For many small firms, the answer decides whether they get shortlisted. A certificate gives buyers a simple, trusted sign that the basics are in place. Without one, you can lose out before anyone reads your proposal.

Here are the certificates worth knowing about, what each one involves, and what it can open up for your business.

1. Cyber Essentials

Cyber Essentials is the UK government-backed scheme, run by IASME with the National Cyber Security Centre. It is the most common starting point for small firms and the one buyers ask for most often.

It covers five areas:

• Firewalls
• Secure settings
• User access control
• Malware protection
• Security updates

What it opens up

• Many central government contracts require it, mainly where personal or sensitive data is handled.
• It is common in wider public sector tenders. It is also growing in private supply chains, where main contractors send security checks down to their suppliers.
• Law firms are often asked for it on panels and in referral deals.
• Eligible UK businesses can get cyber insurance included with it.

What changed in 2026

The current version, v3.3, came into effect on 27 April 2026. Two changes matter for most businesses:

• Multi-factor authentication (MFA) must be switched on for every cloud service where it is available, even where it is a paid extra. Not having it is an automatic fail.
• High-risk and critical security updates must be installed within 14 days of release. This covers operating systems, apps, firewalls and routers.

If your certificate is due for renewal, check both of these before you start. Many firms that passed before will not pass under the new rules without changes. Our free Cyber Essentials readiness checker takes a few minutes and shows where you stand.

2. Cyber Essentials Plus

Cyber Essentials Plus covers the same five areas, but an independent assessor tests your systems instead of relying on your own answers.

What it opens up

• Higher-value public sector and defence supply chain work often asks for Plus.
• It carries more weight in tender scoring because the controls have been checked.

Worth knowing

Under v3.3, if the assessor finds problems on the devices they test, a fresh random sample must be drawn to show the fix has worked. Getting your devices properly managed before the audit saves time and cost.

3. ISO 27001

ISO 27001 is the international standard for managing information security. It goes beyond technical controls. It covers risk, policies, suppliers and regular reviews across the business.

What it opens up

• Larger corporate clients, financial firms and overseas buyers often expect it.
• It can shorten or replace long security questionnaires.
• It shows long-term maturity, which helps in bigger multi-year contracts.

Worth knowing

ISO 27001 is a big job, with external and yearly audits. For most small firms, Cyber Essentials comes first. Holding ISO 27001 does not exempt you from Cyber Essentials where a contract asks for it by name.

4. Data Security and Protection Toolkit (DSPT)

The DSPT is a yearly self-assessment set by the Department of Health and Social Care. It is not a certificate in the usual sense, but for health and care providers it plays the same role.

Who needs it:

• CQC-registered adult social care providers in England
• Anyone with access to NHS patient data or systems
• Suppliers working directly for an NHS body

What it opens up

• Access to NHS.net Connect secure email, GP Connect, shared care records and Proxy Access
• Evidence for CQC under the Well Led key question
• Commissioners are advised to write DSPT at Standards Met into provider contracts. So it now affects who wins local authority and NHS work.

Worth knowing

The DSPT covers far more than IT. Paper records, staff training, verbal sharing and data sharing are all included. Your IT provider can supply the technical evidence, but the submission needs input from across the business. At least 95% of staff must complete yearly data protection training. Our Spot the Phish quiz is a quick way to test where your team is starting from.

5. Other standards to know about

Depending on your sector and clients, you may also come across:

• IASME Cyber Assurance: a step up from Cyber Essentials. It follows the same ideas as ISO 27001 but is built to be easier for small firms to reach.
• PCI DSS: needed if you take, store or process card payments.
• Lexcel: the Law Society’s practice management standard, which includes rules on handling information.
• ICO registration: not a certificate, but a legal must for almost every business that handles personal data. Buyers do check the public register. This matters for accountancy practices and anyone else holding client financial data.

How certificates help you win work

You pass the first filter. Many tenders are pass or fail on certificates. Without one, your pricing and experience never get read.

You score higher. Where security is scored, a recognised certificate earns marks a written answer cannot.

You answer security checks faster. Supply chain questionnaires can run to dozens of questions. A certificate covers many of them in one line.

