Cyber Security for Business in Ely

What cyber security for business means for a small or medium business

Cyber security is the combination of tools, settings, habits and monitoring that stops attackers accessing your systems, data or email. For a business running Windows PCs, laptops and Microsoft 365 - which is the environment we support - the threats are real and the controls are practical. None of this requires specialist knowledge from you; it requires a clear process carried out properly.

We support businesses in Ely and the wider area from our base in Bury St Edmunds. We work with Windows and Microsoft 365 environments only.

Step one - understanding what you currently have

Before any security work begins, it is worth establishing what is actually in place. A good starting point is a straightforward review of the current setup. This covers which Windows machines and laptops are on the network, what version of Windows is running on each, whether Microsoft 365 accounts have multi-factor authentication enabled, what endpoint protection software is installed and whether it is active, how backups are configured and when they were last tested, and who has administrative access to which systems.

Many businesses at this stage discover things they did not expect: a machine still running an unsupported Windows version, MFA switched off on key accounts, or a backup that has been silently failing for months. None of these are unusual findings, and identifying them is the point of the review. You cannot fix what you do not know about.

Step two - prioritising the gaps

Not every gap carries the same risk. Once the review is done, the gaps are ranked by the damage they could cause and the ease with which an attacker could exploit them. Multi-factor authentication missing from Microsoft 365 accounts is always near the top because a stolen password is all that stands between an attacker and your email, files and contacts. Unpatched Windows machines are similarly high priority because known vulnerabilities are actively and automatically scanned for by attackers.

Lower-priority items might include things like tightening email filtering settings or implementing a password manager - genuinely useful, but less urgent than closing the bigger gaps first. A clear priority order means the most important work gets done first, not the most visible or the easiest.

Step three - applying the essential controls

With priorities set, the core controls are put in place. For a business running Windows and Microsoft 365, this typically involves the following actions.

• Enabling MFA on every Microsoft 365 account. This is done in the Microsoft 365 admin centre and takes effect immediately. Staff will be prompted to set up their second factor on next login. The disruption is brief; the protection is substantial.
• Bringing Windows updates current on all machines. Where machines have fallen significantly behind, this can take time and may require restarts. It is worth doing out of busy hours where possible.
• Confirming endpoint protection is active and reporting correctly. Installing antivirus software is not enough. The management console needs to show all machines as protected, up to date and not reporting any active threats.
• Verifying backup configuration. Backups should run automatically, write to a location separate from the machine being backed up (so ransomware cannot encrypt both at once), and be tested by actually restoring a file - not just checking that the backup job completed without errors.
• Reviewing admin rights. Staff running day-to-day work under an administrator account is a common security risk. Malware that runs under an admin account can make system-wide changes; under a standard account it is far more limited. Where possible, staff should use standard accounts and admin credentials used only when explicitly needed.
• Checking Microsoft 365 sign-in logs for anything unusual. Before closing out the setup phase, a look at recent sign-in activity can reveal whether any account has already been accessed from an unexpected location or at an unusual time.

Step four - talking to staff

Technical controls cover a lot of ground, but the human element remains the most reliably exploited vulnerability in small business cyber security. Phishing emails - messages designed to look legitimate but crafted to steal passwords or trick someone into opening a malicious file - are the starting point for the majority of successful attacks on small businesses.

Staff do not need a lengthy training course. They need to know three things clearly: what a suspicious email looks like (urgency, unexpected requests, slightly wrong sender addresses or links that do not match the text), what to do when they receive one (do not click, report it), and who to contact if something already happened that they are not sure about. A brief, practical conversation is more effective than an hour of slides.

Step five - ongoing monitoring

Cyber security is not a one-time project. New vulnerabilities appear regularly, staff join and leave, and software versions change. What was properly configured six months ago may have drifted. Ongoing monitoring keeps the setup in the state it should be in.

In practice, this means Windows and Microsoft 365 updates applied consistently as they are released, endpoint protection alerts reviewed, backup jobs checked, and periodic review of who has access to what - particularly when staff leave the business. When someone leaves, their Microsoft 365 account should be disabled promptly and any shared passwords they knew should be changed.

Step six - knowing what to do when something goes wrong

Even well-protected businesses can face a security incident. Having a clear response plan - even a simple one - means the first minutes of an incident are not wasted on confusion. If a machine starts showing signs of ransomware, disconnect it from the network immediately to limit spread. If a Microsoft 365 account appears to have been accessed by someone else, change the password and check the account's sent items, forwarding rules and external access settings. Then contact your IT support team and let them guide the recovery.

Speed matters in an incident, but disconnecting an affected machine from the network before calling for help is always the right first step.

How our support contracts are structured

Our managed contracts include security monitoring and updates as standard. We offer two levels, both billed per computer per month (excluding VAT).

Business Essentials covers unlimited remote and phone support during office hours, with Windows updates, backups and security kept in check. On-site visits are charged at a £60 call-out fee plus labour. Prices: 1 computer £36, 2-3 computers £31.20 each, 4-9 computers £25.20 each, 10-17 computers £22.20 each, 18 or more computers £21.60 each.

Business Premium includes everything in Business Essentials with on-site labour and call-outs included. Prices: 1 computer £54, 2-3 computers £42 each, 4-6 computers £38.60 each, 7-9 computers £33.80 each, 10-12 computers £31.20 each, 13-15 computers £28.40 each, 16-19 computers £25.40 each, 20 or more computers £24.40 each.

If a monthly contract is not right for you, pre-paid time blocks are available: 4 hours for £312, 8 hours for £592, or 16 hours for £1,123, valid for up to six months. A managed email service is available separately.

Get in touch about cyber security for your Ely business

We work with businesses across the region from our base in Bury St Edmunds, covering Ely and neighbouring towns including Cambridge, Newmarket, Haverhill and beyond. Call us during office hours to talk through where your business currently stands and what the next practical steps look like.