Blog

<h2>Every business owner hits this point sooner or later: the IT bill lands, and the first instinct is to start cutting. Fair enough, but most of the cutting we see business owners do falls into one of two traps. Either it's cosmetic, like cancelling some small subscription that wasn't costing much to begin with, or it's genuinely risky, like switching off backup or security tools because "we haven't needed them lately." Neither actually fixes anything.</h2>&nbsp;The money worth finding is usually somewhere much less dramatic: licences nobody's using, tools that overlap with each other, hardware bought (or kept) at the wrong moment, and subscriptions nobody in the business signed off on. None of that touches your security or your team's ability to do their job. You just have to know where to look. Here's where we'd start.&nbsp; 1. Check your software licences every few months, not once a year&nbsp;Most businesses only look at this properly once a year, if that. By the time anyone checks, you've often been paying for a full year of seats nobody's touched since spring.&nbsp;It's always the same story. Someone leaves, and their Microsoft 365 licence quietly keeps renewing. A team trials a project management tool, decides against it, and forgets to cancel before the free period ends. Two people on different teams sign up for the same tool independently because neither knew the other already had it sorted. Nobody's being careless herem it's just what happens when licensing isn't someone's actual job.&nbsp;The fix is boring but it works: a quick look every quarter at who has access to what, and whether they're still using it. For a small team that's a fifteen-minute job. Once you're bigger, it's worth just giving it to someone by name — otherwise it becomes nobody's responsibility, and that's exactly how the waste creeps back in.&nbsp; 2. Stop giving everyone the same licence tier&nbsp;A lot of businesses put every employee on the same Microsoft 365 plan because it's simpler to manage. It is simpler. It's also usually more expensive than it needs to be.&nbsp;Think about it: a top-tier plan with the full Office suite and Teams Phone makes total sense for someone who lives in Excel and takes calls all day. It's overkill for someone who checks email and a shared calendar. Multiply that gap across fifteen or twenty people and you're looking at a real difference in the monthly bill ,without anyone losing anything they were actually using. This one takes a bit more thought than "everyone gets the same plan" you have to actually look at what each role needs. But it's usually the single biggest, and least painful, saving on the list.3. Stop paying four vendors to do the job of oneIt's easy to end up with antivirus from one place, email filtering from another, backup somewhere else, and device management from a fourth, each one picked at a different time, for a different reason, by whoever was dealing with it that month. Each decision made sense on its own. Put together, it often costs more than a single joined-up stack would.There's a cost hiding here beyond the invoices too. When something goes wrong, more vendors means more time spent working out whose problem it actually is. A security alert that touches both the antivirus and the email filter turns into two separate support calls instead of one, because the two tools don't talk to each other and neither vendor wants to own it.We're not saying chase the cheapest all-in-one option going, sometimes a specialist tool is worth the extra cost. But if you're juggling four or five overlapping products, it's worth asking whether a smaller, better-connected setup would be both cheaper and less of a headache.4. Get the timing right on hardwareHardware costs go wrong in both directions. Buy machines that are overpowered for what people actually do with them, and you're paying for headroom nobody uses. Hang onto ageing laptops for five or six years, and you pay for it a different way,more support calls, slower staff, machines limping along on patches they were never really built for.The businesses that get this right treat hardware as something you plan for, not something you react to. Replacing a portion of the fleet each year on a rolling three-to-four-year cycle keeps the spend predictable and means you're never stuck making a panicked, expensive decision the day someone's five-year-old laptop finally gives up mid-project.5. Find the software nobody told you aboutEvery business has some version of "shadow IT" a free trial that quietly turned into a paid plan, a tool someone signed up for on a personal card and expensed later, an app someone installed months ago to solve a one-off problem and never mentioned again.It costs money because nobody's checking if it's still needed, or whether you're now paying for the same thing twice under two different names. But it's also a security gap that's easy to miss: if IT doesn't know something exists, it isn't being patched, isn't being backed up, and isn't part of any review. It's just sitting there, outside every safety net the rest of your systems have, often holding real company data.You don't need anything heavy-handed to fix this. A simple list of approved tools, a quick chat before anyone signs up for something new, and the occasional look through what's being expensed usually closes the gap,and tends to turn up a saving or two almost immediately. None of this needs a bigger budget or a bigger IT team. It just needs someone actually looking at where the current spend is going — because in most small businesses, the waste isn't hiding somewhere exotic. It's sitting in old licences, mismatched plans, overlapping tools, hardware bought at the wrong time, and subscriptions nobody remembers signing up for.If you want a second pair of eyes on where your business might be quietly overpaying, we're always happy to have that conversation.Check how we can help you with our <a href="https://www.blackgate-tech.co.uk/managed-it" target="_blank" rel="noopener" data-mce-href="https://www.blackgate-tech.co.uk/managed-it">managed it services</a>

