Cyber security: five questions every business owner should ask

Imagine arriving at work tomorrow to find your team cannot access email, customer records or your main business system.

How long could you keep operating? Which customers would be affected? Who would decide what happens next?

For businesses across Milton Keynes, these are useful starting points for a conversation about cyber security. They connect a technical subject to the things owners and directors already understand: keeping services running, protecting relationships and managing costs.

The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a cyber security breach or attack in the previous 12 months.

You do not need to become an IT expert to take an informed interest. Start with these five questions.

1. Which systems and information could we least afford to lose?

Think about the work your business needs to do each day. Taking bookings, paying staff, accessing client files and processing orders all depend on particular systems and information.

Identify your most important activities, the technology behind them and how long each could realistically be unavailable. Include services provided by other organisations.

This gives you a practical way to decide where protection and recovery efforts should come first.

2. When did we last prove that we could recover?

Knowing that backups run is useful. Knowing that the right information can be restored, within a timescale your business can tolerate, gives you something concrete to plan around.

Ask what is covered, how recent the recoverable information would be and when restoration was last tested.

For cloud services, check the recovery arrangements included in your service and any additional backup provision. Be clear about who is responsible for restoring what. The NCSC’s backup guidance is a useful starting point.

3. Who can access our important accounts?

Ask how email, finance systems and other critical accounts are protected. Multi-factor authentication adds protection beyond a password; phishing-resistant options such as passkeys can strengthen this further where supported.

Then review who has access. Former employees, contractors and suppliers should only retain access where there is a current business need.

Give particular attention to administrator accounts, which can make significant changes to your systems. The NCSC’s account security guidance explains these steps in plain English.

4. Would someone feel comfortable reporting a mistake?

A convincing message can catch someone at a busy moment. Staff need a clear route to report suspicious emails, unexpected login requests or something they have clicked.

Make it easy to raise a concern quickly, without fear of embarrassment.

Build checks into everyday work too. A request to change a supplier’s bank details should be verified using contact details you already trust. The NCSC’s guidance on spotting attacks offers practical advice on checking suspicious messages.

5. Who takes charge if something happens?

Your IT team or provider may handle the technical response. Someone within the business still needs to make decisions about priorities, customer communication and how work continues.

Keep a short response plan with named responsibilities, contact details and a way to access it if your usual systems are unavailable.

Run through a realistic scenario together. An hour discussing what you would do can reveal unanswered questions before an incident puts those decisions under pressure.

A practical next step

Put these five questions on the agenda for your next management meeting and invite input from whoever manages your IT.

Where an answer is unclear, agree an action, an owner and a review date. You will have the beginnings of an improvement plan grounded in how your business operates.

Jamie Pope is Service Delivery Director at Cloud Agile, a consultancy with a Milton Keynes office supporting organisations with cyber security, compliance and IT strategy.