Cybersecurity and IT resilience: the complete guide

No organisation can prevent every security incident. Attackers only need one weakness, and every business has staff who are busy, suppliers with access and systems that cannot be patched as fast as anyone would like. What separates a bad week from a business crisis is resilience: knowing your risks, controlling access, protecting what matters most and being able to recover quickly when something does go wrong.

This guide draws on the briefings in our security series. It is written for leaders of small and mid-sized organisations who need a clear, proportionate approach rather than a catalogue of tools. It covers how to assess risk, the basics that stop most common attacks, backup and recovery, incident response, supplier risk and new risks from AI.

Know your risks and your crown jewels

Start with a clear picture of what you have and what would hurt most if it were lost, stolen or unavailable. Review assets, threats, current controls and gaps against recognised good practice, such as national cyber security guidance or ISO 27001, and rank what to fix first.

1. List the data and systems that matter most: customer records, financial systems, product designs, operational systems that keep the business running.
2. For each, ask what would happen if it were stolen, altered or unavailable for a day, and for a week.
3. Record the controls already in place, such as who has access, how it is backed up and how it is monitored.
4. Identify the gaps and rank them by the harm they could cause and the effort needed to close them.
5. Agree a short list of priorities with the leadership team and review it every six months.

The aim is a clear risk picture in order of importance, not a long register that nobody reads. A ranked list of ten actions with owners and dates will do more for security than a hundred-page assessment.

Cover the basics that stop most attacks

People are the main entry point. Most attacks begin with phishing emails or stolen passwords, not sophisticated technical exploits. That is good news, because a handful of well-chosen controls prevents many common attacks, and they are within reach of any organisation.

The last item is easily overlooked. If staff fear being blamed for clicking a bad link, they will hide it, and the attacker gains hours or days. If reporting is quick and welcomed, the security team can contain the problem before it spreads.

Back up and recover with confidence

Backups that are never tested fail. Many organisations discover during an incident that backups were incomplete, could not be restored in time or had been encrypted along with everything else because they sat on the same network. A restore that has not been rehearsed is a hope, not a plan.

• Choose what to test: critical systems first, plus sample files from shared storage.
• Restore to a separate test environment so you do not disturb live systems.
• Time the restore and compare it with how long the business can tolerate being without the system.
• Fix what fails and test again on a schedule, at least quarterly for critical systems.
• Keep at least one backup copy that attackers on your network could not reach or alter.

Backups are one part of a wider continuity plan. Decide in advance how the business would operate if a key system were unavailable for several days: manual workarounds, alternative suppliers, temporary equipment. Testing these plans against realistic scenarios, such as ransomware on the finance system the week before payroll, reveals gaps that a checklist will not.

The first hour of an incident

What you do in the first hour often decides the size of the damage. People under pressure make poor decisions if they are improvising, so write a short response plan, name the roles and rehearse it at least once a year.

1. Contain. Isolate affected systems from the network, disable compromised accounts and stop the spread. Do not wipe machines yet.
2. Preserve evidence. Keep logs and affected systems intact for investigation; they may be needed for insurers, regulators or law enforcement.
3. Convene the team. Bring together the named incident lead, IT, a senior decision-maker and communications.
4. Communicate. Inform the right people with clear, factual updates, internally first, then customers, partners or regulators as required.
5. Call for help. Contact your cyber insurer and any specialist response provider early; many policies require prompt notification.

Keep the plan short enough to use under pressure, with phone numbers printed on paper. If email and the file server are down, an incident plan stored only on the file server will not help.

Manage supplier and third-party risk

Many incidents begin outside your organisation. Software providers, IT support firms, cloud services and other suppliers with access to your data or systems extend your risk. List the suppliers with access, ask them standard questions about their security practices and incident handling, give them only the access they need and review it regularly. Remove access promptly when a contract ends.

Pay particular attention to IT support providers and software vendors with remote access to your systems, because an attacker who compromises them may reach many of their customers at once. Ask how their staff sign in, whether access is logged and how quickly they would tell you about a breach on their side. Write the answers into the contract, so that expectations are clear before anything goes wrong rather than argued about afterwards.

Fit security to the business

Security must be proportionate. Controls that block work get bypassed: people share passwords, forward documents to personal email or use unapproved tools to get the job done. Good security protects critical assets strongly and keeps other controls light. Ask users where controls cause workarounds; their feedback shows where the design needs adjusting.

AI adds new risks. Staff using unapproved AI tools may paste customer data, contracts or source code into services outside your control. Rather than a blanket ban that will be ignored, include AI in your security policy, approve suitable tools and explain clearly what may and may not be shared.

We had invested in tools but never practised. The tabletop exercise showed nobody knew who could authorise taking the systems offline. That took ten minutes to fix on paper.

Chief financial officer, distribution client

Done well, this work gives you a clear risk picture, fewer successful attacks through stronger sign-in and patching, faster recovery from tested plans and backups, and evidence of control that boards, insurers and customers increasingly ask for. A practical first step is a one-hour session with your IT lead to confirm multi-factor sign-in is on for every administrator and remote access account, and to schedule your first timed restore.

Source: Intelliversal analysis, drawing on the briefings in this series.

Frequently asked questions

We are a small organisation. Where should we start?

With the basics: multi-factor sign-in, regular patching, tested backups kept separate from the network, and short staff training on phishing. These stop many common attacks at modest cost.

Do we need cyber insurance?

Many organisations find it worthwhile, especially for incident response support. Insurers increasingly require basic controls such as multi-factor sign-in and tested backups before offering cover.

Should we ban AI tools?

Bans are often ignored. A better approach is to approve suitable tools, set clear rules on what data may be shared and include AI use in your security policy and training.

Explore Cybersecurity and IT resilience