How to Prevent Email Phishing in Your Business

A fraudulent invoice sent at 4.45pm on a Friday can look convincing enough to bypass even careful staff. It may use a supplier name your team recognises, refer to a real project and ask for a quick payment before the weekend. Knowing how to prevent email phishing means putting sensible checks around those pressured moments, not expecting people to spot every scam on sight.

For UK businesses, phishing is more than an inbox nuisance. A successful message can lead to stolen Microsoft 365 credentials, diverted payments, unauthorised access to customer information or ransomware. The financial and operational impact can be significant, particularly where a small team is already managing IT alongside its day job.

What email phishing looks like now

Phishing has moved well beyond badly written messages claiming you have won a prize. Criminals regularly impersonate Microsoft, banks, delivery firms, solicitors, suppliers and senior colleagues. They use copied logos, believable email signatures and language tailored to a business, department or individual.

The aim is usually one of three things: to make someone reveal a password, open a malicious attachment, or approve a payment or change to bank details. Some messages lead to a fake Microsoft 365 sign-in page. Others start a conversation, with the attacker posing as a director and requesting an urgent transfer. This is often called business email compromise.

A message can look legitimate while still being unsafe. That is why a prevention plan needs both alert employees and technical controls. One should support the other.

How to prevent email phishing before it reaches staff

The most effective place to stop a phishing email is before it lands in an employee’s inbox. Modern email filtering can assess sender reputation, message content, suspicious links and attachments, then quarantine high-risk messages. It will not catch everything, but it removes a large volume of routine threats and gives staff fewer risky decisions to make.

For businesses using Microsoft 365, the security settings should be configured to match the level of risk. This may include stronger anti-phishing policies, attachment scanning, safe-link protection and external sender warnings. The right configuration depends on how your organisation works. A company that receives invoices from many new suppliers, for example, may need a more carefully tuned approach than one with a small, fixed supplier base.

Multi-factor authentication is equally important. If an employee does enter a password on a fraudulent page, multi-factor authentication can prevent that stolen password from being enough to access the account. Use an authenticator app or security key where practical, rather than relying solely on text messages.

It is also worth reviewing who has administrator rights, who can create mailbox forwarding rules and which accounts can approve payments. Attackers often use a compromised mailbox to set up hidden forwarding, watch conversations and strike when an invoice or payment request is expected. Limiting access reduces the damage one compromised account can cause.

Give staff clear checks, not vague warnings

Telling people to “be careful” is unlikely to change behaviour. Staff need a short, repeatable process that works when they are busy. The most useful habit is to pause before acting on any unexpected request involving credentials, payment, sensitive information or attachments.

Encourage employees to check the full sender address, not just the display name. An email apparently from a trusted supplier might come from a similar-looking domain with one changed letter. They should also hover over links before selecting them, although this is not a guarantee of safety. A genuine-looking web address can still lead to a compromised site.

Payment requests need an additional control. A change to bank details, an urgent transfer or a request that breaks normal process should be verified through a known contact method. That means calling a number already held in company records, not the number in the email. This single step can prevent high-value fraud.

Training is most effective when it reflects the threats people actually see. Finance teams need examples of invoice fraud and supplier impersonation. HR teams may receive fake CVs or payroll requests. Senior staff are common targets for impersonation, while new starters may be more likely to trust a message that appears to come from IT.

Short, regular awareness sessions are generally more useful than a single annual presentation. Use realistic examples, explain the signs that matter and make it easy for staff to ask when they are unsure. The aim is not to create anxiety or blame. It is to make reporting the normal, responsible action.

Build a reporting route people will use

A suspicious email should be easy to report without the employee needing to decide whether it is definitely malicious. A dedicated reporting button in the email platform, or a clearly communicated IT support address, gives your team a consistent route to investigate messages.

Staff should know what happens next. They should report the email, avoid clicking links or opening attachments, and leave it in place until advised otherwise. If they have already entered credentials, they need to report it immediately. Prompt reporting allows IT to reset passwords, revoke active sessions, check mailbox rules and identify whether other users received the same message.

There is a trade-off here. Overly aggressive blocking can delay legitimate supplier emails, while a relaxed approach increases exposure. Reviewing quarantined messages and reported emails helps fine-tune controls over time. It also shows staff that reporting is worthwhile, rather than a task that disappears into a black hole.

