PSTN stands for Public Switched Telephone Network. It’s the analogue landline system that has carried UK phone calls for over a century. BT and Openreach are replacing it with digital phone lines that run over broadband, often called the digital switchover or the landline switch off. The date was originally December 2025. It was pushed back once, and Openreach has confirmed it won’t move again.

Most businesses have already switched without noticing. The ones that get caught out have older equipment nobody has checked for years. This guide explains what’s affected, what care providers need to watch for, and the five checks every London business should do now.

What stops working after the PSTN switch off?

It’s easy to assume you’re fine because your desk phones are new. The risk usually sits in the equipment you don’t think about. Any of these could still rely on an old analogue line:

• Phones at reception, even if they plug into a phone system rather than the wall socket
• Burglar and fire alarms that call a monitoring centre
• Card payment machines
• Lift emergency phones
• Door entry systems
• Fax machines and franking machines
• Older broadband lines that share the copper phone line

If one of these stops working on a Monday morning, you might not find out until a customer can’t pay or an alarm fails to call out.

What about my broadband?

Some older broadband connections share the same copper line as your phone. If your broadband is ADSL, or a fibre-to-the-cabinet service still tied to a phone line, your provider will need to move it too. Full fibre and newer “data only” lines aren’t affected.

This catches out a lot of offices in central London, where full fibre is still patchy. A business on an older line may find that digital calls drop or sound poor because the connection can’t keep up.

PSTN switch off for care providers: telecare and personal alarms

Care providers have the most at stake. Personal alarms and telecare devices help vulnerable people call for help, and many were built for analogue lines. The original switch-off date was delayed because of problems with exactly these devices during early migrations.

If you’re a home care agency or care home, ask yourself:

• Do any of the people you support use a pendant alarm or telecare service?
• Has the telecare provider confirmed in writing that the device works on a digital line?
• What happens to that device if the power goes off at the person’s home?

These questions also matter for your own office. If staff, families or commissioners can’t reach you, that’s a risk to the people in your care. Business continuity is also part of how CQC looks at whether a service is well led, so it’s worth having your answers written down.

PSTN switch off checklist: five things to check this week

1. Look at what’s plugged into your phone line. Phones, alarms and card machines might rely on it, even if they don’t plug straight into the wall.
2. Write down every number your clients call you on. Main line, direct lines, any old numbers still printed on letterheads or your website. Each one needs to move.
3. Ask your alarm company if they’re ready for the switch. Get the answer in writing.
4. Try a video call. If it keeps freezing, your broadband may struggle with digital phone calls too. This is common in parts of central London where full fibre isn’t available yet.
5. Find out if your phones still work in a power cut. Digital lines and on-site phone systems need power. A battery backup or calls diverted to mobiles keeps you reachable.

If you answered “not sure” to any of these, it’s worth getting someone to check.

PSTN switch off support in North West and Central London

Guard IQ helps care providers, law firms, accountants and other regulated businesses across North West London, Central London and Hertfordshire get ready for the PSTN switch off with as little disruption as possible.

• A switch-off check. We go through your office and list every device and number that relies on the old network.
• Broadband check. We test whether your connection can carry digital calls and tell you what your options are if full fibre isn’t available.
• Supplier coordination. We deal with your phone provider, alarm company and other suppliers so the right people move the right lines, in the right order.
• Power cut planning. We make sure you can still be reached if the power or internet goes down.
• A plan with dates. You get a written list of what moves, who moves it and when, well before 31 January.

Phones are only one part of your IT. Once the switch is done, we can look after your systems, security and compliance on a fixed monthly plan, so you have one person to call for all of it. Care providers can also see how we support Cyber Essentials certification and DSPT evidence.

PSTN switch off FAQs

When is the PSTN switch off?

The PSTN switch off date is 31 January 2027. Openreach has confirmed there will be no further delay.

Will my landline stop working on 1 February 2027?

Not all at once. Openreach plans a limited emergency calling service for lines that haven’t moved, but it’s a last resort and may not work for every line. Don’t rely on it to keep your business running.

Do I need a new phone system?

Not always. Many modern phone systems can connect to a digital line with a small change. Older on-site systems may need replacing or moving to a cloud phone service. A quick check will tell you which applies.

Will my burglar or fire alarm still work?

Only if it’s been tested on a digital line. Ask your alarm company to confirm in writing. Many older alarm diallers need an upgrade.

Will my card machine still work?

Most newer card machines use broadband or a mobile signal. Older machines that dial out over a phone line will stop working. Check with your payment provider.

What happens to my phones in a power cut?

Digital phones need power, so they stop in a power cut unless you have a battery backup. Diverting calls to mobiles is a simple fallback.

Will I keep my phone number?

Yes, in most cases. Your number can move to the new digital service. Make a list of every number you use so none get missed.

Does the PSTN switch off affect care homes and home care agencies?

Yes. Telecare devices and personal alarms are the highest-risk equipment. Check every device with your telecare provider before 31 January 2027.

Book a free PSTN switch off check

The closer it gets to 31 January 2027, the busier phone providers and engineers will be. If you’re a London business or care provider and you’re not sure where you stand, book a free 30-minute consultation at guardiq.co.uk/book. We’ll tell you what’s affected and what to do next.

Sources

• Openreach confirms post-January 2027 measures for the analogue switch-off, ISPreview
• Openreach says no big bang in January 2027, ISPreview
• Analogue switch-off delayed to 2027, ISPreview

The post PSTN Switch Off 2027: A Guide for London Businesses and Care Providers first appeared on Guard IQ.

For many small firms, the answer decides whether they get shortlisted. A certificate gives buyers a simple, trusted sign that the basics are in place. Without one, you can lose out before anyone reads your proposal.

