IT leadership. Nobody is asking whether the technology strategy is right. Nobody is challenging the supplier contract at renewal. Nobody is reporting cyber risk to the board in terms the board can act on.

This gap is invisible until it becomes a problem.

The signs that your IT governance needs attention

You may have a governance gap if:

– You are not sure exactly what IT systems and licences your business is paying for

– Your MSP contract has not been reviewed in more than two years

– You have no documented IT security policy

– Leavers’ system access is not removed consistently and promptly

– You have never tested your backup and recovery process

– Your board has no visibility of IT or cyber risk beyond “it’s being handled”

– You don’t know which systems contain personal data or how it is protected

None of these is a crisis in isolation. Collectively, they represent significant operational and commercial exposure.

How right IT governance looks like for an SME

Good governance does not require a large investment or a complex framework. For most SMEs, it means:

**Clear ownership** – someone is responsible for IT and cyber oversight at a senior level. In a small business, this is often best handled fractionally – a part-time IT director who attends board meetings, reviews suppliers and reports on risk, without the cost of a full-time hire.

**Basic documentation** – an IT security policy, an acceptable use policy, and a data register. These do not need to be lengthy documents. They need to exist, be accurate, and be reviewed annually.

**Supplier accountability** – regular service reviews with your MSP, performance metrics that are actually tracked, and contracts that are reviewed before automatic renewal.

**Risk visibility** – the board receives a brief, plain-English update on IT and cyber risk at least quarterly. They understand what the key risks are and what is being done about them.

**Incident readiness** – there is a basic plan for what happens if something goes wrong. Who do you call? What do you communicate to clients? What are the regulatory obligations?

The commercial case for better governance

IT governance is not a compliance exercise. It is a commercial discipline. Businesses with good IT governance:

– Spend less on technology, because spend is reviewed and challenged

– Recover faster from incidents, because plans exist

– Win more contracts, because they can demonstrate security and compliance

– Pay lower cyber insurance premiums, because their risk profile is better

– Attract better talent, because their systems and processes work properly

For a business of 20 to 100 people, the return on investment in proper IT governance is typically significant and measurable within twelve months.