You make insurance easier. Insurers now ask about MFA, patching and backups. A certificate gives you written answers. You can also check your email security in a few seconds.

You lower your real risk. The controls these schemes need, such as MFA, fast patching and malware protection, block the most common attacks on small businesses. Use our cyber risk cost calculator to see what an incident could cost your business.

Where to start

For most small firms the sensible order is:

1. Check you are registered with the ICO.
2. Get Cyber Essentials in place, and make sure MFA and 14-day patching are covered under v3.3. If you are not sure you will pass, start with a readiness assessment.
3. If you are in health or care, complete the DSPT to Standards Met.
4. Move to Cyber Essentials Plus once you are going after higher-value or public sector contracts.
5. Look at IASME Cyber Assurance or ISO 27001 when larger clients start asking for it.

The hardest part is not the assessment. It is keeping the controls in place all year, so renewal is routine and your evidence is ready when a tender lands. That is what Managed Cyber Essentials is for.

Guard IQ helps regulated businesses across London and Hertfordshire get certified and stay audit-ready all year. Book a free consultation.

The post Which IT Certificates Does Your Business Need to Win Bigger Contracts? first appeared on Guard IQ.

That’s a mistake.

Lexcel v6.1 explicitly requires evidence of information security and risk management.

Assessors want to see it working, not just written down; our IT support for solicitors page covers this standard.

Here’s where firms most commonly fall short.

1. Access Control Reviews Exist on Paper, Not in Practice

Lexcel expects a documented process for reviewing who has access to what, and evidence that the review actually happens.

Having an access control policy is not the same as a log.

That log shows you checked it in the last 12 months.

What assessors want to see: a dated record of the last access review, who conducted it, and what changed as a result. This is exactly the kind of gap our managed security and network reliability services are built to close before it becomes a renewal problem.

2. Backup Testing Is Assumed, Not Verified

Almost every firm has backups. Far fewer have proof that a restore actually works. “Backup completed successfully” in a system log is not the same as evidence of a tested, working restore process.

What assessors want to see: a record of an actual restore test, with a date and outcome.

3. Leaver Access Isn’t Closed Down Fast Enough

This is the most common gap we see. It is the easiest to fix. Offboarding isn’t tied to a hard deadline, and a staff member’s system access can stay active for weeks. Lexcel guidance emphasises timely offboarding.

What assessors want to see: a leaver checklist with access revocation as a same-day or next-day step, not a “when we get to it” task.

Why This Matters Beyond the Audit

These aren’t just box-ticking issues. Each one is a real risk:

• Stale access control means former employees or ex-staff retain routes into client data
• Untested backups mean you find out they don’t work during an actual incident, not before
• Delayed leaver offboarding is one of the most common causes of data breaches in professional services

None of these require expensive tooling. They require a documented process someone actually follows.

The DSPT Parallel

This overlap isn’t a coincidence. Moreover, the Data Security and Protection Toolkit assesses care and health providers. Lexcel shows a similar expectation of security discipline, and we apply it across every regulated business we support.

If your practice can’t produce this evidence today, you’re not alone. It’s the single biggest reason Lexcel renewals turn stressful in the final weeks.

Get Ahead of It

We run a free 20-minute IT review for firms heading into Lexcel renewal. Additionally, you will walk away knowing exactly where your access control, backup, and offboarding processes stand against assessor expectations. Before renewal season, full details on what our free cybersecurity and network audit covers are on our homepage.

Book your free review

GuardIQ works with regulated businesses across NW London, including legal practices and care providers, on IT compliance and security aligned to sector-specific standards.

The post Lexcel Renewal IT Gaps first appeared on Guard IQ.

Most IT companies sell you a list of things. Antivirus. Backup. A firewall. A password rule. The list looks reassuring right up until something goes wrong and you find out none of it was joined up.

Good security is simpler than that, and it comes down to three words that have been the foundation of the whole field for decades.

Confidentiality. Integrity. Availability.

Whether you run a care home, a law firm, an accountancy practice or a business with nothing more regulated than a customer database, these three words are what everything else hangs off. They are also what your regulator is measuring you against, even if nobody has ever used the term with you.

Here is what each one means in real life, and what we actually do about it.