Here are the certificates worth knowing about, what each one involves, and what it can open up for your business.

1. Cyber Essentials

Cyber Essentials is the UK government-backed scheme, run by IASME with the National Cyber Security Centre. It is the most common starting point for small firms and the one buyers ask for most often.

It covers five areas:

• Firewalls
• Secure settings
• User access control
• Malware protection
• Security updates

What it opens up

• Many central government contracts require it, mainly where personal or sensitive data is handled.
• It is common in wider public sector tenders. It is also growing in private supply chains, where main contractors send security checks down to their suppliers.
• Law firms are often asked for it on panels and in referral deals.
• Eligible UK businesses can get cyber insurance included with it.

What changed in 2026

The current version, v3.3, came into effect on 27 April 2026. Two changes matter for most businesses:

• Multi-factor authentication (MFA) must be switched on for every cloud service where it is available, even where it is a paid extra. Not having it is an automatic fail.
• High-risk and critical security updates must be installed within 14 days of release. This covers operating systems, apps, firewalls and routers.

If your certificate is due for renewal, check both of these before you start. Many firms that passed before will not pass under the new rules without changes. Our free Cyber Essentials readiness checker takes a few minutes and shows where you stand.

2. Cyber Essentials Plus

Cyber Essentials Plus covers the same five areas, but an independent assessor tests your systems instead of relying on your own answers.

What it opens up

• Higher-value public sector and defence supply chain work often asks for Plus.
• It carries more weight in tender scoring because the controls have been checked.

Worth knowing

Under v3.3, if the assessor finds problems on the devices they test, a fresh random sample must be drawn to show the fix has worked. Getting your devices properly managed before the audit saves time and cost.

3. ISO 27001

ISO 27001 is the international standard for managing information security. It goes beyond technical controls. It covers risk, policies, suppliers and regular reviews across the business.

What it opens up

• Larger corporate clients, financial firms and overseas buyers often expect it.
• It can shorten or replace long security questionnaires.
• It shows long-term maturity, which helps in bigger multi-year contracts.

Worth knowing

ISO 27001 is a big job, with external and yearly audits. For most small firms, Cyber Essentials comes first. Holding ISO 27001 does not exempt you from Cyber Essentials where a contract asks for it by name.

4. Data Security and Protection Toolkit (DSPT)

The DSPT is a yearly self-assessment set by the Department of Health and Social Care. It is not a certificate in the usual sense, but for health and care providers it plays the same role.

Who needs it:

• CQC-registered adult social care providers in England
• Anyone with access to NHS patient data or systems
• Suppliers working directly for an NHS body

What it opens up

• Access to NHS.net Connect secure email, GP Connect, shared care records and Proxy Access
• Evidence for CQC under the Well Led key question
• Commissioners are advised to write DSPT at Standards Met into provider contracts. So it now affects who wins local authority and NHS work.

Worth knowing

The DSPT covers far more than IT. Paper records, staff training, verbal sharing and data sharing are all included. Your IT provider can supply the technical evidence, but the submission needs input from across the business. At least 95% of staff must complete yearly data protection training. Our Spot the Phish quiz is a quick way to test where your team is starting from.

5. Other standards to know about

Depending on your sector and clients, you may also come across:

• IASME Cyber Assurance: a step up from Cyber Essentials. It follows the same ideas as ISO 27001 but is built to be easier for small firms to reach.
• PCI DSS: needed if you take, store or process card payments.
• Lexcel: the Law Society’s practice management standard, which includes rules on handling information.
• ICO registration: not a certificate, but a legal must for almost every business that handles personal data. Buyers do check the public register. This matters for accountancy practices and anyone else holding client financial data.

How certificates help you win work

You pass the first filter. Many tenders are pass or fail on certificates. Without one, your pricing and experience never get read.

You score higher. Where security is scored, a recognised certificate earns marks a written answer cannot.

You answer security checks faster. Supply chain questionnaires can run to dozens of questions. A certificate covers many of them in one line.

You make insurance easier. Insurers now ask about MFA, patching and backups. A certificate gives you written answers. You can also check your email security in a few seconds.

You lower your real risk. The controls these schemes need, such as MFA, fast patching and malware protection, block the most common attacks on small businesses. Use our cyber risk cost calculator to see what an incident could cost your business.

Where to start

For most small firms the sensible order is:

1. Check you are registered with the ICO.
2. Get Cyber Essentials in place, and make sure MFA and 14-day patching are covered under v3.3. If you are not sure you will pass, start with a readiness assessment.
3. If you are in health or care, complete the DSPT to Standards Met.
4. Move to Cyber Essentials Plus once you are going after higher-value or public sector contracts.
5. Look at IASME Cyber Assurance or ISO 27001 when larger clients start asking for it.

The hardest part is not the assessment. It is keeping the controls in place all year, so renewal is routine and your evidence is ready when a tender lands. That is what Managed Cyber Essentials is for.

Guard IQ helps regulated businesses across London and Hertfordshire get certified and stay audit-ready all year. Book a free consultation.

The post Which IT Certificates Does Your Business Need to Win Bigger Contracts? first appeared on Guard IQ.

New to the scheme? Start with our guide to what small businesses need to prepare for Cyber Essentials.

What changed

• New rules (v3.3) took effect on 27 April 2026
• The question set is now called Danzell (it replaces Willow)
• Account opened before 27 April: you can use the old rules, with 6 months to finish
• Account opened after 27 April: you’re assessed under v3.3

Change 1: MFA on every cloud service

If a cloud service offers MFA, you must switch it on. This applies even if MFA is a paid extra. Miss one and you fail.

