10 Questions Your Business Should Ask Itself About Your IT & Cyber Security

From communicating with customers and processing payments to accessing documents, managing employees and delivering the goods/services you offer, almost every business now relies on IT and Cyber Security throughout the working day (and beyond). 

The challenge is that it can be easy to assume everything is working as it should simply because nothing has gone noticeably wrong recently. 

The UK Government’s latest Cyber Security Breaches Survey found that 43% of UK businesses identified a cyber security breach or attack during the previous 12 months. Therefore, Cyber security should not simply be viewed as something for the IT department to worry about, it should sit at the core of your business operations. Business owners and senior leaders should understand whether their technology is secure, reliable and capable of supporting where the business is heading. 

But how do you know your IT & Cyber Security are working for you? 

Many business owners may not know the right questions to ask about your business IT and Cyber Security. As such, we have provided these easy 10 questions you should ask yourself. 

  

1. “Do we actually know all of the Devices, Software and Cloud Services we use?”

How can you manage or secure technology that you do not know exists? 

As businesses grow, new laptops, mobile devices, IoT devices (manufacturing terminals, Raspberry Pi’s or other connected devices), software subscriptions and cloud services can quickly become part of the business. Without effective management, businesses can lose visibility over the technology they use (or don’t use). People can become blind to a “box that has always been sitting there in the corner”, but do people understand what some of these devices really do? 

Proper asset management provides a clear understanding of all of the technology across your business. What is it? What are it’s technical specifications? Where is it? What is it used for? Who has access to it? Is it still needed? When should we replace it? By understanding and recording all of this information in an asset management system it helps your business to make informed decisions around security, licensing, purchasing and future investment. 

The latest Cyber Essentials requirements specifically highlight effective asset management as a core security function that can help businesses meet all five Cyber Essentials controls. 

 

2. “Is our technology helping our business, or holding it back?”

If it is holding it back… realistically, you probably don’t have the right solutions in place for your business. Your business IT and Cyber Security should make it easier for your team to do their jobs, not hinder their operations. 

Slow devices, unreliable connectivity, outdated systems, unnecessary manual processes and poorly integrated software can gradually become accepted as “part of how things work”. Whilst individually they may appear relatively minor, across an entire business… they can result in a significant amount of lost time that could have been prevented. 

Your IT strategy should consider more than if the tools and systems you have in place are technically working. It should look at if your technology is improving productivity & efficiency, supporting your people and giving the business the flexibility it needs to grow and scale effectively. 

Our vCIO service helps businesses to understand if there solutions are working for them and identify where technology could be improved, consolidated or better aligned with your wider business growth strategy. 

 

3. “Are our devices and applications kept up to date?”

Software updates are not simply about just adding new features. They frequently contain security fixes for vulnerabilities discovered within operating systems, applications and devices. If those updates are not installed, attackers may be able to exploit vulnerabilities that are already known and, in many cases, already have fixes available. 

The National Cyber Security Centre recommends ensuring desktops, laptops, mobile devices, third-party applications, firmware and internet-facing services are appropriately patched, with Patch Management forming an essential part of the Cyber Essentials Certification process. 

Effective Endpoint Management and Patch Management can provide greater visibility over this process, helping businesses identify devices that are out of date, unsupported or not meeting required security standards. 

 

4. “Do my employees only have access to what they actually need?”

Employees may change roles, move departments, temporarily require additional permissions for a project or even leave the business entirely. Unless user accounts and permissions are regularly reviewed, people can gradually gain access to systems and information they no longer require, potentially even leaving access to former employee accounts active long after they have left the business. 

The same applies to administrative accounts. Employees should not routinely have administrator-level access simply because “it’s convenient”. 

Strong Identity and Access Management (IAM) ensures that administrative access is provided temporarily based on genuine business requirements, while Multi-Factor Authentication (MFA) adds an additional and important layer of protection around access to your business accounts. This is particularly important when protecting sensitive business information, financial systems and cloud environments such as Microsoft 365. 

 

5. “How would we know if somebody was trying to attack us?”

Businesses are increasingly needing higher visibility over what is happening across their devices, identities, email environments and networks so suspicious behaviour can be identified and acted upon quickly. 

The National Cyber Security Centre recommends businesses understand what security logging is in place, where those logs are stored and whether they are actively being monitored. 

Technologies such as Endpoint Detection and Response, Security information and Event Management (SIEM), Security Operations Centre monitoring, Software as a Service Alerts, identity protection and other managed cyber security services can help identify and act upon suspicious activity that might otherwise go unnoticed. 

The important question is not simply whether security software is installed. It is whether somebody is monitoring unusual, suspicious and malicious activity that could be the sign of a potential cyber threat. 

 

6. “If we lost access to our systems or data tomorrow, how quickly could we recover?”

Having a backup is one thing… but being able to recover your business operations following a cyber attack or natural disaster is another thing entirely. Businesses need to understand exactly what is being backed up, how often backups are completed, where those backups are stored, if the backups are encrypted/secured and ultimately how long recovery would realistically take. 