Protect the business processes attackers exploit

Email security is not only an IT issue. Many phishing attacks succeed because a business process allows a single email to trigger a high-risk action. Finance, procurement and payroll procedures should include independent verification for changes to bank details and unusual payment instructions.

Consider separating responsibilities where possible. One person can request a supplier amendment, while another confirms it using a trusted contact record. For larger payments, a second approver should verify both the instruction and the destination account. These controls may feel slower than acting on an email alone, but they are far quicker than recovering from a diverted payment.

Sensitive documents also deserve attention. Avoid sharing passwords, bank details or personal information by email where a more secure approved system is available. If email must be used, confirm the recipient carefully and apply appropriate encryption and access controls. A misaddressed email is not phishing, but the same discipline helps prevent both problems.

What to do when someone clicks

Even well-trained people can be caught out, especially when attackers are using a real compromised supplier account. The priority is speed and a calm response. Staff should contact their IT support provider immediately, ideally by phone if their email account may be compromised.

The response should normally include resetting the password, revoking sign-in sessions, checking multi-factor authentication details, reviewing mailbox forwarding and inbox rules, and investigating recent sign-ins. If a payment has been made, contact the bank without delay and preserve the relevant emails and records for investigation.

Avoid treating the employee as the problem. If people fear blame, they will wait to report an error, and that delay gives an attacker more time. A supportive culture turns a potential incident into an opportunity to contain risk and improve controls.

Make phishing prevention part of managed IT

Phishing methods change constantly, so a one-off configuration review is not enough. Email protection, Microsoft 365 security, user awareness and payment controls should be reviewed together as part of ongoing cyber risk management. That joined-up approach helps identify gaps between technology and day-to-day working practices.

For businesses without a large in-house IT team, specialist support can provide the oversight needed to monitor alerts, manage security settings and respond quickly when something looks wrong. iData works with organisations to align managed IT support and cyber security controls with the way their people actually work, rather than applying a generic checklist.

The most useful test is practical: could a member of staff recognise an unusual request, report it quickly and continue working safely? When the answer is yes, phishing prevention becomes less about fear of the next email and more about dependable habits, clear processes and technology that supports the business.

A cloud migration is rarely just a matter of moving files from one place to another. For a growing business, it can affect how staff access systems, how customers are served, how information is protected and what happens when a site loses connectivity. Done well, it removes friction from daily work. Done hurriedly, it can create new costs, access problems and security gaps.

The right approach starts with the business outcome. You may need staff to work securely from several locations, replace ageing servers, improve disaster recovery, support a new office, or bring email, files and communications under better control. The cloud should be selected and configured to solve that specific problem, not adopted simply because it is the expected direction of travel.

What cloud migration should achieve

Cloud services can give small and medium-sized businesses access to technology that would be expensive or difficult to operate on-site. Microsoft 365, hosted applications, cloud backup and cloud phone systems can make it easier for people to work productively without relying on a single office server or location.

However, moving to the cloud does not automatically make a business more secure, more efficient or less expensive. Those outcomes depend on the design. User permissions, backup arrangements, internet resilience, device security and staff training still need proper attention. In many cases, the best result is a mixed environment where selected systems remain on-site while the services that benefit from remote access or managed infrastructure move to the cloud.

A successful project should have clear measures of success. These might include reduced downtime, fewer support issues, secure access for remote workers, simpler collaboration, predictable monthly costs or a faster recovery following an incident. Agreeing these measures early helps prevent the project becoming a technical exercise with no clear business value.

Start cloud migration with an honest assessment

Before choosing licences or setting a migration date, build a realistic picture of what is currently in use. This includes obvious systems such as email, shared files and accounting software, but also older databases, specialist applications, CCTV recording, line-of-business devices and integrations that may depend on a particular server or network location.

It is useful to ask practical questions. Who needs access to which information? Are staff working from home, visiting customer sites or moving between offices? Which systems cannot be unavailable during working hours? Is data subject to contractual, financial or public-sector requirements? Do key applications work reliably over the available broadband connection?