It covers more than Microsoft 365. Check your:

• Accounting and payroll software
• CRM and practice management systems (see the hidden risks in cloud CRMs)
• Care planning, rostering or patient record systems
• Online banking and payment platforms
• File sharing and e-signature tools
• Domain and website hosting accounts

Quick check:

1. List every cloud service your team uses
2. Mark which ones offer MFA
3. Make sure it’s on for every user, including admins and shared accounts
4. Save the list, because you’ll need it for the assessment and next year

MFA works best alongside strong passwords. Test yours with our Password Strength Checker.

Change 2: Critical updates within 14 days

High-risk and critical security updates must go on within 14 days of release. An update counts if the vendor rates it high or critical, or if it fixes a flaw scoring 7 or above on the CVSS v3 scale.

The 14-day rule applies to:

• Operating systems on laptops, desktops, servers and phones
• Apps such as browsers, PDF readers and video calling tools
• Firewalls
• Routers

Where businesses get caught out:

• Routers and firewalls that haven’t been updated in years (5 office network mistakes that put businesses at risk)
• Apps that Windows Update doesn’t patch
• No record of when updates were installed, so there’s no proof
• Old devices or software that no longer get updates, which must be replaced or removed

This is where proactive IT maintenance pays off.

Other changes to know

• Backups get more weight, with a focus on being able to recover your data (the real cost of downtime)
• Passwordless sign-in, such as passkeys and FIDO2 keys, is encouraged
• On Cyber Essentials Plus, fixes are checked on a new random sample of devices
• ISO 27001 doesn’t exempt you

Before you renew

• List every cloud service and its MFA status
• Confirm critical updates reach every device within 14 days, and that you can prove it
• Check router and firewall firmware, and agree who updates them
• Find any device or app that no longer gets updates
• Test that a backup actually restores
• Open your assessment account once all of the above is done

How Guard IQ can help

We help healthcare providers and law firms get ready for Cyber Essentials and stay compliant all year:

• MFA set up and enforced across your systems
• Patching managed, with a record of every update
• Evidence ready well before your assessment date

Healthcare providers can also read our DSPT guide for London clinics. Law firms preparing for Lexcel should see the IT gaps assessors look for.

Try our free Cyber Essentials Readiness Checker
Or call 020 8537 8167 to book a free consultation

The post Cyber Essentials v3.3: The Two Changes That Will Fail Your Renewal 🛡️ first appeared on Guard IQ.

It works because it looks like a Tuesday morning.

If your staff have ever been contacted by an IT provider they did not expect, and did anything other than hang up and call back on a number they already had, this one is worth ten minutes of your time.

What actually happens

Microsoft set out the chain in detail. The short version:

1. First contact through Teams. The attacker operates from an external Microsoft 365 tenant and starts a chat or call posing as internal IT or helpdesk. Common pretexts include a security update, a spam filter update, account verification, or a warning that an account is about to be deactivated. Sometimes they phone as well, so the instructions never appear in the chat log.
2. The user grants remote control. They are talked through approving a “request control” prompt during a Teams screen share, or opening Quick Assist and reading back the connection code. From the user’s side this feels exactly like being helped.
3. Software gets installed silently. Inside that session the attacker runs PowerShell to pull down an installer package from cloud storage and installs it with the interface suppressed. The user sees nothing. The files are named things like “devfix” and “Hotfix” to fit the helpdesk story.
4. The attacker sets up camp. The package stages a legitimate, signed JavaScript runtime downloaded from the official source, then uses it to run an encrypted implant. Because every component is legitimate and signed, tooling that only looks for unsigned executables has nothing to flag. Persistence is set up under an update-themed name so it restarts every time the user logs in.
5. They look around, then move. Screenshots of the desktop are captured periodically. The attacker enumerates domain accounts and servers, then pivots across the network toward domain controllers and certificate authorities.

Microsoft is direct about what that pattern usually precedes: data theft, extortion, ransomware.

The part worth sitting with is that nothing here was hacked. Teams shows external contact warnings, an accept or block prompt, and phishing indicators. The whole attack depends on persuading one person to click past them.

Why this is a small business problem, not just a large one

It is easy to read “domain controllers” and “certificate authorities” and file this under enterprise. Two reasons not to.

First, the entry point is the same everywhere. A 12-person care agency and a 12,000-person bank both run Teams, both have someone who answers messages, and both have staff who have been trained for years that the helpful thing to do is cooperate with IT.

Second, smaller organisations are easier to impersonate. In a large company, an unexpected message from “IT” is odd because nobody knows the IT team anyway, so the culture is to check. In a 10-person firm that outsources IT, staff are used to a named external person contacting them from outside the organisation. That is the normal state. The attacker is not fighting your culture. They are using it.

If you outsource IT, external contact from IT is not a red flag for your staff. It is Tuesday. That is the gap.

Four controls that actually close this

Microsoft’s guidance runs long. Four things carry most of the weight for a small regulated firm.

1. A verification rule your staff can follow under pressure.

Not awareness training in general. One rule, written down, that survives someone sounding urgent and authoritative:

Nobody from IT will ever contact you out of the blue and ask for remote access. If it happens, end the conversation and call the support number yourself. You will never be in trouble for checking.

That last sentence matters more than the rest of it. Most people who fall for this had a doubt and pushed past it, because raising it felt rude. Give them explicit permission and the rule works. Without it, it does not.

If you want to see how your own team would do, our Spot the Phish quiz takes two minutes and is a useful thing to put in front of staff at a team meeting.

2. Restrict who can reach your staff in Teams.

Teams external access can be limited to trusted domains. Most small firms leave it open to the entire world by default and have no idea. If your staff only ever collaborate with a handful of outside organisations, the setting should reflect that. It is a configuration change, not a purchase.

