Cyber Security for Business in Burwell

What cyber security for business means in practice

For a small business running Windows PCs, laptops and Microsoft 365, cyber security is a set of practical controls: managed software updates, properly configured accounts with multi-factor authentication, email filtering, monitored backups and clear rules about who can access what. These controls are not a one-time setup. They need attention over time, because the threats change, your team changes, and your software changes.

A Microsoft 365 tenant that was set up securely three years ago may now have dormant user accounts, outdated external sharing permissions, or app integrations that were added without proper review. A Windows PC that was patched regularly may have drifted if someone changed update settings or the monitoring lapsed. Security is not a state you achieve - it is something you maintain.

Why aftercare matters more than the initial setup

Most small business cyber incidents are not caused by sophisticated attacks that bypass well-maintained defences. They happen because something slipped: a patch was not applied, a leaver's account was not disabled, a backup stopped running and nobody noticed for six months. The controls were right once - they just were not kept that way.

This is why ongoing monitoring and a clear maintenance routine are more valuable than any one-off configuration exercise. Knowing that your backups ran last night, that Windows devices received this month's patches and that no unusual login activity has been flagged is what actually protects your business day to day.

Simple aftercare habits that prevent the next problem

Whether you manage your own IT or work with a provider, the following maintenance habits are what separate businesses that stay protected from those that do not.

Check that backups are actually running

A backup that is not monitored is not a backup - it is an assumption. Backup jobs fail silently more often than people expect: a storage limit is hit, a credential expires, or a software update breaks the job. Someone in your business should be checking backup status at least weekly, or your IT provider should be doing it on your behalf and flagging exceptions. If you cannot tell us when your backup last succeeded, that is the first thing to fix.

Remove or disable accounts for people who have left

Dormant Microsoft 365 accounts belonging to former staff are a genuine security risk. They often still have access to shared mailboxes, SharePoint sites and Teams channels. A common attacker tactic is to use old credentials - obtained from a data breach on another service - to try logging into business accounts where passwords have been reused. Disabling or deleting leaver accounts promptly, and revoking active sessions at the point of departure, closes that door.

Keep Windows devices updated

Microsoft releases security patches on the second Tuesday of every month (widely known as Patch Tuesday) and sometimes releases emergency patches outside that cycle for critical vulnerabilities. Devices that are not picking up these updates are running with known, publicly disclosed vulnerabilities. For managed devices this should be handled automatically - but it is worth confirming that updates are applying successfully rather than being deferred indefinitely.

Review who has admin rights

Admin accounts on Windows PCs should be used only when administrative tasks genuinely require them. Staff should use standard user accounts for day-to-day work. If malware runs under an admin account, it has far greater ability to cause damage or spread across the network than if it runs under a standard account. Periodically reviewing who has local admin rights and removing it where it is not needed is a practical, low-cost security improvement.

Check Microsoft 365 admin settings after updates

Microsoft regularly updates the 365 admin centre and sometimes changes default settings or introduces new features with sharing or access implications. It is worth reviewing your tenant's security settings every few months - particularly external sharing on SharePoint and OneDrive, email forwarding rules (attackers often set these to silently copy emails to an external address), and which third-party apps have been granted access to your tenant.

Test a restore, not just the backup

A backup is only valuable if data can actually be restored from it in a reasonable time. Periodically testing a restore - recovering a single file or folder to confirm the process works - is the only way to know your backup is genuinely usable. Many businesses discover their backup was corrupt or incomplete only when they try to recover from an incident.

Keep a simple record of your IT assets

Knowing which machines you have, what operating system each runs, when each was last updated and who uses it sounds basic - but many small businesses do not have this information to hand. Without it, a security review or incident response takes longer and costs more. A simple spreadsheet kept up to date is enough.

When to bring in outside help

Some aftercare tasks are straightforward enough for an office manager to handle. Others - particularly reviewing Microsoft 365 security settings, investigating unusual account activity or confirming that monitoring is correctly configured - benefit from specialist input. If your IT is managed externally, your provider should be handling the monitoring and patching automatically and reporting exceptions to you. If you are not receiving regular confirmation that these tasks are being done, ask for it explicitly.

A cyber security review does not need to be a major project. For most small businesses, it is a focused exercise that takes a few hours and produces a clear list of what needs attention and what is already in good shape.

What our service covers

We support Windows PCs, laptops and Microsoft 365 - we do not work with Apple Mac environments. Our managed service handles the ongoing security maintenance that small businesses need but often cannot resource internally:

• Continuous monitoring of Windows devices and security status
• Managed patching - Windows updates applied and confirmed
• Backup monitoring and exception reporting
• Microsoft 365 configuration management and security reviews
• Multi-factor authentication setup and enforcement
• Account management support - leavers, new starters, permission reviews
• Email filtering and threat detection
• Managed email service available

Pricing

Contracts are priced per computer per month (all prices exclude VAT).

Business Essentials - on-site visits charged separately at £60 call-out plus labour:

• 1 computer: £36/month
• 2 to 3 computers: £31.20 each/month
• 4 to 9 computers: £25.20 each/month
• 10 to 17 computers: £22.20 each/month
• 18 or more computers: £21.60 each/month

Business Premium:

• 1 computer: £54/month
• 2 to 3 computers: £42 each/month
• 4 to 6 computers: £38.60 each/month
• 7 to 9 computers: £33.80 each/month
• 10 to 12 computers: £31.20 each/month
• 13 to 15 computers: £28.40 each/month
• 16 to 19 computers: £25.40 each/month
• 20 or more computers: £24.40 each/month

Serving Burwell and nearby businesses from Bury St Edmunds

We have supported businesses from our Bury St Edmunds base since 1990, working with firms in Burwell and the surrounding area including Newmarket, Ely, Soham and further across the region. Call us to discuss your current setup and what a sensible ongoing maintenance approach would look like for your business.