Small business and sole traders
Nobody wakes up wanting a cyber policy
Something landed. A customer sent a security questionnaire. An insurer asked a question at renewal you could not answer. A tender wants Cyber Essentials. This page is arranged by what has just arrived on your desk, rather than by what we would like to sell you.
Before anything else
Most of what a small business needs here is free
There is a self-check, a set of policy templates, awareness posters you can print, and twelve questions to work through before you switch on Copilot. None of it is gated, and none of it asks for your email. For a sole trader, or a firm of ten with sensible habits, that is frequently the entire job.
We sell to organisations that have run out of things they can sensibly do themselves. For a small business that point arrives later than most consultancies will tell you.
What has just landed on your desk?
A customer sent us a security questionnaire
Usually forty to a hundred questions, often written for an organisation twenty times your size, with a deadline attached to a contract you want to keep.
- Answer honestly. An invented answer becomes a contractual warranty
- "Not applicable, and here is why" is a legitimate answer
- Keep every answer you give — the next questionnaire asks eighty per cent of the same things
Start with the vendor review policy template and the sample due diligence report, both free.
A tender or customer wants Cyber Essentials
It is a self-assessed questionnaire covering five technical controls, marked by a licensed certification body. Fees run from £320 + VAT. The question set changed in April 2026 and got materially stricter.
Our insurer is asking questions at renewal
Insurers now ask about multi-factor authentication, backups and privileged access in enough detail that a vague answer costs you cover or premium.
Cyber-insurance application companion — £95 + VAT
We want to use AI without causing a problem
Copilot respects your permissions perfectly, which is exactly why it surfaces whatever was already over-shared. The free tier carries the opposite risk: staff uploading files by hand.
Twelve free readiness questions · which licence does what · free AI use policy
Something has gone wrong, today
The first hour decides how much of the next fortnight you spend on it. What to do, in order, before you know what you are dealing with.
Nothing. We would just like to be sensibly secure
The rarest and most welcome reason to be here. Start with the self-check — it takes a few minutes, nothing leaves your browser, and there is no form at the end.
Where do you stand? · free posters · the guide for staff and families
The short version
What a small business actually needs
- Multi-factor authentication on everything, especially email. This single control removes more risk than everything below it combined
- Backups you have actually restored from, at least once, on purpose
- Software that updates itself, on every device including the phones
- One named person who decides — not a committee, and not nobody
- Something to follow when it goes wrong, written down while everyone is calm
- Cyber Essentials, if and only if somebody is asking you for it
What a business of your size almost certainly does not need: a full information security management system, a data protection officer, or a two-hundred-page policy library that nobody will read and no auditor asked for.
If a supplier is selling you an ISMS and you have eleven staff, ask them which customer requirement it satisfies. Then ask to see that requirement.
Being straight about it
When it is worth paying somebody
When the scope is genuinely unclear. Several legal entities, contractors on their own laptops, a development environment, staff in another country. Scope is where small organisations most often get certification wrong, and it is not obvious from the outside.
When you are the supplier and your customer is the one asking. A contract is riding on the answer, and the cost of getting it wrong is not the fee — it is the account.
When somebody needs to be independent. If we help you build it, we will not then tell your customer we independently assessed it. Those are two different jobs and we will say which one we did.
If you send us a questionnaire and the answer is that you can handle it yourself, that is what we will tell you.