3. Phishing-resistant MFA and Conditional Access.

MFA on its own does not stop someone who has been handed live control of a logged-in machine. Conditional Access, requiring a managed and compliant device, limits what that session is worth. This one also has a compliance edge: under Cyber Essentials Requirements for IT Infrastructure v3.3, effective 27 April 2026, MFA is mandatory on every cloud service where it is available, including where it costs extra. Not enabling it is an automatic fail. If you are certifying or renewing this year, our Cyber Essentials readiness checker will tell you where you currently stand.

4. Control which remote support tools can run at all.

Quick Assist and general-purpose remote support tools are the delivery mechanism here. If your IT provider uses one specific tool, the others should not be usable on your machines. Restricting remote assistance software removes the attacker’s easiest route, and it takes an afternoon.

The awkward question for anyone who outsources IT

This attack impersonates your IT provider. So ask us, or whoever supports you:

• Which channels will you ever contact my staff on, and what will you never ask them to do?
• What number should my team call to verify that a request came from you?
• Which remote support tool do you use, and are the others blocked on our devices?
• Is Teams external access restricted on our tenant, or open to anyone?
• If someone did grant a stranger remote access on Monday morning, what would tell you, and how fast?

A provider who cannot answer the last one has a monitoring gap, and it is the question that decides whether this is an incident or a disaster.

For our part, Guard IQ contacts clients through three channels only: our support email, our office number on 020 8537 8167, and our published WhatsApp number. Anything else claiming to be us is not us. If in doubt, hang up and call the office. We would rather take a hundred unnecessary calls than one that came too late.

If you want a second opinion

We work with care and healthcare providers, law firms, accountancy practices and other regulated businesses across North West London and the Home Counties, where a breach is not just downtime but a reportable incident with a regulator attached.

If you are not sure whether your Teams external access is locked down, whether Conditional Access is doing anything, or what your staff would actually do if a convincing stranger asked for remote control, book a free consultation or call 020 8537 8167.

Source: Microsoft Security Blog, “Impersonating IT support: how threat actors turn a remote session into enterprise-wide access”, 2 September 2026.

The post Someone calls claiming to be your IT support. How does your team check? first appeared on Guard IQ.

That’s a mistake.

Lexcel v6.1 explicitly requires evidence of information security and risk management.

Assessors want to see it working, not just written down; our IT support for solicitors page covers this standard.

Here’s where firms most commonly fall short.

1. Access Control Reviews Exist on Paper, Not in Practice

Lexcel expects a documented process for reviewing who has access to what, and evidence that the review actually happens.

Having an access control policy is not the same as a log.

That log shows you checked it in the last 12 months.

What assessors want to see: a dated record of the last access review, who conducted it, and what changed as a result. This is exactly the kind of gap our managed security and network reliability services are built to close before it becomes a renewal problem.

2. Backup Testing Is Assumed, Not Verified

Almost every firm has backups. Far fewer have proof that a restore actually works. “Backup completed successfully” in a system log is not the same as evidence of a tested, working restore process.

What assessors want to see: a record of an actual restore test, with a date and outcome.

3. Leaver Access Isn’t Closed Down Fast Enough

This is the most common gap we see. It is the easiest to fix. Offboarding isn’t tied to a hard deadline, and a staff member’s system access can stay active for weeks. Lexcel guidance emphasises timely offboarding.

What assessors want to see: a leaver checklist with access revocation as a same-day or next-day step, not a “when we get to it” task.

Why This Matters Beyond the Audit

These aren’t just box-ticking issues. Each one is a real risk:

• Stale access control means former employees or ex-staff retain routes into client data
• Untested backups mean you find out they don’t work during an actual incident, not before
• Delayed leaver offboarding is one of the most common causes of data breaches in professional services

None of these require expensive tooling. They require a documented process someone actually follows.

The DSPT Parallel

This overlap isn’t a coincidence. Moreover, the Data Security and Protection Toolkit assesses care and health providers. Lexcel shows a similar expectation of security discipline, and we apply it across every regulated business we support.

If your practice can’t produce this evidence today, you’re not alone. It’s the single biggest reason Lexcel renewals turn stressful in the final weeks.

Get Ahead of It

We run a free 20-minute IT review for firms heading into Lexcel renewal. Additionally, you will walk away knowing exactly where your access control, backup, and offboarding processes stand against assessor expectations. Before renewal season, full details on what our free cybersecurity and network audit covers are on our homepage.

Book your free review

GuardIQ works with regulated businesses across NW London, including legal practices and care providers, on IT compliance and security aligned to sector-specific standards.

The post Lexcel Renewal IT Gaps first appeared on Guard IQ.

Most IT companies sell you a list of things. Antivirus. Backup. A firewall. A password rule. The list looks reassuring right up until something goes wrong and you find out none of it was joined up.

Good security is simpler than that, and it comes down to three words that have been the foundation of the whole field for decades.

Confidentiality. Integrity. Availability.

Whether you run a care home, a law firm, an accountancy practice or a business with nothing more regulated than a customer database, these three words are what everything else hangs off. They are also what your regulator is measuring you against, even if nobody has ever used the term with you.

Here is what each one means in real life, and what we actually do about it.

Confidentiality: only the right people can see the information

Confidentiality means the people who need to see something can see it, and nobody else can.

This is where most businesses are exposed, and it is almost never because of a hacker in a hoodie. It builds up quietly over years. Staff emailing documents from personal accounts. Records sitting on a laptop nobody has updated in two years. Someone who left last summer whose login still works. One password shared between four people.

We found exactly that at one client before they came to us. Sensitive records were moving through personal email and personal phones. No protection, no control, no way of knowing who had seen what. Nothing had gone wrong yet. It was going to.