This discovery stage often reveals issues that are not strictly cloud issues. A poorly configured WiFi network, unsupported laptops, weak passwords or unreliable connectivity can undermine an otherwise well-planned move. Addressing those foundations first is usually cheaper and less disruptive than discovering them during go-live.

Choose the right migration method

Not every workload should be moved in the same way. Email and collaboration tools may be suitable for a straightforward planned migration. A bespoke application may need testing, redevelopment or a staged transition. Older systems may be better retained temporarily while a replacement is selected.

There are broadly three practical options. Some businesses move a service with minimal changes, often called a lift-and-shift approach. Others replace an existing system with a cloud-based alternative, such as moving from an on-site email server to Microsoft 365. A third option is to redesign a process around cloud tools, which can deliver greater efficiency but needs more planning and user involvement.

The right choice depends on risk, cost and the value of changing the underlying process. A quick move can reduce pressure on ageing infrastructure, but it may carry old inefficiencies into a new platform. A full redesign can be valuable, but it should not interrupt a busy team without a compelling operational reason.

Security must be designed into the move

Cloud providers invest heavily in their platforms, but responsibility is shared. The provider may protect the underlying service, while the business remains responsible for user accounts, access settings, information handling and the security of devices connecting to it.

Multi-factor authentication should be standard for business accounts, particularly for email, finance systems and administrator access. Permissions should follow the principle of least privilege: people should have the access they need to do their jobs, and no more. Departing staff, temporary users and external suppliers need a defined process for access removal and review.

Data protection also needs careful thought. Understand where information is held, how long it is retained and how it can be recovered. Synchronisation is useful, but it is not always the same as an independent backup. If a user deletes or corrupts information, a separate backup policy can be vital.

Cybersecurity should extend beyond the cloud account itself. Managed endpoint protection, device updates, encrypted laptops, phishing awareness and monitored backup all contribute to a stronger position. Businesses working with sensitive customer, education, healthcare or public-sector information may also need more formal controls and documented procedures.

Plan around people and continuity

The technical transfer is only one part of cloud migration. Staff need to understand what is changing, when it will happen and where to get help. A clear communication plan prevents small frustrations from becoming resistance to the new system.

Pilot groups are particularly useful where a change affects everyday habits. Test a new file-sharing structure or cloud phone platform with a representative group of users first. Their feedback can highlight permission issues, training needs and process gaps before the wider rollout.

Timing matters too. Migrating email or core business systems during a peak trading period, month-end or school term can introduce unnecessary risk. Establish a change window, communicate expected interruptions, and retain a practical rollback plan where possible. There should be a named person responsible for decisions if an unexpected issue arises.

For organisations with several sites, remote workers or public-facing locations, connectivity deserves special attention. Cloud services depend on reliable internet access. Business-grade broadband, resilient connections, correctly configured firewalls and well-managed WiFi are not optional extras when core systems are online.

Control costs after the move

Cloud spending is often more predictable than buying and replacing servers, but it still needs active management. Licence numbers can grow quietly as roles change, users leave or short-term projects end. Storage, backup retention and additional security features can also affect the monthly bill.

Review licences regularly and match each user to the service level they genuinely require. A business may need different licence types for office-based staff, mobile workers, shared devices and senior administrators. This is not simply about reducing spend; it is about ensuring people have the tools required without paying for unused capacity.

It is equally important to account for the costs that sit around the platform. Connectivity, support, security monitoring, device replacement and training all contribute to the true operating cost. A good business case considers these elements alongside the savings from retired servers, reduced downtime and less time spent maintaining ageing equipment.

Ongoing support is part of the solution

Cloud environments change continuously. New staff join, applications evolve, threats develop and business requirements shift. A migration should therefore lead into a support model, not finish at handover.

Regular reviews can check security settings, backup status, licence usage and opportunities to improve how teams work. They also provide a sensible point to discuss future needs, such as a new site, upgraded connectivity, cloud telephony or additional protection for remote devices.

For businesses without a large internal IT team, a single accountable technology partner can make a significant difference. iData can assess the wider environment, coordinate cloud services with connectivity and security, and provide ongoing support through the same team that understands the original plan.

The best cloud migration leaves people feeling that technology is easier to use, not harder to understand. Start with the work your organisation needs to do, protect the systems and information that matter most, and make each change at a pace your people can support.

