What the latest cyber security guidance means for your business
Security guidance is written for auditors, which is why most businesses read the summary and file it. That is a mistake, but so is treating every recommendation as equally urgent. Here is what actually changes for a business of fifty to five hundred people.
Multi-factor authentication is now the baseline, not the upgrade
The direction of travel is clear: single-factor access to anything containing customer data is treated as a control failure rather than a risk to be accepted. If you have exceptions carved out for senior staff or for legacy systems, those exceptions are the finding.
The practical move is to inventory every system that touches customer or financial data, and mark which ones support modern authentication. The ones that do not are your roadmap.
Supplier risk is your risk
You are increasingly expected to demonstrate that you know what your suppliers do with your data, not merely that you have a contract with them. For most businesses this means maintaining a current list of processors, what each one holds, and where it sits.
This is tedious rather than difficult, and it is far easier to build once and maintain than to reconstruct under pressure.
Logging you cannot search is not logging
Retention requirements are meaningless if nobody can answer “who accessed this record, and when” inside a working day. Centralised, searchable logs with a defined retention period are the practical bar.
Incident response needs a rehearsal, not a document
The plan in the folder is not the thing being assessed. What matters is whether the people named in it know they are named, and whether the contact details are current. A ninety-minute tabletop exercise once a year closes most of the gap.
Staff training has to be specific
Generic awareness training has poor measured outcomes. Training built around the attacks your sector actually sees — invoice fraud in construction, credential phishing in professional services — performs considerably better.
If you only do one thing this quarter: complete the authentication inventory. It is the control with the widest blast radius, and it makes every subsequent conversation easier.