How we protect confidentiality

• A second check when anyone logs in, so a stolen password on its own is useless
• Proper business email and file storage, so information stops travelling through personal accounts
• People only get access to what their job needs
• Regular reviews of who can see what, because old access piles up and nobody notices
• Blocking of dangerous websites and fake emails before anyone can click them
• Control over the devices your information sits on

At another client we locked down a system holding highly sensitive records that had almost no protection when we took it on. No incident, no report, no finding at their next inspection. That is the whole point.

Integrity: the information is right and nobody has meddled with it

This is the one everybody forgets about.

Integrity means your information is what it is supposed to be. Not changed. Not corrupted. Not quietly edited by someone who should never have been near it.

For a care provider, this is a medication record that does not match what was actually given. For an accountant, it is bank details on an invoice that are no longer your supplier’s. For a solicitor, it is a file you can no longer swear is a true record of what happened. For everyone else, it is a payment that went to the wrong account because an email looked convincing.

These attacks are quiet and profitable, which is why they are so common.

How we protect integrity

• Software watching every computer for behaviour that looks wrong, rather than waiting for a virus it already recognises
• Automatic updates, because out-of-date software is how people get in and start changing things
• Checks that flag emails pretending to be from someone inside your business
• Monitoring for the hidden email rules attackers set up to cover their tracks
• A record of who did what and when, so if anything is ever questioned you can show it

That last set of controls caught a real attempt at one of our clients. Someone posed as a supplier and tried to redirect an invoice payment to their own account. We blocked it. Not a penny left the business.

Availability: it works when you need it

This is the one every owner understands straight away, because they have lived it. The main system is down. Email is down. Nobody can work, nobody can bill, and in a care setting nobody can safely look after anyone.

Availability is about how fast you get back when something breaks, and whether that recovery is a plan or a panic.

How we protect availability

• Constant monitoring, so we usually know before you ring us
• Backups that we actually test, because an untested backup is a hope
• A written recovery plan for every client, so nothing depends on someone remembering
• Direct access to your engineer. No call centre, no queue, no ticket sitting in a pile
• Response times you can hold us to, written into the agreement

One client lost access to their main operational system after an outage. We had them back in an hour instead of the days a full rebuild would have taken. Staff kept working throughout.

We also moved a growing business off personal email accounts onto proper business systems with zero downtime and nothing lost. Nobody stopped working for a minute.

The three only work if they work together

This is the bit that matters.

Push any one of them too hard and you break another.

Lock everything down and your staff cannot get what they need at 3am, so they invent their own workarounds and you lose confidentiality anyway. Chase availability on its own and you end up with everything open to everyone. Back up all your data with no protection on the backup, and the backup becomes the breach.

Good security is the balance. That is why we do not sell off a list. We look at what information you hold, what your regulator expects, how your team really works, and we build around that.

What the three principles look like in your sector

Care and healthcare. Your DSPT submission asks you to state that personal information is handled safely. A CQC inspector asks you to prove it. Resident records, medication charts and rostering all have to be private, accurate and available at 3am. We have taken more than ten care providers through DSPT to Standards Met.

Legal. Client confidentiality is the whole business. A leaked matter file is a regulatory problem before it is anything else, and a day of downtime is a day of billing you never get back.

Accountancy. You hold client financial data and you work to fixed filing deadlines. Invoice fraud and email compromise target you specifically, and an outage in January is not an inconvenience.

Financial services. Operational resilience and client data protection are watched closely. You are expected to show you have thought about all three principles, not just bought antivirus.

Everyone else. Construction, property, agencies, manufacturers. You may not have a regulator breathing down your neck, but you have GDPR duties, customer data, and a business that stops earning the moment your systems stop working.

What this means when someone asks you to prove it

Regulators do not accept intentions. They ask for evidence.

At one client we showed the evidence at inspection and they passed. The evidence existed because the protections existed, so there was no scramble the night before.

We are Cyber Essentials certified ourselves. That is the difference between a company that talks about compliance and one that has sat in the room and done it.

Common questions about data security

What is the CIA triad in data security?

The CIA triad is the standard model for information security. It stands for confidentiality, integrity and availability. Confidentiality keeps information private. Integrity keeps it accurate. Availability keeps it accessible when needed. Every serious security control exists to support at least one of the three.

Why is integrity the one businesses miss?

Confidentiality and availability are obvious. You notice a leak and you notice an outage. Integrity failures are silent. An invoice with the wrong bank details or a quietly altered record can sit unnoticed for months, which is exactly why attackers favour them.

What does DSPT require from a care provider’s IT?

The Data Security and Protection Toolkit asks you to assert that personal information is handled safely. In practice that means access controls and a second check at login, protected devices, up to date software, tested backups, staff training, and a record of who can see what.

Does my business need Cyber Essentials?

It is mandatory for some government contracts and increasingly expected by insurers, commissioners and larger clients. Beyond that, it is the clearest independent proof that your basic protections are in place, and it takes days rather than months.

What happens if my business has a data breach?

Depending on the data involved you may have to report it to the Information Commissioner’s Office within 72 hours and notify the people affected. Regulated businesses will also answer for it at their next inspection or audit. The reputational cost with clients is usually the part that hurts longest.

How much does managed IT and security cost?

It depends on your headcount and how much security and compliance support you need. What matters more is what is included. A cheap contract that leaves gaps on confidentiality or integrity costs far more the day something goes wrong.

Where to start

If you are not sure whether your setup holds up on all three, the honest answer is usually that it is fine on availability and has gaps on the other two. That is what we find most of the time.

We will look at your systems, tell you plainly where the gaps are, and show you what it takes to close them and prove it to whoever asks.

Guard IQ provides managed IT, security and compliance support to businesses across North West London, Greater London and the Home Counties.

Guard IQ. IT and Security Managed For You.

Book a security and compliance review

The post 🔐 The Three Principles of Data Security Every Business Should Get Right first appeared on Guard IQ.

