Small and medium businesses hold a lot of valuable data: customer records, staff details, financial information and, increasingly, the data of larger customers up the supply chain. That makes them a target, and it makes data protection a business requirement rather than a technical nicety.

Know what you hold and where

You can't protect what you can't see. Start by understanding what personal and sensitive data you hold, where it lives (file servers, Microsoft 365, laptops, third-party systems) and who can reach it. Sensitivity labels in Microsoft 365 make this far easier than it used to be.

Control who can access it

Give people access to the data they need for their job and nothing more. Use separate accounts for admin work, remove access the day someone leaves, and protect every account with multi-factor authentication.

Encrypt devices and data

Every laptop and phone should be encrypted, and you should be able to wipe a lost device remotely. Data should be encrypted when it's stored and when it's sent, which modern cloud services do by default if they're configured properly.

Stop data walking out of the door

Data loss prevention rules can stop a spreadsheet of customer details being emailed to a personal address or shared publicly by mistake. Review external sharing settings regularly.

Back it up, and test the backup

Ransomware and human error are the 2 most likely ways to lose data. Keep independent backups, including of Microsoft 365, and restore from them in a real test at least once a year.

Train your people

Most data incidents start with a person: a phishing click, a misdirected email, a shared password. Short, regular training and phishing simulations make a measurable difference.

Prove it

Cyber Essentials gives you a recognised baseline, and customers, insurers and, in defence, the MOD increasingly expect it. If you're not sure where you stand, our health check is a good place to start, or read more about how we approach data security.