A suspicious email reaches a member of staff shortly before a customer deadline. It looks familiar, the sender’s name is close enough, and one click could expose login details or install malicious software. This is where business cybersecurity becomes real: not as a technical checklist, but as the practical work of keeping people productive, systems available and customer trust intact.

For UK small and medium-sized organisations, the risk is rarely limited to one computer. A cyber incident can interrupt email, prevent access to files, disrupt cloud phone systems, expose confidential records and bring routine operations to a halt. The right response is not to buy every available security product. It is to build sensible layers of protection around the way your organisation actually works.

Business cybersecurity starts with business continuity

Cybersecurity is often discussed in terms of threats, but decision-makers need to consider the operational consequences. If staff cannot access Microsoft 365, process orders, answer calls or retrieve customer information, the issue quickly becomes one of lost revenue, missed commitments and reputational damage.

That is why a useful security plan begins with a few straightforward questions. Which systems would cause the greatest disruption if they stopped working? Where is sensitive information stored? Who needs access to it? How quickly could you restore services after a serious incident?

The answers will differ between organisations. A professional services firm may place email, document access and client confidentiality at the top of the list. A school or healthcare setting must carefully protect personal information while maintaining access for authorised users. A multi-site business may be particularly dependent on reliable connectivity, secure remote access and consistent controls across every location.

Good security decisions follow these priorities. They focus first on reducing the risks that could stop the organisation from operating.

The controls that make the biggest difference

No single tool can prevent every cyber incident. Effective business cybersecurity uses several connected controls, so that one mistake or technical failure does not become a major breach.

Secure identities before devices

Most cloud services, business applications and remote-working tools rely on user accounts. If an attacker gains access to an account, they may not need to break through a firewall or compromise a device at all.

Multi-factor authentication should be enabled wherever it is available, particularly for email, Microsoft 365, finance systems, remote access and administrator accounts. It adds a further proof of identity, such as an authenticator app approval, alongside a password.

Passwords still matter, but staff should not be expected to remember increasingly complex combinations or reuse them across systems. A managed password approach can help users create unique credentials and store them safely. Access should also be reviewed when someone changes roles or leaves the organisation. Former accounts, shared logins and excessive administrator rights create avoidable exposure.

Keep systems maintained and protected

Attackers often take advantage of known weaknesses in software, operating systems, routers and other connected equipment. Regular updates close many of these gaps, but patching needs ownership. It is not enough to assume that every device will update itself at the right time.

A managed approach can monitor devices, apply appropriate updates and identify machines that have fallen behind. Endpoint protection also helps to detect suspicious activity, malicious files and attempts to encrypt data through ransomware. This should cover laptops used away from the office as well as desktop computers on site.

There is a balance to manage. Updates can occasionally affect older applications or specialist equipment, which is why testing and planned maintenance are valuable. Delaying every update, however, is usually a greater risk than managing change properly.

Treat email as a security boundary

Email remains one of the most common routes into an organisation. Phishing messages can imitate suppliers, senior colleagues, banks and delivery firms. Others carry harmful attachments or direct users to convincing fake sign-in pages.

Email filtering can block a significant proportion of unwanted and dangerous messages before they reach users. Domain protections help reduce the chance of criminals impersonating your organisation, while clear reporting routes allow staff to flag anything suspicious without embarrassment.

Technical filtering is not a replacement for judgement. Staff should be encouraged to pause when an email creates urgency, requests a payment change or asks them to sign in unexpectedly. A quick phone call to a known contact can prevent a costly mistake.

Back up what you cannot afford to lose

Backups are often mentioned after a ransomware attack, when restoring files has become urgent. They should be planned long before then. A useful backup strategy covers critical data, is monitored for successful completion and is tested through restoration.

The key question is not simply whether a copy exists. It is whether the organisation can restore the right information within the time it needs. A backup that takes several days to recover may not meet the needs of a business that relies on records, orders or shared documents throughout the working day.

Cloud platforms provide valuable resilience, but organisations should understand what is and is not protected by their service settings. Retention, recovery and account security all need consideration.

People are part of the security plan

Security awareness works best when it is practical and regular. Annual training delivered without context is easy to forget. Short, relevant guidance is more likely to change behaviour, especially when it reflects the messages staff receive and the systems they use.