Small and medium-sized businesses are now frequent targets because criminals know many do not have the time, tools, or internal expertise to monitor their systems properly.

Basic antivirus is no longer enough.

That is where Managed EDR comes in.

Not sure if your business is properly protected? Book a free cybersecurity review with Guard IQ.

What Is Managed EDR?

Managed EDR stands for Managed Endpoint Detection and Response.

An endpoint is any device connected to your business systems, such as a:

Laptop
Desktop
Server
Work device

EDR software monitors these devices for suspicious behaviour, unusual activity, and signs of compromise.

The “managed” part means it is not just installed and forgotten. It is monitored by cybersecurity professionals who review alerts, investigate threats, and respond when something looks wrong.

In simple terms, Managed EDR helps detect and stop threats before they turn into serious incidents.

Want stronger protection across your business devices? Speak to Guard IQ today.

How Is Managed EDR Different From Antivirus?

Traditional antivirus usually looks for known threats. It checks files and programs against a database of recognised malware.

That is useful, but modern attacks are often more sophisticated.

Cyber criminals may use:

Stolen passwords
Fake invoices
Malicious scripts
Built-in Windows tools
Phishing emails
Ransomware

Managed EDR goes further by looking at behaviour, not just known viruses.

For example, it can flag activity such as:

A user account suddenly accessing large numbers of files
A device trying to connect to suspicious servers
Malware attempting to disable security tools
Unusual PowerShell or command-line activity
Signs of ransomware encryption starting
A laptop behaving differently from normal

This gives your business a much better chance of spotting an attack early.

If you are only relying on standard antivirus, it may be time to review your setup.

The Main Benefits of Managed EDR

1. Faster Threat Detection

The earlier you detect a cyber attack, the less damage it can cause.

Managed EDR continuously monitors your devices and looks for signs of suspicious behaviour. Instead of waiting until files are encrypted, accounts are compromised, or data is stolen, threats can be identified much earlier.

This is especially important for businesses that hold:

Client data
Financial records
Staff information
Patient or service user records
Sensitive documents

Early detection can be the difference between a small issue and a serious business incident.

2. Expert Monitoring Without Hiring an Internal Security Team

Most small businesses cannot justify hiring a full-time cybersecurity analyst. Even if they could, finding the right person is difficult and expensive.

Managed EDR gives your business access to specialist monitoring without the cost of building an internal security team.

The service provider reviews alerts, investigates issues, and helps decide what action needs to be taken.

This reduces the risk of important warnings being missed or ignored.

Guard IQ can help monitor and manage your endpoint protection, so your team can focus on running the business.

3. Protection Against Ransomware

Ransomware remains one of the most damaging types of cyber attack.

It can lock your files, stop your staff from working, and leave your business facing serious recovery costs.

Managed EDR can help detect early signs of ransomware activity, such as:

Unusual file changes
Suspicious processes
Attempts to disable security software
Activity spreading across devices
Mass file encryption behaviour

In many cases, fast detection and response can make the difference between a contained incident and a major business disruption.

Do not wait until your files are encrypted. Put protection in place before an incident happens.

4. Better Incident Response

When something goes wrong, speed matters.

Managed EDR can help identify:

Which device is affected
What happened
Where the threat came from
Whether it has spread
What needs to be done next

Depending on the setup, it may also allow the affected device to be isolated from the network to stop the threat spreading.

This gives your business a clearer, faster response plan instead of guessing under pressure.

Need a stronger incident response process? Guard IQ can help you put one in place.

5. Improved Compliance and Client Confidence

Many businesses now need to show that they take cybersecurity seriously.

This is particularly important for sectors such as:

Care providers
Law firms
Accountants
Professional services
Healthcare providers
Finance-related businesses

Clients, insurers, regulators, and supply chain partners increasingly expect businesses to have appropriate security controls in place.

Managed EDR can support wider requirements linked to:

Cyber Essentials
Cyber Essentials Plus
DSPT
Insurance questionnaires
Data protection expectations
Client due diligence

It shows that your business is not only trying to prevent attacks, but also actively monitoring for them.

Preparing for Cyber Essentials, DSPT, or a client security questionnaire? Guard IQ can help.

6. Reduced Downtime and Business Disruption

A serious cyber incident can stop a business from operating.

Staff may lose access to:

Emails
Files
Business systems
Client records
Billing and finance tools

Managed EDR helps reduce this risk by detecting threats early and supporting a faster response.

For many businesses, the cost of downtime can quickly exceed the cost of proper protection.

If your business cannot afford days of disruption, Managed EDR should be part of your security strategy.

7. Clearer Visibility Across Your Devices

Many businesses do not have a clear view of what is happening across their laptops, desktops, and servers.

Managed EDR provides better visibility into device activity, security events, and potential risks.

It can help answer important questions such as:

Which devices are protected?
Has anything suspicious happened?
Are any machines behaving unusually?
Where did an incident start?
Has the threat spread anywhere else?

Without this visibility, businesses are often working blind.

Guard IQ can help you understand what is happening across your devices and where your risks are.

Who Needs Managed EDR?

Managed EDR is especially useful for businesses that:

Handle client, patient, or financial data
Use Microsoft 365 heavily
Have staff working remotely
Need to meet compliance or insurance requirements
Cannot afford prolonged downtime
Do not have an internal cybersecurity team
Want stronger protection than basic antivirus

For small businesses, it is one of the most practical ways to improve cyber resilience without overcomplicating things.

Not sure whether Managed EDR is right for your business? Book a free consultation with Guard IQ.

Is Managed EDR Worth It for Small Businesses?

Yes, for many businesses it is.

The cost of a cyber incident is rarely limited to fixing the infected device.