5 Ways to cut IT costs without cutting corners

Most business owners assume their biggest IT risk is a sophisticated hacker targeting their systems from the outside. The reality is far less dramatic and far more preventable.According to the UK Government's Cyber Security Breaches Survey published in 2026, 43% of UK businesses experienced a cyber breach or attack in the past twelve months. The most common attack vector wasn't a zero-day exploit or a nation-state actor. It was an email. Specifically, a phishing email, one that looked legitimate enough to trick someone into clicking a link or handing over their login credentials.The single most common way into a UK business in 2026 is a message your employee didn't think twice about opening.The numbers that should concern every London SMBEmployees at small businesses with under 50 staff receive more targeted malicious emails than any other size category, one in every 323 emails is malicious. The median time between receiving a phishing email and clicking the link is under 60 seconds. And 20% of people who click also go on to enter their credentials.In other words, by the time anyone realises something is wrong, it's often already too late.What makes this particularly frustrating is that the solution isn't complicated or expensive. It just isn't being done. Only 9% of small businesses run quarterly security awareness training. Yet employees who receive consistent, simulation-based training are seven times less likely to fall for a phishing attack.Seven times. For a few pounds per employee per month.Shadow AI is making this worseThere's a newer dimension to this problem that barely existed two years ago. Around a quarter of UK organisations using, adopting, or considering AI have no security practices in place to manage the associated risks.That means employees are using AI tools, pasting client data into ChatGPT, uploading contracts to summarisation tools, asking AI assistants questions they'd never send to an external email address, without any governance or awareness of where that data is going. It's not malicious. It's just habit. But the consequences can be significant, particularly for businesses handling client information under GDPR.What good actually looks likeThe businesses that handle this well aren't necessarily spending more. They're doing a few specific things consistently:Regular phishing simulations. Not a one-off training video that gets clicked through in ten minutes. Actual simulated phishing campaigns sent to staff throughout the year, with targeted follow-up for anyone who falls for them. The goal isn't to embarrass anyone, it's to build the instinct to pause before clicking.Multi-factor authentication enforced everywhere. MFA doesn't stop phishing, but it does stop an attacker from being able to use stolen credentials to log in. Even if an employee hands over their password, MFA means the attacker still can't get in without the second factor. It's one of the single highest-impact controls available and it costs almost nothing to implement.A clear AI usage policy. Not a 40-page document nobody reads. A simple, practical set of guidelines that tells staff which tools are approved, what data should never be pasted into an external tool, and what to do if they're unsure. Most employees want to do the right thing, they just haven't been told what that looks like.Email filtering and DMARC. Sixty-eight percent of UK SMBs don't have DMARC configured, which means attackers can send emails that appear to come from your own domain. Proper email security stops a significant proportion of phishing emails before they ever reach your team's inbox.The uncomfortable truthBoard-level responsibility for cyber security in UK businesses has risen to 31% — which means 69% of businesses still have nobody at a senior level meaningfully involved in cyber security decisions. For a small business where the "board" is the owner-director, that gap is even larger.This isn't about blame. It's about the fact that cyber risk is now an operational and financial risk, not just an IT problem. A single successful phishing attack can result in a data breach, regulatory consequences under GDPR, reputational damage with clients, and in the worst cases, ransomware that takes your business offline entirely.The businesses that avoid these outcomes aren't the ones with the biggest IT budgets. They're the ones that treat their people as part of the security solution, not just a potential weak point.At Blackgate Tech, we help London SMBs put the right controls in place — from phishing simulations and security awareness training to MFA enforcement and email security. If you'd like to understand where your business currently stands, we offer a free IT security review with no obligation.Staff training is one part of the picture, see our <a data-mce-href="https://blackgate-tech.co.uk/managed-it" href="https://blackgate-tech.co.uk/managed-it" target="_blank" rel="noopener">Managed IT Support</a> and <a data-mce-href="https://www.blackgate-tech.co.uk/cybersecurity-services" href="https://www.blackgate-tech.co.uk/cybersecurity-services">Cybersecurity Services</a> for the rest.info@blackgate-tech.co.uk