Explain what a phishing email can look like, how to report it, and what to do if somebody clicks a link or enters credentials by mistake. The correct instruction is usually to report the issue immediately, not to worry about blame. Early reporting gives IT support a better chance to contain the problem before it spreads.

Policies also need to reflect real working patterns. If employees work from home, travel between sites or use mobile devices, they need secure and workable ways to access services. Overly restrictive controls can lead people to find unofficial alternatives, such as forwarding files to personal email accounts. A well-designed solution protects the business without making ordinary work unnecessarily difficult.

Connect physical and digital security

Cybersecurity does not sit separately from the rest of the workplace. Network cabinets, WiFi access points, CCTV systems, cabling and internet connections all form part of the environment that keeps systems running.

For example, poorly secured network equipment can expose an otherwise well-managed office. Guest WiFi should be separated from the business network. CCTV cameras and connected devices should use appropriate credentials, updates and network segmentation. During an office move, expansion or refurbishment, structured cabling and network design should be planned alongside IT requirements rather than treated as an afterthought.

This joined-up approach is particularly useful for organisations managing several suppliers. When IT, connectivity, telephony and infrastructure are considered together, problems are easier to identify and accountability is clearer.

Build a response plan before you need it

Even well-protected organisations should assume that something may eventually go wrong. The difference between a contained incident and a prolonged outage often comes down to preparation.

An incident response plan does not have to be complicated, but it should identify who makes decisions, who contacts IT support, how staff will communicate if email is unavailable, and when customers, insurers or regulators may need to be informed. Keep key contact details available outside the systems that could be affected.

Run through likely scenarios. What would happen if a director’s account were compromised? What if ransomware affected shared files? What if the primary internet connection failed at a key site? These conversations reveal gaps before they become urgent problems.

Cyber Essentials can provide a useful baseline for many organisations by focusing attention on core technical controls. Certification is not a guarantee against every attack, but it demonstrates a disciplined approach and can help create a clear starting point for improvement.

Make security proportionate and accountable

The best business cybersecurity arrangements are proportionate. A small organisation does not necessarily need the same tools, processes or internal team as a large enterprise. It does need a clear understanding of its risks, dependable support and a plan that can develop as the organisation changes.

Start with visibility: know what devices, accounts, applications and connections you have. Then prioritise the controls that protect the systems and information your organisation relies upon most. Review them regularly, especially after changes such as new premises, acquisitions, remote-working changes or adoption of new cloud services.

For businesses without a large in-house IT team, a specialist partner can provide the monitoring, advice and accountability needed to keep that work moving. iData Com Limited takes this practical, joined-up view, helping organisations align IT support, security, connectivity and infrastructure around day-to-day operational needs.

The aim is not to make people fearful of technology. It is to give them the tools, guidance and support to use it confidently, while ensuring that a single mistake does not have to become a business-stopping event.

A Microsoft 365 bill can rise quietly. A new starter needs an account, a department adopts a premium application, a former employee’s licence remains active, and soon the monthly cost no longer reflects how people actually work. The aim to reduce Microsoft 365 costs should not mean removing useful tools or creating extra work for staff. It means making deliberate decisions about licensing, security and support.

For UK small and medium-sized businesses, Microsoft 365 is often central to email, file sharing, meetings and day-to-day collaboration. Changes therefore need to protect continuity as well as budgets. The most effective savings usually come from understanding what is in use, matching licences to genuine needs and preventing avoidable costs from returning.

Start with a clear view of licences and users

The first question is simple: who has a Microsoft 365 licence, and what do they need it for? In practice, the answer is rarely as straightforward as the user list suggests. Businesses commonly carry accounts for leavers, temporary workers, shared mailboxes, inactive service accounts or staff whose roles have changed.

A licence review should compare your Microsoft 365 admin records with HR or payroll records. Check active employees, contractors, shared accounts and recent leavers. Then identify dormant accounts and licences assigned to people who no longer require them. This exercise is also a useful security control. An account left active after someone leaves can create a route into business data, not just an unnecessary charge.

Do not assume every account should be deleted. A former employee’s mailbox may need to be retained for legal, operational or customer-service reasons. In those cases, consider whether the mailbox can be converted to a shared mailbox or handled through an appropriate retention policy, rather than continuing to use a full user licence. The right approach depends on mailbox size, access requirements and your wider governance arrangements.