It can include:

Emergency IT support
Lost working time
Data recovery
Regulatory reporting
Reputational damage
Loss of client trust
Lost revenue

Managed EDR is not just another security product. It is a way of reducing business risk.

It gives you stronger protection, expert oversight, and a much better chance of stopping threats before they cause serious damage.

The real question is not just “Can we afford Managed EDR?” It is “Can we afford to be without it?”

How Guard IQ Can Help

At Guard IQ, we help businesses put the right cybersecurity protections in place without unnecessary complexity.

We can help with:

Managed EDR deployment
Threat monitoring
Alert investigation
Device protection
Microsoft 365 security
Cyber Essentials support
DSPT support
Backup and monitoring
Incident response planning
Ongoing IT support

We make sure your business has practical protection in place, without overloading you with jargon or unnecessary tools.

If you are not sure whether your current antivirus is enough, we can review your setup and recommend the right level of protection.

Final Thoughts

Cyber attacks are becoming more common, more automated, and harder to spot.

Managed EDR gives your business a stronger line of defence by combining advanced detection technology with expert human monitoring.

For businesses that rely on their systems, data, and client trust, it is no longer a luxury. It is becoming a sensible baseline for modern cybersecurity.

Ready to strengthen your business security?

Book a free consultation with Guard IQ today and find out whether Managed EDR is the right fit for your business.

Visit: www.guardiq.co.uk

The post What Is Managed EDR and Why Does Your Business Need It? 🛡️ first appeared on Guard IQ.

The Double-Edged Sword of AI

AI tools are genuinely useful. They help businesses write faster, analyse data, automate repetitive tasks, and serve customers better. Most business owners are aware of this side of the story.

What gets far less attention is the other side. The same AI tools that are helping legitimate businesses work smarter are being used by cybercriminals to attack faster, more convincingly, and at a scale that wasn’t possible two years ago.

The threat landscape hasn’t just grown. It has fundamentally changed.

How AI Is Being Used to Attack Businesses

Phishing Emails That Are Almost Impossible to Spot

Traditional phishing emails were relatively easy to identify. Poor grammar, generic greetings, obvious spelling mistakes. Most people learned to spot them.

AI has changed that completely. Criminals now use large language models to generate phishing emails that are grammatically perfect, contextually relevant, and personalised to the recipient. They can scrape your LinkedIn profile, your company website, and public information to craft an email that references your actual clients, your team members, or a recent project.

The result is emails that look entirely legitimate – from what appears to be a trusted contact, referencing something real, asking for something plausible. The click rate on AI-generated phishing emails is significantly higher than traditional attacks.

Deepfake Voice and Video Fraud

This is newer and less well known, but it is already happening to businesses in the UK.

AI can now clone a person’s voice from as little as a few seconds of audio. Criminals use this to impersonate senior executives, calling finance teams and instructing them to make urgent bank transfers. In some cases, video deepfakes have been used in fake video calls to add further credibility.

A finance manager receiving a call that sounds exactly like the CEO asking for a same-day payment is in a genuinely difficult position. This type of attack bypasses almost all traditional security awareness training because the threat doesn’t look like a threat.

Automated Vulnerability Scanning

Previously, identifying weaknesses in a business’s IT systems required skilled human attackers spending significant time on reconnaissance. AI has automated this process.

Criminal tools can now scan thousands of businesses simultaneously, identifying unpatched software, misconfigured systems, weak passwords, and open ports – all without human involvement. By the time an attack is launched, the groundwork has already been done automatically.

For small businesses that haven’t kept their systems up to date, this significantly increases the likelihood of being targeted.

AI-Generated Malware

Security tools work partly by recognising the signatures of known malware. AI is now being used to generate malware that constantly rewrites its own code, making it harder for traditional antivirus software to detect. Each variant looks different enough to avoid detection while doing the same damage.

Why SMEs Are Particularly Vulnerable

Large enterprises have dedicated security teams, enterprise-grade tools, and significant budgets for threat detection. SMEs typically have none of these things.

Cybercriminals know this. SMEs are attractive targets precisely because they hold valuable data – client records, financial information, payment details – but often have minimal defences in place. AI-powered attacks make it economical to target smaller businesses at scale in a way that wasn’t viable before.

The assumption that small businesses aren’t worth attacking is no longer true. Automated tools make it just as easy to attack a ten-person business as a thousand-person enterprise.

What This Means in Practice

The types of incidents Guard IQ sees most frequently among SMEs in London:

Business email compromise – a staff member receives a convincing email from what appears to be a supplier or director, makes a payment, and the money is gone.

Ransomware – systems are encrypted and the business is unable to operate until a ransom is paid or systems are restored from backup.

Credential theft – login details are stolen through phishing, giving criminals access to email accounts, cloud storage, or financial systems.

All three are increasingly being enabled or enhanced by AI tools on the attacker’s side.

What You Can Do About It

The good news is that the fundamentals of protection haven’t changed, even if the threats have.

Multi-factor authentication – even if a password is stolen, MFA stops the attacker from getting in. This is the single highest-impact control for most SMEs.

Email security – modern email filtering uses AI on the defensive side to detect and quarantine suspicious emails before they reach your inbox.

Staff awareness – your team needs to know that phishing emails no longer look like phishing emails. Training needs to reflect the current threat, not the threats of five years ago.

Endpoint detection and response – traditional antivirus is no longer sufficient. EDR tools monitor behaviour rather than just signatures, catching threats that signature-based tools miss.

Patching and updates – automated vulnerability scanning finds unpatched systems. Keeping software up to date removes the most commonly exploited entry points.

None of these require an enterprise budget. They do require someone who knows what they’re doing to implement and manage them properly.

The Bottom Line

AI is not a future threat. It is being used against businesses right now, today, including small businesses that assume they are too small to be worth targeting.

