Summary

• Many company leaders lack the familiarity with business systems to adequately assess cyber risks in their business

• There is no easy framework for IT

• It is easy for business leaders to assume if they use ‘big cloud hyperscalers’, they are compliant, backed up and safe

• Basic starter questions you can ask in your business to assess the level of security you have in place and more importantly, whether it is at the right level for your business

In a week that saw one of the world’s biggest IT disruptions that affected 8.5 million Windows devices, a new Cyber Security and Resilience Bill was announced in the UK.

A Bill is being introduced in response to the increasing frequency and severity of cyber-attacks which we’ve recently seen affect critical functions of the Ministry of Defence, the British Library, Royal Mail, and most recently, the NHS.

While I applaud the UK government taking action to mitigate this serious threat to our infrastructure, business leaders also need to take notice.

Are You Protected?

Many business leaders may not have the in-depth familiarity with technology systems to fully assess the cyber risks their organisations face. Often, asking the IT team, “Are we secure?” results in a reassuring response: “Yes, we’re covered with Cyber Essentials, ISOs, and we haven’t experienced any recent disruptions.” However, it’s challenging to dig deeper without a clear sense of what questions to ask—until an incident occurs. Much like house insurance, the true impact of a cyberattack only becomes clear after it happens.

One of the reasons is that there is no easy framework for IT. Take Health and Safety, with straightforward certificates and policies that can be easily adhered to and a regulator that strikes the fear of god into most businesses if not. There is no real equivalent for cybersecurity risk management and yet the risks to your business are just as critical to your customers, employees and shareholders.

Your Critical Systems

It is easy for business leaders to assume if they use ‘big cloud hyperscalers’, they are compliant, backed up and safe. Cloud services are a tool, and it’s down to you to make them safe.

The recent Microsoft IT outage was a big wake-up call. It demonstrated the impact of a global outage. If you have critical systems, you should consider that cloud-hosted systems could pose a heightened risk factor in your IT profile assessments.

I work for Claritas Solutions, a Wetherby-based IT company and the problem is, as we saw, when everyone else is doing something, everyone is impacted when things go wrong, with many systems now cloud-based services it is assumed are safe and impenetrable because everyone else is doing it.  The problem is, as we saw, when everyone else is doing something, everyone is impacted when things go wrong.

At Claritas Solutions, we operate UK-based data centres, ensuring that your data and traffic never leave the country. This matters because, unlike hyperscale providers who may route data offshore, we prioritise UK data sovereignty—ideal for businesses with legal or regulatory requirements to keep systems and data within UK borders.

Starter Questions

Here are some basic starter questions you can ask in your business to assess the level of security you have in place and more importantly, whether it is at the right level for your business.

They are:

1. How do you manage IT risk?

2. How do you protect your business against cyber-attacks and how often is it tested?

3. How do you detect incidents once they’ve happened and how are they reported to you?

4. How do you get yourself back up and running afterwards?

5. What are your most valuable assets and data? – and…How do you secure them?

6. What would be the real impact to your business (financial/operational) if you were victim to a cyber-attack?

7. Are your staff actively engaged and trained on Cyber Security best practices?

Knowing these answers may start to help you understand your business’s current risk exposure. Having a single provider for core critical systems is always a risky strategy that needs careful consideration, with built-in robust mitigation capability in the event of failure.

Understanding IT Risks

Take time to seek a deeper understanding of IT risks in your business and responsibility for them, asking these four questions today to help prevent future cyber attacks.

Feel free to reach out and have a chat with the team.