Match Microsoft 365 plans to real work

Many organisations standardise on one licence for everyone because it is easy to administer. It can also mean paying for features that some staff will never use. A finance manager working with sensitive files and advanced spreadsheets may have different needs from a warehouse colleague who only needs email, Teams access and basic document viewing.

A role-based approach is usually more accurate. Group users by what they need to do, rather than by department name alone. Typical groups might include office-based knowledge workers, frontline staff, senior leadership, shared-device users and external contractors. Review the applications and security features each group genuinely needs, then assess whether their current plan is suitable.

Downgrading licences can save money, but it should be done carefully. A lower-cost plan may remove desktop applications, larger storage allowances, device management or security controls that a user relies on. Saving a few pounds per person is not worthwhile if it causes productivity issues, exposes data or leads to costly workarounds.

It is equally important to recognise where a higher licence is justified. Some businesses pay more for advanced identity protection, endpoint management, data loss prevention or compliance capabilities because the risk reduction is valuable. The question is not simply which plan costs less. It is whether the features you pay for are being used to support a real business requirement.

Review add-ons separately

Add-ons deserve the same scrutiny as core licences. Audio conferencing, calling plans, extra storage, advanced security tools and specialist applications are sometimes assigned broadly during a project and never reviewed afterwards. A separate report of all add-ons, their assigned users and their purpose can reveal straightforward savings.

This is particularly relevant where Microsoft 365 overlaps with other services. For example, a business may have Teams telephony capability but continue to pay for an unrelated calling service that is no longer required. Conversely, removing a calling add-on without reviewing the wider phone system can interrupt number routing or call handling. Technology costs should be reviewed as connected services, not isolated line items.

Reduce Microsoft 365 costs through better governance

One-off clean-ups help, but governance prevents waste from building again. Set clear rules for joining, moving and leaving employees. When someone starts, the manager should request the right licence for their role. When their responsibilities change, their applications and access should be reviewed. When they leave, a defined process should remove access promptly and deal with their mailbox, files and device.

Assign ownership for this process. In smaller businesses, it may sit with an office manager alongside IT support. In larger organisations, HR, finance and IT may each have a part to play. What matters is that licence decisions do not depend on someone remembering to send an email after a staff change.

A quarterly review is a sensible starting point for many organisations. It should cover inactive users, unassigned licences, high-cost plans, expiring subscriptions and newly purchased add-ons. Businesses with frequent staff turnover, seasonal workers or multiple sites may benefit from checking more often.

You should also control who can purchase licences or enable trials. Free trials can become paid subscriptions if they are not managed, while individual card payments make it harder for finance teams to see the full cost. Central purchasing and a documented approval process make spend more predictable.

Use the security features you are already paying for

Cost control and cyber security are closely linked. A compromised account can lead to fraud, downtime, recovery costs and reputational damage that outweigh any licence saving. Before buying another security product, review what your existing Microsoft 365 plan already includes and whether it is configured properly.

Multi-factor authentication is a clear example. It is one of the most effective controls against unauthorised account access, yet it is sometimes enabled only for administrators or introduced inconsistently. Conditional access, device management and anti-phishing settings may also be available depending on your licence level. Used appropriately, these capabilities can reduce reliance on duplicate tools and strengthen your overall security position.

That does not mean Microsoft 365 should replace every specialist security service. Some organisations need managed detection, security monitoring, backup, secure email gateways or additional compliance controls. The right combination depends on your risk profile, internal expertise and regulatory obligations. The aim is to remove unnecessary overlap, not to leave a gap in protection.

Do not confuse backup with retention

A common source of avoidable cost is buying storage or backup without first defining what needs protecting and for how long. Microsoft 365 retention features can help preserve certain information, while independent backup can provide faster restoration, separate recovery options and more granular control. They are not identical.

A practical review should consider the business impact of losing email, OneDrive files, SharePoint content or Teams data. It should also consider legal retention requirements. Once these needs are clear, you can select a proportionate service rather than purchasing capacity based on assumptions.