Why your employees are still your biggest IT risk in 2026 (And what to do about it)

If you are weighing up Microsoft 365 plans for your business and wondering whether to pay the extra for Business Premium ( or whether Intune specifically is worth the cost ) this article gives you a straight answer.The short version: for most small businesses in the UK handling client data, employee devices, or remote workers, Intune is worth it. The longer answer depends on what you are already paying for and what your biggest risks actually are.&nbsp; What is Microsoft Intune? Intune is Microsoft's cloud-based device management platform. It lets you control how every laptop, phone, and tablet connecting to your business data is configured, secured, and monitored, from one central dashboard, without needing to be in the same room as the device.In practical terms, it means you can:Enforce encryption and strong PINs on every device accessing company email Push software and security updates to all devices automatically Wipe a lost or stolen device remotely, including personal phones with a work profile Block access to company data from any device that does not meet your security policy Set up a new employee's laptop automatically, without an IT engineer on site It works across Windows, macOS, iOS, and Android. And it integrates natively with Microsoft 365, Entra ID, and Defender for Business.&nbsp; How much does Intune cost for a small business in the UK? This is where many small business owners are surprised: if you are already on Microsoft 365 Business Premium, you already have Intune included.Microsoft 365 Business Premium costs £17.60 per user per month (excluding VAT, as of mid-2026). It includes the full Office suite, Exchange email, Teams, SharePoint, and a full security stack: Intune, Defender for Business, and Entra ID Premium P1.Microsoft 365 Business Standard, by contrast, costs £9.40 per user per month and does not include Intune, Defender for Business, or any device management capability at all.So the real question for most small businesses is not "should I pay for Intune?" but "should I be on Business Premium rather than Business Standard?" For a team of ten, that difference is £82/month. Whether that is worth it depends on what Intune replaces or prevents.If you need Intune standalone without a Business Premium licence, it starts at around $4/user/month, but you would also need Entra ID Premium P1 separately for conditional access, which is where most of the real security value sits.&nbsp; What does Intune actually do day-to-day for a small business? Device enrolment and setup With Intune and Windows Autopilot, a new employee can receive a laptop directly from the supplier, sign in with their work account, and have the device automatically configured with your company's apps, policies, and security settings. No IT engineer needs to touch it first. For a small business without a dedicated IT team, this alone saves significant time with each new hire.Remote wipe If a staff member loses their phone or laptop (or leaves the business ) you can immediately remove all company data from the device. On personal phones using a work profile, Intune removes only the business data and leaves personal content untouched. This is not a nice-to-have for any business handling client information; it is a basic control your insurer and clients increasingly expect.Conditional access Working with Entra ID Premium P1 (included in Business Premium), Intune lets you set rules like: "only allow access to company email and files from devices that are enrolled, encrypted, and compliant