Confidentiality: only the right people can see the information

Confidentiality means the people who need to see something can see it, and nobody else can.

This is where most businesses are exposed, and it is almost never because of a hacker in a hoodie. It builds up quietly over years. Staff emailing documents from personal accounts. Records sitting on a laptop nobody has updated in two years. Someone who left last summer whose login still works. One password shared between four people.

We found exactly that at one client before they came to us. Sensitive records were moving through personal email and personal phones. No protection, no control, no way of knowing who had seen what. Nothing had gone wrong yet. It was going to.

How we protect confidentiality

• A second check when anyone logs in, so a stolen password on its own is useless
• Proper business email and file storage, so information stops travelling through personal accounts
• People only get access to what their job needs
• Regular reviews of who can see what, because old access piles up and nobody notices
• Blocking of dangerous websites and fake emails before anyone can click them
• Control over the devices your information sits on

At another client we locked down a system holding highly sensitive records that had almost no protection when we took it on. No incident, no report, no finding at their next inspection. That is the whole point.

Integrity: the information is right and nobody has meddled with it

This is the one everybody forgets about.

Integrity means your information is what it is supposed to be. Not changed. Not corrupted. Not quietly edited by someone who should never have been near it.

For a care provider, this is a medication record that does not match what was actually given. For an accountant, it is bank details on an invoice that are no longer your supplier’s. For a solicitor, it is a file you can no longer swear is a true record of what happened. For everyone else, it is a payment that went to the wrong account because an email looked convincing.

These attacks are quiet and profitable, which is why they are so common.

How we protect integrity

• Software watching every computer for behaviour that looks wrong, rather than waiting for a virus it already recognises
• Automatic updates, because out-of-date software is how people get in and start changing things
• Checks that flag emails pretending to be from someone inside your business
• Monitoring for the hidden email rules attackers set up to cover their tracks
• A record of who did what and when, so if anything is ever questioned you can show it

That last set of controls caught a real attempt at one of our clients. Someone posed as a supplier and tried to redirect an invoice payment to their own account. We blocked it. Not a penny left the business.

Availability: it works when you need it

This is the one every owner understands straight away, because they have lived it. The main system is down. Email is down. Nobody can work, nobody can bill, and in a care setting nobody can safely look after anyone.

Availability is about how fast you get back when something breaks, and whether that recovery is a plan or a panic.

How we protect availability

• Constant monitoring, so we usually know before you ring us
• Backups that we actually test, because an untested backup is a hope
• A written recovery plan for every client, so nothing depends on someone remembering
• Direct access to your engineer. No call centre, no queue, no ticket sitting in a pile
• Response times you can hold us to, written into the agreement

One client lost access to their main operational system after an outage. We had them back in an hour instead of the days a full rebuild would have taken. Staff kept working throughout.

We also moved a growing business off personal email accounts onto proper business systems with zero downtime and nothing lost. Nobody stopped working for a minute.

The three only work if they work together

This is the bit that matters.

Push any one of them too hard and you break another.

Lock everything down and your staff cannot get what they need at 3am, so they invent their own workarounds and you lose confidentiality anyway. Chase availability on its own and you end up with everything open to everyone. Back up all your data with no protection on the backup, and the backup becomes the breach.

Good security is the balance. That is why we do not sell off a list. We look at what information you hold, what your regulator expects, how your team really works, and we build around that.

What the three principles look like in your sector

Care and healthcare. Your DSPT submission asks you to state that personal information is handled safely. A CQC inspector asks you to prove it. Resident records, medication charts and rostering all have to be private, accurate and available at 3am. We have taken more than ten care providers through DSPT to Standards Met.

Legal. Client confidentiality is the whole business. A leaked matter file is a regulatory problem before it is anything else, and a day of downtime is a day of billing you never get back.

Accountancy. You hold client financial data and you work to fixed filing deadlines. Invoice fraud and email compromise target you specifically, and an outage in January is not an inconvenience.

Financial services. Operational resilience and client data protection are watched closely. You are expected to show you have thought about all three principles, not just bought antivirus.

Everyone else. Construction, property, agencies, manufacturers. You may not have a regulator breathing down your neck, but you have GDPR duties, customer data, and a business that stops earning the moment your systems stop working.

