Does IT Support Include Cyber Security?

IT support can include cyber security, but the scope depends on your agreement. Paying for support does not, by itself, confirm that someone monitors security alerts, checks account access, tests backups or responds outside office hours. Ask what is covered, who does it and what evidence you can see.

“Our IT company handles that.”

They might well do. A good IT provider can be one of the most useful relationships a small business has.

But before you rely on that answer, it helps to be clear about what “that” actually includes.

Fixing a laptop, securing an email account and recovering a business after an incident are different jobs. They can sit with the same provider. They still need to be agreed.

I’ve worked in IT for more than 30 years. My starting point here would be a conversation with your existing provider, with seven questions on the table.

1. What cyber security work is included in our agreement?

Ask for a plain-English description of the work, including anything charged separately.

Does the provider install security software? Manage its settings? Investigate alerts? Take action when something looks wrong?

These are separate activities. A licence listed on an invoice doesn’t explain which of them you are buying.

I would also ask who handles email security, staff access, software updates and backups. Some jobs may belong to you. That’s workable, provided you know about them.

2. Who checks security alerts, and when?

Ask which systems are monitored and what happens when they generate an alert.

“Monitoring” needs a little unpacking. It could mean checking whether a server is online. It could mean investigating signs of an attacker. Find out which applies.

If coverage is described as 24/7, ask whether that includes human investigation and response, which actions are authorised, and when the provider will contact you.

Office-hours cover may be a deliberate choice for your business. The problem is discovering that limitation during an incident because everybody assumed something else.

3. Who manages access to our important accounts?

Ask who secures your email and other business-critical accounts, reviews administrator access and removes access when someone leaves.

The NCSC recommends passkeys where available, and strong, unique passwords with two-step verification where passwords remain in use. Its advice covers business accounts beyond email, including payroll, banking and website administration. Read the NCSC’s account security guidance.

Your provider may not manage every service you use. If you subscribed to an invoicing app yourself, for example, someone needs to tell them it exists and agree who looks after it.

Dave leaving the business should trigger more than someone collecting his laptop.

4. Who checks that software updates have actually installed?

Ask which devices and applications are covered, how failed updates are handled and who identifies software that is no longer supported.

The NCSC recommends keeping devices and software updated as part of protecting a small organisation. Read its device protection guidance.

For your business, the useful evidence is a current view of what needs attention. Ask whether the provider can show you outstanding updates and explain any exceptions.

An instruction to update and a successfully installed update are two different things.

5. What can we recover, and when was it last tested?

Ask what your backup covers, how far back recovery goes and who carries out a restore.

Include the information your business actually depends on: email, shared files, accounts data and anything stored only on a particular computer or server.

The NCSC advises checking that backups contain your important data and knowing how to restore it. Read its backup guidance.

I would ask for a recent restore test and an explanation of what it proved. Restoring one file is useful evidence, but it doesn’t establish how quickly the whole business could be working again.

Pick a real task, such as raising an invoice or finding tomorrow’s job sheets. Then ask what would have to be recovered to do it.

6. What should our staff do if something looks wrong?

Staff need a clear reporting route, including a way to get help if their normal email account is unavailable.

Ask who receives reports, what staff should include and what happens next. Make sure the answer is available somewhere people can actually find it.

My advice is to make early reporting easy and calm. Someone who thinks they have made a mistake needs help, not a lecture while the problem gets worse.

Agree the route with your provider and tell your team about it. Don’t assume a support number buried in an old email counts as a plan.

7. Who takes charge if we have an incident?

Agree who coordinates the response, who can authorise disruptive actions and which work attracts additional charges.

For example, disconnecting a computer or disabling an account could interrupt someone’s work. Who has permission to make that decision? Who speaks to the business owner? What happens if that person is unavailable?

Keep a short contact list accessible outside your usual systems. Ask your provider to explain their role and where you may need additional help.

You don’t need a shelf full of folders to start. You need an arrangement people understand.

Put the answers on one page

Here is a simple starting point for your next supplier conversation. Fill in each row together.

Do we need a separate cyber security company?

Not necessarily. Your existing IT provider may cover everything you need. Ask for the scope and evidence before deciding to buy something else.

Additional support can make sense where there is a specific gap, such as security monitoring, recovery planning or help deciding what to prioritise. Agree how the providers will work together so responsibilities stay clear.

What if we only have five or ten staff?

Keep the work proportionate. Start with the accounts, devices and information you need to trade, then agree who protects them and how you would recover access.

You can use all seven questions without commissioning a large project. The answers help you decide whether any further work is needed.

Practical help for small businesses

I’m Kevin Walker, founder of Black Swan Cyber Security Solutions in Chesterfield. I help small organisations make sense of cyber security and the IT decisions that sit around it.

If you’re unsure where your existing support ends or what you should tackle next, find the right support for your business.

Bring the questions. We can start there.