with our security policy." A device that has not been patched, or a personal laptop that has never been enrolled, gets blocked. This is one of the most effective controls against account takeover and data breach.Automated patching Intune manages Windows Update policies centrally, so you can control when updates are pushed and ensure no device in your business is running months behind on patches. Unpatched devices are one of the most common entry points for ransomware.App management on personal devices (BYOD) Many small businesses have staff checking work email on personal phones. Without Intune, you have no control over what happens to that data. With Intune's mobile application management, you can apply policies to the work apps on a personal phone — requiring a PIN, blocking copy-paste to personal apps, and wiping work data if needed — without touching anything personal on the device.&nbsp; When is Intune not worth it? If your team is two or three people, everyone uses company-owned devices, and your work does not involve sensitive client data, the overhead of configuring and managing Intune may not be justified at this stage. Microsoft 365 Business Standard is likely sufficient.Similarly, if you are in a very early stage and cost is the overriding concern, Business Standard gets you functional email, Office apps, and Teams without the security stack.But if any of the following apply, Business Premium with Intune is worth the extra cost:You have remote or hybrid staff accessing company data from home devices Staff use personal phones for work email You handle client data in healthcare, legal, finance, or recruitment You are pursuing or considering Cyber Essentials certification You have had staff turnover and are not confident devices were properly cleared Your cyber insurance renewal has started asking about device management controls &nbsp; Cyber Essentials and Intune Cyber Essentials is the UK government-backed certification that confirms your business has the five core technical controls in place. It is increasingly required by clients in regulated sectors and referenced by cyber insurers.One of those five controls is secure device configuration. Intune is the most straightforward way to demonstrate and enforce that control across a mixed device estate. Microsoft 365 Business Premium includes everything the NCSC's Cyber Essentials scheme expects from a Microsoft 365 environment when configured correctly.&nbsp; The bottom line For most UK small businesses handling any kind of sensitive data (client records, financial information, personal data ) Microsoft 365 Business Premium is the right foundation, and Intune is a core part of why. It costs £8.20/user/month more than Business Standard, and in exchange you get device management, endpoint protection, and identity controls that would cost significantly more to assemble from separate tools.The main caveat is that Intune needs to be configured properly to deliver its value. Out of the box, enrolling devices and setting meaningful policies takes time and some technical knowledge. That is where a managed IT provider adds real value, handling the setup, ongoing management, and ensuring your configuration actually meets the standard your business needs.At Blackgate Tech, we deploy and manage Microsoft 365 Business Premium for small businesses across London and UK, including Intune configuration, Defender setup, and Cyber Essentials alignment. If you are not sure whether your current Microsoft 365 setup is properly configured, we offer a no-obligation review.Get in touch: info@blackgate-tech.co.uk&nbsp;