What this means when someone asks you to prove it

Regulators do not accept intentions. They ask for evidence.

At one client we showed the evidence at inspection and they passed. The evidence existed because the protections existed, so there was no scramble the night before.

We are Cyber Essentials certified ourselves. That is the difference between a company that talks about compliance and one that has sat in the room and done it.

Common questions about data security

What is the CIA triad in data security?

The CIA triad is the standard model for information security. It stands for confidentiality, integrity and availability. Confidentiality keeps information private. Integrity keeps it accurate. Availability keeps it accessible when needed. Every serious security control exists to support at least one of the three.

Why is integrity the one businesses miss?

Confidentiality and availability are obvious. You notice a leak and you notice an outage. Integrity failures are silent. An invoice with the wrong bank details or a quietly altered record can sit unnoticed for months, which is exactly why attackers favour them.

What does DSPT require from a care provider’s IT?

The Data Security and Protection Toolkit asks you to assert that personal information is handled safely. In practice that means access controls and a second check at login, protected devices, up to date software, tested backups, staff training, and a record of who can see what.

Does my business need Cyber Essentials?

It is mandatory for some government contracts and increasingly expected by insurers, commissioners and larger clients. Beyond that, it is the clearest independent proof that your basic protections are in place, and it takes days rather than months.

What happens if my business has a data breach?

Depending on the data involved you may have to report it to the Information Commissioner’s Office within 72 hours and notify the people affected. Regulated businesses will also answer for it at their next inspection or audit. The reputational cost with clients is usually the part that hurts longest.

How much does managed IT and security cost?

It depends on your headcount and how much security and compliance support you need. What matters more is what is included. A cheap contract that leaves gaps on confidentiality or integrity costs far more the day something goes wrong.

Where to start

If you are not sure whether your setup holds up on all three, the honest answer is usually that it is fine on availability and has gaps on the other two. That is what we find most of the time.

We will look at your systems, tell you plainly where the gaps are, and show you what it takes to close them and prove it to whoever asks.

Guard IQ provides managed IT, security and compliance support to businesses across North West London, Greater London and the Home Counties.

Guard IQ. IT and Security Managed For You.

Book a security and compliance review

The post 🔐 The Three Principles of Data Security Every Business Should Get Right first appeared on Guard IQ.

If you run a GP surgery, dental clinic, or private practice in NW or Central London, the NHS Data Security and Protection Toolkit (DSPT) can feel like another box-ticking headache. It doesn’t have to. Below is a plain-English guide to what the DSPT asks for, the pitfalls we see every week, and the fastest ways to get it sorted without derailing patient care.

What DSPT actually is

The DSPT is an online self-assessment that proves you handle patient data safely. Think of it as a yearly MOT for your IT and data processes: confirm the basics, fix anything obvious, and log the evidence, no essays, just clear yes/no answers backed up with simple docs (for example, an access-control list or a Wi-Fi security screenshot).

Why it matters to smaller practices

• You cannot legally share data with NHS bodies unless your DSPT is at Standards Met.
• Some insurers now request your DSPT status before renewing cyber cover.
• A clean DSPT record reassures patients that you take confidentiality seriously, without blowing the budget on enterprise tools.

Common sticking points

1. Old routers left on factory passwords – easy to fix, often missed.
2. Shared logins for email and cloud records – fails DSPT’s “unique user ID” test.
3. No written process for lost or stolen laptops – yet most clinicians work on the move.
4. Unpatched PCs running the reception desk – quick win with automatic updates.
5. Wi-Fi network not separated for guests – patient data should never ride on the public signal.

If any of these sound familiar, Get in Touch

A calm, practical route to compliance

Guard IQ keeps DSPT support as straightforward as any other IT issue:

Throughout the work we explain everything clearly and only recommend steps that genuinely tighten security or cut downtime.

Quick checklist you can run today

• Change any default router or Wi-Fi passwords.
• Make sure every staff member has a unique login for email and clinical apps.
• Enable automatic updates on all PCs and laptops.
• Draft a one-page “lost device” process and store it where staff can find it.
• Separate guest Wi-Fi from your clinical network.

The post DSPT Compliance for London Clinics 💊 first appeared on Guard IQ.