When discussing cyber security, many envision suspicious figures hunched over screens in dimly lit rooms, perhaps with the scent of Jamaican Woodbines lingering in the air. Unfortunately, this image is misleading; cyber security is often quite routine, especially for those of us focused on defence rather than offence. It fundamentally revolves around People, Process, and Technology.

I published a blog recently about how hackers hack (https://hah2.co.uk/how-do-hackers-hack/). In this article, I delve into how hackers profile individuals and organisations through various methods, frequently utilising what is known as social engineering. This technique is primarily non-technical and hinges on a cybercriminals ability to infiltrate the defences of your employees to extract information. Defending against this threat relies heavily on the first two components of cyber risk management: People and Policy.

For regular readers, it’s clear how much I value cyber awareness training. I consistently emphasise that your staff can be both your most significant asset and your greatest vulnerability. Cyber awareness training is essential and should include educating employees about your organisations structure and operations. They should know whom to contact if they have concerns regarding cyber security or suspect social engineering attempts. This information needs to be embedded in the policy, potentially accompanied by a related process that connects People with Process.

In addition to cyber security policies, we also have data protection policies, which are separate but certainly overlap. While nearly every organisation requires security policies, the necessity and comprehensiveness of data protection policies vary based on the type of business. For instance, you might not immediately think of Estate Agents as data holders, yet they manage substantial amounts of Personally Identifiable Information (PII)—data that can identify an individual. Not long ago, a London estate agent faced an £80,000 fine from the Information Commissioner’s Office (ICO) for leaving the personal data of over 18,000 customers exposed for almost two years due to a failure in their data sharing practices.

It’s astonishing how much PII estate agents possess. Consider all the information they request when buying a house! In this case, compromised details included bank statements, salary information, copies of passports, birth dates, and addresses for both tenants and landlords.

Moreover, individuals have the right to sue companies that mishandle their data. Today, law firms even promote “no win no fee” agreements for these cases. Remember that data breaches typically involve numerous individuals—often hundreds or thousands of records.

To solidify the connection between cyber security and data protection, it’s important to note that the Data Protection Act 2018—often referred to as UK GDPR—mandates that personal data must be secured by ‘default and design’. This implies that cyber security measures must be integrated into your data protection processes, potentially increasing the number of policies and procedures necessary to ensure safety and compliance with legal requirements.

Let’s explore what you might need for cyber security. First and foremost, you require a comprehensive policy approved at the board level or by company ownership if there isn’t a formal structure in place. This policy serves to demonstrate the company’s commitment to cyber security and establishes a foundation for what we term an Information Security Management System (ISMS). While you don’t need to adopt formal terminology, it essentially outlines the framework detailing necessary policies, assigns responsibility for keeping them current and relevant, and ensures dissemination among all staff. Essential policies may include but aren’t limited to:

– Top-level policy issued by the board

– Starters and Leavers Policy

– Access Control Policy

– Magnetic Media Policy

– Mobile Working Policy

– Password Policy

– Email Policy

– Acceptable Use Policy

As mentioned earlier, data protection closely aligns with cyber security. Below is a potential list of policies you may need to comply with legal standards. Again, this list is not exhaustive and may seem excessive for some businesses but provides insight into what may be required:

– Data Protection – Overarching Policy

– Data Protection Training

– Data Protection – Consent

– Consent Withdrawal

– Subject Access Request

– Data Protection Complaints

– Retention of Records

– Data Breach Notification (note there is an electronic version of this on the ICO website)

– Data Protection Impact Assessment Procedure

– Security & Control of data protection documentation

– Policy Management Review Procedure

– Internal Data Protection Breach Register

– Retention & Disposal of Records Register

– Data Protection Officer (DPO) Responsibilities

– Required records to be maintained

Most policies are readily available online; however, knowing what you truly need versus what you can do without can be challenging. Too often people download templates only to modify them superficially while hoping for satisfactory results.

Over time, our approach has evolved alongside legislative changes both here and in Europe as well as shifts in working practices. We’ve dedicated countless hours researching solutions tailored to meet requirements that adapt into systems suitable for all business types—not only affordable but also compliant with standards like Cyber Essentials if needed. Flexibility has become crucial due to new working paradigms; traditional security systems where everyone operates within secure boundaries protected by firewalls are outdated. Today’s protective systems must function seamlessly whether you’re at home, on the move, or in the office, and your policies must reflect that.

When we first engage with prospective clients, we offer a free trial to assess their needs, we frequently discover they lack clarity on what data they hold or its location. They might have a vague understanding—perhaps it’s stored on cloud servers, with laptops or desktops accessing data on the cloud. However, once we implement our software for discovery purposes, we often find numerous copies stored on laptops/desktops alongside cloud servers. How does this happen? Over time—and particularly with many adopting hybrid work models—employees log onto cloud services remotely using unstable internet connections; they download necessary files to work offline then neglect to delete them after re-uploading. Or they may share files via email without realising it leaves sensitive information attached to their email server.

Audit trails present another issue: If the ICO investigates, having clear records indicating who created/copied/deleted/forwarded data is crucial. Additionally, individuals are entitled to submit Data Subject Access Requests (DSARs), compelling you to disclose any held data regarding them—a legal obligation you cannot refuse. I know of a financial firm that took almost three weeks just to fulfil a DSAR request which diverted an employee from billing tasks during that time.

Our solution addresses today’s requirements effectively—it even includes an encryption system—all under one monthly fee. You can trial it at no cost; we’d be surprised if after seeing its capabilities along with our incredibly low managed service rates you didn’t want to keep it!