Is Microsoft Intune worth it for a small company?

The short answer is yes, and in the UK, it is no longer really a choice. The country's traditional copper phone network, the PSTN, is being switched off by BT Openreach in January 2027. Openreach has already stopped installing new landlines. If your small business is still running on a traditional phone line, you need a plan before it stops working entirely.But even setting the deadline aside, VoIP wins on almost every metric that matters to a small business: cost, features, flexibility, and call quality. Here is what you need to know.&nbsp; What is VoIP? VoIP (Voice over Internet Protocol) is a phone system that runs over your internet connection rather than a copper wire. Instead of a physical line from the exchange to your premises, calls are routed digitally through the cloud. You can use desk phones, a laptop app, or a mobile app, or all three at once.Hosted VoIP systems (sometimes called cloud phone systems) are managed by a provider. You pay a monthly per-user fee and get a fully featured phone system with no hardware investment and no on-site PBX to maintain.&nbsp; The PSTN switch-off: why this affects every UK business BT Openreach is retiring the Public Switched Telephone Network (the copper infrastructure that has carried landline calls since the Victorian era) by January 2027. ISDN lines are included. After that date, traditional landlines simply stop working.If your business phone number is on a PSTN or ISDN line, you will lose it unless you migrate to a digital alternative. The good news: your existing number can be ported to a VoIP provider in 7–14 days with no downtime if you plan ahead. Leaving it until late 2026 risks being caught in a rush of last-minute migrations.&nbsp; VoIP vs landline: how they compare for a small business Cost Traditional landlines carry line rental, per-minute call charges, and in many cases the cost of a PBX system and physical cabling. VoIP runs over your existing broadband with little or no new hardware. Plans typically bundle unlimited UK minutes and significantly cheaper international rates.Most businesses switching to VoIP save 40–70% on their phone bills. For a small team, that is a meaningful number each month.Features This is where the gap is most obvious. A traditional landline gives you a phone number and basic call handling. A hosted VoIP system gives you:Auto-attendant (virtual receptionist) Call recording and transcription Ring groups and hunt lines Voicemail to email Mobile and desktop apps so staff can take calls anywhere Call analytics and reporting CRM integration (Microsoft 365, HubSpot, Salesforce, and others) Video calling on the same platform For a small business trying to present professionally, auto-attendant and ring groups alone justify the switch.Call quality The idea that VoIP calls sound worse than landlines is outdated. Traditional analogue calls use a narrow frequency band ( 300 Hz to 3,400 Hz ) that was designed when bandwidth was scarce. VoIP using wideband audio codecs delivers noticeably clearer calls. On a stable broadband connection, VoIP call quality is equal to or better than a traditional landline.Flexibility and remote working VoIP works on any device with an internet connection. Your team can take and make calls from their mobiles or laptops using the same business number, whether they are in the office, at home, or on the road. This is simply not possible with a traditional landline.For small businesses with hybrid or remote staff, this removes the need for call forwarding workarounds and ensures customers always reach someone on the main business number.Scalability Adding a new user on a traditional landline means new hardware, new wiring, and a call to your provider. Adding a user on a hosted VoIP system takes minutes and costs a monthly licence fee. Removing a user when someone leaves is equally straightforward.Reliability A common concern about VoIP is dependability is what happens if the internet goes down? Modern hosted systems include built-in failover routing. Calls can automatically divert to mobile numbers if your broadband drops. For most small businesses, a 4G mobile backup connection adds a further layer of resilience at minimal cost.&nbsp; Are there any cases where a landline is still the right choice? For most UK small businesses in 2026, no. The only scenarios where you might delay are if you have specialist legacy equipment connected to your phone line (some alarm systems, card terminals, or lifts use analogue connections) in which case those devices need to be assessed and migrated separately, not left on the old line.&nbsp; What does migration actually involve? Less than most business owners expect. For a small team:Setup typically takes 24 hours for new numbers, 7–14 working days if porting existing numbers No downtime. You can run VoIP alongside your existing line temporarily No need to replace handsets if you prefer to keep desk phones (IP phones or adaptors are inexpensive) Staff need minimal training for basic use; most find it more intuitive than a traditional system &nbsp; What Blackgate Tech recommends For small businesses in London and across the UK, we recommend moving to a hosted VoIP system now rather than waiting for the 2027 deadline. The cost savings are immediate, the features are significantly better, and you avoid the risk of a forced migration under pressure.Get in touch: info@blackgate-tech.co.uk&nbsp;

Is VoIP better than a landline for a small business in the UK?