Tackle unused storage and unmanaged file sharing

Storage pressure often prompts an immediate upgrade. Before increasing capacity, look at why it is being consumed. Old project folders, duplicate files, large media assets and former employees’ OneDrive accounts can all contribute. Agree retention periods for business records, archive completed projects where appropriate and make sure ownership of shared data is clear.

Good file management has an operational benefit too. Staff spend less time searching for the correct version of a document, and sensitive information is less likely to be shared widely by mistake. Cost savings are stronger when they improve the way people work rather than simply restricting them.

Include support and productivity in the calculation

The cheapest licence arrangement is not always the lowest-cost outcome. If staff cannot access the applications they need, if accounts are provisioned slowly, or if recurring Microsoft 365 issues consume hours of internal time, the apparent saving can disappear quickly.

Consider the full cost of ownership: licence charges, support effort, downtime, security exposure, training and the time employees spend working around poor configuration. For a business without a large internal IT team, experienced support can make licensing decisions more accurate and ensure changes are tested before they affect users.

At iData, Microsoft 365 is assessed as part of the wider technology environment, including connectivity, devices, cyber security and communications. That joined-up view matters because the best decision for one service can affect another.

A practical way to reduce Microsoft 365 costs

Start with data, not assumptions. Export your current licences and add-ons, compare them with your employee records, and identify accounts that need action. Next, map licence types to job roles and check whether duplicate tools or subscriptions are delivering real value. Finally, put a repeatable review process in place so savings continue after the initial tidy-up.

A well-managed Microsoft 365 environment should feel straightforward to staff: the right tools are available, access is secure and costs are visible. If the picture is unclear, an independent review can turn a confusing monthly bill into a technology plan that supports the business you are running.

A Cyber Essentials application often exposes issues that have been tolerated for too long: an old laptop in a cupboard, former staff accounts still active, unsupported software, or updates that depend on somebody remembering. The top Cyber Essentials preparation steps are not about producing paperwork for its own sake. They are about getting a clear, defensible view of the technology your business relies on and closing gaps before they become an operational or security problem.

For most small and medium-sized organisations, the challenge is not a lack of intent. It is that IT has grown in stages – new cloud services, remote workers, mobile devices, a second site or a supplier-managed connection – without one person holding a complete view. A structured preparation process brings those moving parts back under control.

Start with the right Cyber Essentials scope

Before checking a setting or buying a security tool, decide what is in scope. Cyber Essentials covers the systems, devices and services your organisation uses to process business data or connect to the internet. That can include office PCs, laptops used at home, mobile phones, servers, routers, wireless networks, cloud-based applications and accounts managed by a third party.

This is where businesses can either make the assessment harder than it needs to be or overlook something material. A sensible scope should reflect how people actually work, not how the network diagram looked two years ago. If staff access Microsoft 365 from personal devices, for example, those devices and the controls around access need careful consideration. If a hosted phone system, CCTV platform or guest WiFi is managed separately, establish how it connects and who is responsible for its security.

Create a straightforward inventory showing each asset, its owner, its operating system or service, and whether it is supported and still needed. Include network equipment, not just computers. An accurate list gives you a practical baseline for the rest of the work and makes future reviews far less disruptive.

Apply the top Cyber Essentials preparation steps in order

The certification is built around five technical control areas. They work together, so it is better to address them methodically than to treat each as an isolated task.

1. Secure your internet gateways and network devices

Your firewall, router and internet-facing equipment are the first line of control between your business and the wider internet. Check that default administrator passwords have been replaced with strong, unique credentials, that remote administration is disabled unless there is a defined operational need, and that access is restricted to authorised people.

Configuration matters as much as the equipment itself. Remove old port-forwarding rules, accounts belonging to former suppliers and services that were set up for a one-off project. If remote access is needed, use an approved method with multi-factor authentication rather than leaving management interfaces exposed to the internet.

Many organisations rely on a broadband provider, IT provider or firewall vendor to manage this layer. That is entirely reasonable, but accountability should still be clear. Know who applies updates, who reviews rules and who responds if an alert identifies suspicious activity.

2. Remove insecure defaults and standardise configuration

Secure configuration means setting up devices and software so they are not left more open than necessary. This includes removing unused applications, disabling unnecessary user accounts and ensuring screens lock after a suitable period of inactivity.