Business backups and disaster recovery plans should be tested regularly. The NCSC recommends regularly confirming that backups are running correctly, ensuring that there are no errors, checking that off-site backups are managed and monitored correctly, and carrying out test restorations so businesses understand how recovery would work (and how long it would take) if it were genuinely required. 

A strong Backup and Disaster Recovery strategy should be built around the needs of the business. If a critical system suddenly became unavailable, you should already understand how long the business could operate without it and how quickly services could be restored. 

 

7. “Could our employees recognise a cyber attack?”

Your employees are the weakest link in your cyber defences.  

Let that sink in. Whilst technology plays an essential part in preventing cyber threats, forming a “human shield” remains an important part of your defence. 88% of businesses who experienced a cyber attack during 2025 said that phishing was the most common entry point to their business. Firstly, showcasing that employees are not able to spot modern advanced phishing attacks. But secondly, that businesses also do not have the right Email Threat Protection in place to protect themselves from modern advanced phishing attacks. 

Cyber Security Awareness Training can help employees recognise suspicious emails, unexpected login requests, fraudulent websites, impersonation attempts and other common techniques used by attackers. 

However, it is important to remember that Cyber Security Awareness Training should not simply be something employees complete once each year. Regular education, testing and realistic phishing simulations can ensure that keep cyber security visible in your business, encourage employees to question something when it does not look right and stay up to date with new and modern threats when they are uncovered. 

 

8. “Are we meeting the cyber security standards or regulations expected of our business?”

Cyber security requirements increasingly come from more than internal IT policies. 

Customers, suppliers, insurers and tender processes may ask businesses to demonstrate how they protect information and manage cyber risk. 

Cyber Essentials (and Cyber Essentials Plus) provide a Government-backed baseline for cyber security which is recommended for businesses of all sizes across all industries as a minimum standard which they should abide by. It focuses on five technical control areas designed to help protect against common internet-based threats. 

TwentyFour can support businesses throughout this process through ongoing Compliance Management, as well as end-to-end certification thanks to our being an official IASME licensed and accredited Cyber Essentials and Cyber Essentials Plus Certification Body. 

Maintaining compliance throughout the year can also make certification and renewal significantly easier than trying to prepare everything immediately before an assessment. 

Depending on your business and industry you may also need to consider ISO 27001 or other contractual and regulatory requirements. Speak to us to find out how our Compliance Management service can support your business to become certified. 

 

9. “What would we would do if something went wrong?”

When a serious IT outage, natural disaster or cyber incident happens, the middle of the incident is not the ideal time to decide who should do what. 

Businesses should have a clear plan covering who needs to be contacted, what actions need to be taken, who has authority to make decisions, how employees will communicate if normal systems are unavailable and how critical services will be restored. 

Yet the Government’s 2025/2026 Cyber Security Breaches Survey found that only 25% of businesses had a formal incident response plan in place to help them recover. 

An Incident Response, and by extension a Business Continuity, plan does not need to predict every possible scenario. It should provide a clear framework that allows your business to react quickly, make informed decisions, and support you to quickly restore normal operations when something unexpected happens. 

 

10. “Does our IT & Cyber Security strategy work with our business growth strategy?”

One of the most important questions is also one of the easiest to overlook. 

What will your business look like in 12 months, three years or five years, and will your technology be ready for it? 

Growth may mean additional employees, new offices, cloud migrations, acquisitions, new compliance requirements, greater use of AI or changes to the way your employees work. Waiting until technology becomes a problem usually means decisions have to be made quickly and reactively. 

A structured IT roadmap allows businesses to plan investment, replace ageing technology at the right time, understand future cyber security requirements and budget more effectively. 

TwentyFour’s vCIO guidance provides businesses with ongoing strategic support, helping align technology decisions with wider commercial objectives rather than treating IT as a series of individual purchases or problems. 

 

How many of these questions could your business confidently answer? 

You do not need to be an IT or cyber security expert to ask the right questions. 

The National Cyber Security Centre itself highlights that business leaders do not need deep technical knowledge, but they should understand the technical and cyber risks well enough to evaluate how prepared their business is and ensure security supports wider business objectives. 

If several of these questions are difficult to answer, that does not necessarily mean your business has poor IT or cyber security. It may simply mean greater visibility, structure and strategic oversight are needed. 

TwentyFour supports businesses with Fully or Co-Managed IT Services, Managed Cyber Security, Compliance Management, Cyber Essentials and Cyber Essentials Plus Certification, alongside ongoing vCIO board level technical guidance to help your business grow and succeed through its technology. 

Together, these services can provide a clearer understanding of where your business stands today, how you can improve and how technology can support where your business to achieve its goals. 

If you want to speak with TwentyFour about any of these topics, or any other technical advice, contact us to speak with one of our experts. 

Enquire Here