Running a law firm in the UK means operating under some of the most demanding compliance obligations of any sector. The SRA, UK GDPR, the Data Protection Act 2018, and increasingly stringent cyber insurance requirements all place direct obligations on how your firm stores data, manages access, and responds to incidents.For many practices, the honest answer to "who is responsible for making sure our IT meets these standards?" is "no one, specifically." That's where a managed IT provider changes the picture.&nbsp; What compliance actually means for your IT systems The compliance obligations facing UK law firms translate directly into technical requirements:<ul><li>SRA Accounts Rules 2019 require accurate, secure records of all client money transactions, with robust backup and audit trails supporting your legal accounting software.</li><li>SRA Code of Conduct mandates that client affairs remain confidential, which means encrypted storage, secure communications, and access controls across your entire IT infrastructure.</li><li>UK GDPR and the Data Protection Act 2018 classify law firms as data controllers. The SRA expects "appropriate technical and organisational measures" to be in place. Failure to protect client data can result in both SRA disciplinary action and ICO fines.</li><li>SRA Risk and Compliance standards require regular risk assessments of technology systems, including penetration testing and vulnerability scanning.</li><li>The Data (Use and Access) Act 2025, in force from February 2026, has introduced further obligations around data governance and vendor oversight. In 2025 alone, the SRA received over 2,300 reports of data breaches and cyber security incidents affecting solicitor practices. The regulator also intervened in 47 practices in 2024–2025 where IT security failures were cited as a primary or contributing factor. These are not theoretical risks &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</li></ul>Where a managed IT provider adds real value 1. Email security and encrypted communications A managed IT provider fixes this with the right protections in place: secure email gateways, spam filtering, anti-phishing controls, and encrypted communication portals where needed. Your fee earners stay protected without having to think about it. 2. Access controls and identity management Microsoft Entra ID with multi-factor authentication is now baseline for any compliant legal IT environment. Your managed IT provider should configure role-based access so staff only reach the data relevant to their work, and so that access is revoked immediately when someone leaves the firm.3. Backup, business continuity, and disaster recovery &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; The SRA expects firms to maintain business continuity plans, and to show they can restore operations after an incident. A managed IT provider delivers this with automated daily backups covering:<ul><li>Your case management system</li><li>Microsoft 365 data, including Teams and SharePoint</li><li>Any on-premise servers</li></ul>4. Endpoint protection and patch management &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Every device connected to your network is a potential entry point. Managed endpoint protection covers laptops, desktops, and mobile devices. Combined with automated patch management, it closes known vulnerabilities before they can be exploited. Both Cyber Essentials and modern professional indemnity insurance questionnaires now expect this as standard. 5. Cyber Essentials certification The NCSC's Cyber Essentials scheme is increasingly referenced in SRA guidance, Lexcel accreditation, and cyber insurance applications. A managed IT provider can implement the five technical controls required: firewalls, secure configuration, access control, malware protection, and patch management.6. Incident response planning If a breach occurs, you have 72 hours to notify the ICO where the threshold is met. You also have parallel obligations to the SRA and your PII insurer. A managed IT provider can build one incident response runbook that covers all three,so you're not making decisions from scratch when every hour counts. 7. Vendor oversight and GDPR documentation &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Under the Data (Use and Access) Act 2025, firms must carry out due diligence on third-party systems and maintain written agreements covering GDPR obligations. Your managed IT provider should handle this for you:<ul><li>Maintain and update your data processing agreements</li><li>Assess the compliance posture of cloud and SaaS tools used across the firm</li><li>Document this for regulatory review </li></ul>&nbsp; What to look for in an IT provider for your law firm Not every IT provider understands the legal sector. When evaluating options, look for a provider who:<ul><li>Has direct experience supporting SRA-regulated firms and understands the specific obligations of legal practice</li><li>Can assist with Cyber Essentials certification, UK GDPR compliance documentation, and SRA risk assessment responses</li><li>Offers proactive monitoring and patch management as standard, not a reactive break-fix model</li><li>Provides support for the case management and legal accounting platforms your firm uses &nbsp; The bottom line Compliance is not a one-time project. The SRA updates its guidance, GDPR requirements evolve, and cyber threats change shape constantly. A managed IT provider that understands the legal sector does not just keep your systems running, it acts as a continuous compliance partner.</li></ul>At Blackgate Tech, we work with London-based law firms and legal practices to implement the technical controls the SRA, ICO, and your insurer actually expect. If you're not sure where your firm currently stands, we offer a no-obligation IT and compliance assessment.Get in touch: <a href="mailto:info@blackgate-tech.co.uk" data-mce-href="mailto:info@blackgate-tech.co.uk">info@blackgate-tech.co.uk&nbsp;</a><a title="Cyber Security services" href="https://blackgate-tech.co.uk/cybersecurity-services" target="_blank" rel="noopener" data-mce-href="https://blackgate-tech.co.uk/cybersecurity-services">https://blackgate-tech.co.uk/cybersecurity-services</a>&nbsp;For the full breakdown of what's included, ﻿<a title="IT Support" href="https://blackgate-tech.co.uk/managed-it" target="_blank" data-mce-href="https://blackgate-tech.co.uk/managed-it" rel="noopener">see our Managed IT Support page.</a>

