Which cybersecurity rules apply to your business
Cybersecurity compliance is not one rule. It is a mix of voluntary schemes, legal duties and customer contract demands. Most small firms only find out which ones apply when a client asks for proof.
Some obligations are voluntary schemes that unlock contracts. Others are legal duties that apply the moment you handle personal data. The third group comes from your customers, who increasingly ask suppliers to show they take security seriously. Insurers are moving the same way, and some will want to see multi-factor authentication, access reviews and encryption before they pay a claim.
Start by listing what your business actually does. Note where customer data is stored, which suppliers hold your files, and whether you bid for public sector work.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is a government-backed certification run by the National Cyber Security Centre (NCSC). It covers five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. The NCSC Cyber Essentials guidance sets out the detail.
Cyber Essentials Plus adds an independent technical test of your systems on top of the self-assessment. Many public sector contracts and larger supply chains ask for at least the basic certification.
- Cyber Essentials: a self-assessment, checked by the certifying body.
- Cyber Essentials Plus: independent testing of your systems.
- Best for: any firm that wants credible proof of baseline security.
Certificates run for 12 months, so diarise the renewal on the day you certify. Check current fees and timescales with the certifying body before you budget.
Even where no contract demands it, Cyber Essentials is worth holding. It gives you a clear baseline and something to show customers and insurers. A small business does not need ISO 27001 to do this well.
Data protection and UK GDPR
If your business holds personal data about customers or staff, UK GDPR applies to you. The Information Commissioner's Office (ICO) enforces it and expects you to protect that data with appropriate security.
In practice that means:
- Keep a clear record of what personal data you hold and why.
- Answer subject access requests within 30 days.
- Report a qualifying breach to the ICO within 72 hours. If you are unsure whether a breach qualifies, report it anyway.
The ICO publishes guidance for small organisations. Treat data protection as a core compliance area, not an afterthought.
How obligations vary by business type
The rules are not the same for every SME. A firm that takes card payments faces the Payment Card Industry Data Security Standard (PCI DSS). That is a contractual requirement from the card schemes, not a UK law.
Keep the legal and the voluntary apart. UK GDPR and the Privacy and Electronic Communications Regulations (PECR) are legal duties. Cyber Essentials is voluntary unless a contract makes it a condition.
A seven-step compliance roadmap
A practical sequence for most South Wales SMEs:
- Scope it. List the personal data you hold, the systems it sits in and the suppliers who touch it.
- Check the legal baseline. Confirm your privacy notices, data records and breach process are in place.
- Assess risk. Run a short risk assessment (covered below) and write down the results.
- Close the basics. Work through the five Cyber Essentials controls and fix the gaps.
- Gather evidence. Keep policies, asset registers, training logs, risk assessments and incident records in one folder.
- Certify if required. Apply for Cyber Essentials, or Plus if a customer asks for the independent test.
- Review on a schedule. Renew the certificate every 12 months and review the risk assessment every quarter.
Evidence you will need
Auditors and customers rarely accept a verbal assurance. If it is not written down, it did not happen. Expect to be asked for:
- a policy set
- an asset register
- a dated risk assessment
- training completion records
- patch and backup logs
- a documented incident response procedure
Build the folder as you go. Rebuilding it from memory at audit time is slow and rarely complete. Regulators and insurers want to see steady effort, not perfection.
Running a cybersecurity risk assessment
A risk assessment shows you where your business is most exposed. It turns vague worry into a short, ranked list of fixes.
- List your key assets, such as laptops, cloud accounts, customer records and email.
- Identify the threats to each one, such as phishing, ransomware or a lost device.
- Rate each risk by how likely it is and how much damage it would cause.
- Give every high-rated risk an owner and a deadline.
The common mistake is keeping the assessment in someone's head. Write it down, date it and review it every quarter. Review it again after any big change, such as a new system or an office move. That record doubles as your audit evidence.
Between reviews, a 30-minute monthly check is enough to keep things honest. Look at who has access, confirm backups are running and test a restore, check patching, and note what you found.
Writing a policy and checklist your team will use
A written policy gives your team clear rules to follow. Without one, security depends on whoever happens to remember.
Keep it to a handful of plain-English rules. If it reads like a lawyer wrote it, rewrite it. Cover these areas:
- acceptable use of company devices and accounts
- password rules, with multi-factor authentication on every business account, the owner's included
- how staff report a suspicious email or a lost device, which should take seconds, not a form
- how you add and remove people when they join or leave
Review the policy at least once a year.
Costs, timescales and where to get help
Costs vary with the size and complexity of your systems, so no single figure fits every firm. Certification fees and any technical test costs are set by the certifying body. Confirm them before you budget.
Plan for internal time as well as fees. Someone has to gather evidence, complete the self-assessment and fix the gaps. Expect part-time effort from whoever looks after administration and IT. If you use a managed IT provider, agree in advance who supplies which evidence, such as patch and backup logs, so the work is not duplicated.
Timescales depend on how ready your technical controls already are. Confirm expected timescales with the certifying body, and build in review time before any contract deadline rather than working back from the tender date.
Check whether your sector body or local business network offers cybersecurity guidance. If you are considering a Welsh Government or regional support programme, confirm current eligibility with the scheme itself before you rely on it.
A short checklist to finish:
- Confirm which certifications a customer actually requires before paying for any.
- Agree who owns each piece of evidence.
- Diarise the 12-month renewal date when you certify.
If you want an outside view of where you stand first, our free exposure check shows what an attacker can already see about your business.