The businesses that will come out of this period in good shape are the ones that treat cybersecurity as an ongoing managed function rather than a one-off project.

If you’re not sure where your business currently stands, the right first step is a straightforward security assessment.

We’ll assess your current setup, identify the gaps, and tell you honestly what you need to protect your business. No sales pitch. No obligation.

Guard IQ Ltd is a Cyber Essentials certified managed IT and security provider based in North West London, supporting SMEs across London and the Home Counties.

The post Why AI Is the Biggest Cybersecurity Threat Facing SMEs Right Now first appeared on Guard IQ.

What Is ISO 27001?

ISO 27001 is an internationally recognised standard for information security management. In plain English, it’s a framework that proves your business takes the security of its data seriously and has the policies, processes, and controls in place to back that up.

Getting certified means an accredited body has independently audited your business and confirmed that your approach to information security meets the standard. It’s not a one-off tick box. It requires ongoing maintenance and regular reviews to keep the certification active.

What Does ISO 27001 Actually Cover?

The standard covers how your business manages information security across three areas:

People: Do your staff understand their responsibilities around data? Are there clear policies covering acceptable use, access controls, and what to do if something goes wrong?

Processes: Does your business have documented procedures for managing risks, handling incidents, and reviewing security regularly?

Technology: Are the right technical controls in place to protect your systems, devices, and data from unauthorised access or loss?

ISO 27001 doesn’t prescribe exactly what tools you use. It requires you to assess your risks and implement controls that are appropriate for your business.

Who Asks for ISO 27001?

Typically, larger enterprises, public sector bodies, and regulated organisations require their suppliers and partners to hold ISO 27001 certification before they’ll do business with them. If you’re trying to win contracts with NHS trusts, central government, financial institutions, or large corporates, there’s a good chance ISO 27001 will come up.

It’s also increasingly requested by cyber insurers as a condition of coverage, particularly for businesses handling large volumes of sensitive data.

Does Your Business Need ISO 27001?

The honest answer is: it depends on who you’re selling to and what data you handle.

You likely need ISO 27001 if:

• A current or prospective client has asked you for it directly
• You’re tendering for public sector or NHS contracts
• Your cyber insurer has raised it as a requirement
• You handle large volumes of sensitive personal or financial data
• You want to differentiate your business in a competitive market

You probably don’t need ISO 27001 right now if:

• Your clients are small businesses with no formal supplier requirements
• You’re an SME with under 20 staff and no regulated sector clients
• You haven’t been asked for it yet

For most small businesses in London, Cyber Essentials is the more appropriate starting point. It’s government-backed, faster to achieve, less expensive, and required for central government contracts. Many businesses treat it as the foundation before pursuing ISO 27001 as they grow.

How Long Does ISO 27001 Take?

For a small to medium business, the process typically takes between three and twelve months depending on how mature your existing security practices are. Businesses starting from scratch will need longer. Those who already have Cyber Essentials or documented security policies in place will move faster.

The process involves a gap analysis, implementing the required controls, internal audits, and a two-stage external audit by an accredited certification body.

What’s the Difference Between ISO 27001 and Cyber Essentials?

Where Does Guard IQ Fit In?

Guard IQ helps London SMEs navigate compliance requirements, from Cyber Essentials and DSPT through to preparing for ISO 27001. If you’ve been asked about ISO 27001 and aren’t sure where to start, the right first step is understanding where your business currently stands.

We offer a free consultation to assess your current security posture and give you an honest view of what you need and what you don’t.

Book a Free Consultation

No obligation. No jargon. Just a straight conversation about where your business stands.

Guard IQ Ltd is a Cyber Essentials certified managed IT and security provider based in North West London, supporting SMEs across London and the Home Counties.

The post What Is ISO 27001 and Does Your Business Need It? first appeared on Guard IQ.

If you run a GP surgery, dental clinic, or private practice in NW or Central London, the NHS Data Security and Protection Toolkit (DSPT) can feel like another box-ticking headache. It doesn’t have to. Below is a plain-English guide to what the DSPT asks for, the pitfalls we see every week, and the fastest ways to get it sorted without derailing patient care.

What DSPT actually is

The DSPT is an online self-assessment that proves you handle patient data safely. Think of it as a yearly MOT for your IT and data processes: confirm the basics, fix anything obvious, and log the evidence, no essays, just clear yes/no answers backed up with simple docs (for example, an access-control list or a Wi-Fi security screenshot).

Why it matters to smaller practices

• You cannot legally share data with NHS bodies unless your DSPT is at Standards Met.
• Some insurers now request your DSPT status before renewing cyber cover.
• A clean DSPT record reassures patients that you take confidentiality seriously, without blowing the budget on enterprise tools.

Common sticking points

1. Old routers left on factory passwords – easy to fix, often missed.
2. Shared logins for email and cloud records – fails DSPT’s “unique user ID” test.
3. No written process for lost or stolen laptops – yet most clinicians work on the move.
4. Unpatched PCs running the reception desk – quick win with automatic updates.
5. Wi-Fi network not separated for guests – patient data should never ride on the public signal.

If any of these sound familiar, Get in Touch

A calm, practical route to compliance

Guard IQ keeps DSPT support as straightforward as any other IT issue:

Throughout the work we explain everything clearly and only recommend steps that genuinely tighten security or cut downtime.

Quick checklist you can run today

• Change any default router or Wi-Fi passwords.
• Make sure every staff member has a unique login for email and clinical apps.
• Enable automatic updates on all PCs and laptops.
• Draft a one-page “lost device” process and store it where staff can find it.
• Separate guest Wi-Fi from your clinical network.

The post DSPT Compliance for London Clinics 💊 first appeared on Guard IQ.