How a managed IT provider can help a UK Law Firm stay compliant

<h3> If you run a small or medium-sized business in London, chances are you've come across the term Cyber Essentials,&nbsp;maybe from a supplier, an insurance company, or a government contract requirement. But what actually is it, and do you need it?</h3>What Is Cyber Essentials? Cyber Essentials is a UK government-backed cybersecurity certification scheme, run by the National Cyber Security Centre (NCSC) and IASME. It's designed to help businesses of all sizes protect themselves against the most common types of cyberattack.It's not a complex, expensive enterprise standard. It's a practical baseline, five core controls that, if properly implemented, protect against around 80% of the common attacks targeting UK businesses.The five controls are:Firewalls: protecting your network Secure configuration: &nbsp;making sure devices and software are set up securely User access control: limiting who can access what Malware protection: defending against malicious software Security update management: &nbsp;keeping systems patched and up to date &nbsp; Two Levels of Certification Cyber Essentials (CE) A self-assessment questionnaire verified by a certification body. Most businesses can complete this within a few days once the controls are in place.Cyber Essentials Plus (CE+) : The same five controls, but verified by a hands-on technical audit. A higher level of assurance, required for some government contracts and higher-risk sectors.&nbsp; Does My Business Need It? For many London SMBs, the answer is increasingly yes,and here's why.Government and public sector contracts If you supply to the public sector, Cyber Essentials is mandatory for most contracts involving digital services or data handling. The Legal Aid Agency made it a requirement for Standard Crime Contract holders from October 2025. Many NHS organisations and local councils now expect it as standard from their suppliers.Your customers are starting to ask for it It's not just government. Larger businesses are increasingly requiring Cyber Essentials from their suppliers as part of onboarding and due diligence,particularly in finance, legal, healthcare, and real estate. If you're in one of those sectors, expect the question to come up.Cyber insurance Insurers are tightening requirements. Many now ask whether you're Cyber Essentials certified as part of the underwriting process, and certified businesses often benefit from better premiums. Businesses with turnover under £20m who certify their entire organisation also receive £25,000 of free cyber liability insurance included with the certification.It's good baseline security practice Even if none of the above apply to you right now, Cyber Essentials gives you a structured way to check your business is protected against the most common threats, phishing, ransomware, credential attacks. UK businesses saw a 36% year-on-year increase in cyber attacks in 2025.&nbsp; What's Changed in 2026? The scheme was updated in April 2026 with new requirements. The five controls haven't changed, but enforcement has tightened significantly.The biggest change: MFA is now an automatic failure point. If any cloud service your business uses offers multi-factor authentication,whether that's Microsoft 365, your CRM, your accounting software, and you haven't enabled it, your assessment will automatically fail. No exceptions.Cloud services are also now fully in scope. Previously, some businesses excluded cloud platforms from their assessment. That's no longer acceptable under the updated scheme.If you're renewing or applying for the first time, these are the rules you'll be assessed against.&nbsp; How Much Does It Cost? The IASME self-assessment fee is typically £300–£500 + VAT depending on organisation size. The total cost depends on how much remediation your IT setup needs beforehand. For businesses already using Microsoft 365 with MFA properly configured, the path to certification is often straightforward.&nbsp; How Blackgate Tech Can Help We work with London SMBs across finance, hospitality, healthcare, real estate, and law to prepare for and achieve Cyber Essentials certification. We'll review your current setup, identify any gaps, and make sure everything is in place before you go through the assessment.If you'd like a free initial conversation about where your business stands, get in touch, we're happy to take a look.We help businesses get certified and stay compliant <a href="https://www.blackgate-tech.co.uk/cybersecurity-services" data-mce-href="https://www.blackgate-tech.co.uk/cybersecurity-services">see our Cybersecurity Services,</a> delivered as part of our <a href="https://blackgate-tech.co.uk/managed-it" target="_blank" rel="noopener" data-mce-href="https://blackgate-tech.co.uk/managed-it">Managed IT Support</a>

What Is Cyber Essentials and does my business need it?

Blackgate Tech

Blackgate Tech is London‑based Managed Service Provider that delivers modern, trustworthy IT solutions for small businesses with 5–50 users. Offering help‑desk support, endpoint protection, Microsoft 365 and cloud management, backups, disaster recovery and VoIP, Blackgate combines professional, friendly service with a strong security focus.

Blog

5 Ways to cut IT costs without cutting corners

Why your employees are still your biggest IT risk in 2026...

Is Microsoft Intune worth it for a small company?

Is VoIP better than a landline for a small business in th...

How a managed IT provider can help a UK Law Firm stay com...

What Is Cyber Essentials and does my business need it?