Guides
Guides
In-depth, sourced guides for IT teams and business owners. Start with the overview for each subject, then go to the guide you need.
Backup and recovery
8 guidesBuilding backups that survive ransomware, setting recovery targets, keeping copies for the right length of time and testing that restores work.
Start hereBusiness backup and recovery: the UK guideA starting point for backup and disaster recovery in UK organisations. What the NCSC says matters most, the key terms, and links to our detailed…The 3-2-1 backup rule, and how to actually do it in 2026
The 3-2-1 backup rule means three copies, two media types, one offsite. Here is what it does not cover, how 3-2-1-1-0 fills the gap, and worked…
Backup & RecoveryImmutable vs air-gapped backups, and how long to keep them
An immutable backup cannot be changed or deleted until its retention period ends. An air-gapped backup has no automated connection to your systems at…
Backup & RecoveryRPO, RTO and MTD explained, and how to set them
RPO is how much data you can afford to lose, RTO is how long recovery can take, and MTD is how long the business can be disrupted before the harm is…
Backup & RecoveryBackup vs disaster recovery, and BC vs DR plans explained
A backup is a copy of your data. Disaster recovery is the plan for getting systems running again after a major failure, and business continuity is…
Backup & RecoveryHow often should you test DR and business continuity plans?
At least once a year, and again after any major disruption or change. Here is where that yearly minimum comes from, which test to run, and how to run…
Backup & RecoveryBackup retention policy: how to set one, with examples
A backup retention policy says how long each backup is kept before it is deleted. Here is what the NCSC, the ICO and HMRC's record rules mean for…
Backup & RecoveryOffsite backup for small businesses, including your NAS
A NAS in the office is a good backup target, but it is not offsite and ransomware can reach it. Here is what the NCSC says about offline and cloud…
Backup & RecoveryMicrosoft 365 and Google Workspace backup: what's covered
Microsoft 365 and Google Workspace keep deleted email and files for a while, but those windows are short and they are not the same as a backup. Here…
Ransomware
3 guidesWhat to do before, during and after a ransomware attack: protecting backups, responding, reporting and the ransom decision.
Start hereRansomware guide for UK organisations: before, during, afterWhat UK organisations should do about ransomware before an attack, during one and after it, based on NCSC, ICO and government guidance, with links to…Should you pay a ransomware demand? The UK position
Paying a ransom is not banned for most UK businesses, but paying a sanctioned group is a criminal offence, public bodies face a proposed ban, and the…
Backup & RecoveryRansomware recovery and incident response plan: a UK guide
What a ransomware incident response plan should contain, the four stages the NCSC sets out for handling an attack, who to tell and when, and how to…
SecurityMDR vs EDR vs XDR: what is the difference?
A plain-English comparison of EDR, XDR and MDR, where SIEM and SOAR fit, and how a small or mid-sized business chooses between them.
UK cyber compliance
5 guidesThe rules and certifications IT teams meet most: Cyber Essentials, ISO 27001, NIS and the Cyber Security and Resilience Bill, UK GDPR and DORA.
Start hereUK cyber security compliance: a guide for IT teamsThe UK cyber security rules and certifications IT teams meet most often, in one place: Cyber Essentials, ISO 27001, the NIS Regulations and the Cyber…Cyber Essentials vs Plus: cost, renewal and requirements
Cyber Essentials and Cyber Essentials Plus check the same five technical controls. The difference is who checks them: Cyber Essentials is a verified…
SecurityCyber Essentials Plus vs ISO 27001: which does your firm need?
Cyber Essentials Plus tests five technical controls. ISO 27001 certifies a whole information security management system built around risk. Here is…
SecurityNIS2 and the UK: the Cyber Security and Resilience Bill explained
NIS2 is EU law. The UK's version of the same idea is the NIS Regulations 2018, which the Cyber Security and Resilience Bill will reform, bringing in…
Backup & RecoveryUK GDPR and backups: retention and the right to erasure
UK GDPR expects you to be able to restore personal data, to keep it no longer than you need, and to honour erasure requests in backups too. Here is…
Backup & RecoveryDORA backup requirements: what UK firms need to know
DORA sets out what EU financial entities must do about backups, restoration and recovery, and it reaches UK firms through their EU entities and their…