Cybersecurity · practical answers
What does a small-business security review cover?
Scope and starting price
Choose the relevant service below. We confirm the systems covered, checks and final price before work begins. Additional work and third-party costs need to be included in the agreed quote.
Small Business Security Check
From £99
A bounded review of common account, device, website and backup weaknesses.
Cybersecurity & Safety servicesMFA / Password Practices
From £39
Agreed improvements to sign-in protection and password practices.
Cybersecurity & Safety servicesPermissions / Access Review
From £99
Review unnecessary access, user roles and shared-account arrangements.
Cybersecurity & Safety servicesBegin with the services the business depends on
Identify email, file storage, the website, key business applications and the devices used to access them. Include who owns the accounts and what happens when somebody leaves. A review needs this context to distinguish a practical risk from a setting that has little relevance to your business.
The NCSC's guidance for small organisations covers securing email and important accounts, protecting devices, backups and spotting attacks. These provide a useful starting structure for a scoped review.
Technical reference: NCSC: small organisations guide to cyber security
Make the findings actionable
Ask for a clear description of each issue, its likely effect on your work and the next step. Separate a confirmed gap from an item that could not be checked. Priorities should reflect business impact and the work needed to address them.
For example, an account with no named owner may need ownership resolved before changing its sign-in settings. A backup with no restore evidence may need a test before replacing the entire backup product. The aim is to choose the next useful action.
Keep review and remediation clear
Agree which settings will be inspected and whether any changes are included. Enabling stronger sign-in, tidying access or hardening a server can be scoped alongside the review, but should not be assumed to cover every system for the starting price.
A practical review does not issue certification or establish regulatory compliance. If you require a formal assessment, certification scheme or specialist incident investigation, identify that requirement before choosing the service.
Is this the right fit?
A good fit when
- A small business wants a practical starting point for account, device, website and backup safety.
- You want prioritised improvements with a scope matched to the systems you actually use.
Limits of the scope
- This is not a penetration test, certification audit or assurance that every security problem has been found.
- Full incident response, legal compliance advice and company-wide remediation need appropriate separate scope.
What to prepare for an enquiry
- An outline of the business, approximate device and user counts, and important online services.
- The main concern and any recent incident or change that affects the review.
- Who can authorise the checks and which systems are managed by another supplier.
Start with a description and non-sensitive examples. Leave out passwords, API keys, private keys, recovery codes and customer data. Access arrangements are agreed separately if the work needs them.
Common questions
Is this Cyber Essentials certification?
No. This is a scoped practical security review. If you need certification, state that requirement so the appropriate assessment route can be distinguished from preparatory improvement work.
Will you fix every issue found?
The quote should state which changes, if any, are included. Wider remediation should be prioritised and agreed separately.
What if we think an account is already compromised?
Mention that immediately in the enquiry. Suspected compromise needs a triage discussion rather than being treated as a routine review.
Related answers
Cybersecurity
How do I improve the security of a Linux server?
Backups & reliability
How can I tell whether my backups will restore?
Backups & reliability