Standardisation makes this achievable. A business with ten laptops configured in ten different ways will struggle to prove that controls are consistently applied. Where possible, use central management to apply security settings, encryption, approved applications and password policies across devices.

There will be exceptions. A specialist device in a school, healthcare setting or engineering environment may need older software or a fixed configuration to run essential equipment. Do not simply ignore the risk. Document why the exception exists, limit its network access, and agree compensating measures such as segmentation, restricted user permissions or a replacement plan.

3. Review user access, especially privileged accounts

Most avoidable security failures start with access that is broader or longer-lasting than it should be. Review who has accounts, what they can reach and whether they need administrator privileges. Everyday work should normally be carried out using a standard account, with elevated access reserved for specific support and administration tasks.

Pay particular attention to joiners, movers and leavers. When somebody changes role or leaves, access to email, files, finance systems, cloud applications, mobile device management and shared passwords must be reviewed promptly. This process should not depend on an informal message between managers.

Multi-factor authentication is a significant protection for email, cloud services and remote access. It reduces the chance that a stolen or guessed password alone can give an attacker entry. It does add a small step for users, so choose methods that suit your workforce and provide clear guidance before enforcement. Convenience is relevant, but the cost of a compromised account is usually much higher.

4. Maintain protection against malware

Every in-scope device needs appropriate protection against malicious software. For many businesses, centrally managed endpoint security is the practical option because it provides visibility over whether protection is installed, active and receiving updates.

However, software alone is not the answer. Attackers often use legitimate-looking emails, fake login pages and compromised supplier accounts rather than obvious malicious attachments. Pair technical protection with sensible controls over downloads, application installation and administrative rights. Staff should also know how to report a suspicious message without worrying that they are wasting IT’s time.

For organisations with remote workers, confirm that devices remain protected away from the office. A laptop that only receives updates or security checks when it returns to site creates an unnecessary blind spot.

5. Keep software and firmware up to date

Security update management is frequently the most time-sensitive part of preparation. Unsupported operating systems, unpatched applications and old firewall firmware can all leave known weaknesses exposed. Start by identifying what is installed, then check that it remains supported by its vendor.

Set a realistic process for applying updates. Critical security fixes should be dealt with promptly, while routine updates can follow a planned schedule with testing where needed. The right balance depends on the business: a standard office environment may update quickly with little disruption, while a production system or clinical device may need a tested maintenance window.

Do not limit the review to Windows or macOS. Web browsers, PDF readers, office applications, mobile operating systems, wireless access points, switches and cloud application settings all deserve attention. Where a supplier manages an element, obtain confirmation of its update responsibilities rather than assuming it is covered.

Prepare evidence before you begin the assessment

Cyber Essentials is not a box-ticking exercise, but preparation is easier when answers can be supported. Keep records of your asset inventory, software support status, update process, access reviews, firewall responsibility and any documented exceptions. You do not need an elaborate compliance platform to do this. A maintained register and clear internal procedures are often more useful than a large folder of documents nobody checks.

Run a short internal review using the assessment questions before submitting anything. Ask the people who manage IT, HR onboarding, finance applications and facilities to confirm their parts of the picture. This is particularly valuable where IT, connectivity, cabling, CCTV and cloud services have been purchased from different suppliers.

Be accurate rather than optimistic. If a control is not consistently in place, fix it before applying or seek specialist advice on the most proportionate route. Misunderstanding a question can delay certification; hiding a gap leaves the underlying risk untouched.

Make Cyber Essentials part of normal operations

Certification is most valuable when it supports reliable day-to-day working. Build the controls into regular routines: review users when employment changes, check device status monthly, schedule patch reporting, and reassess suppliers or new services before they are introduced.

For a growing business, this may be the point where managed IT support becomes worthwhile. The benefit is not simply outsourcing a checklist. It is having clear ownership of updates, monitoring, access management and advice when technology changes. iData works with organisations that need this joined-up approach across IT, connectivity and security, without adding unnecessary complexity.

A well-prepared Cyber Essentials application should leave your business in a better position than when it started: fewer unknown devices, clearer responsibilities and less opportunity for a routine oversight to interrupt the working day. That is a useful outcome whether certification is requested by a customer, required for a contract or simply part of running the business responsibly.