Email security
Check the meaning of SPF, DKIM and DMARC observations. Find the correct DKIM selector, map legitimate senders and plan a controlled email policy change.
Explore email security PRACTICAL SECURITY GUIDANCE
Cyber security and recovery planning for small businesses
A small-business cyber security review should begin with the services you need to keep operating. Identify their owners, the accounts and providers they depend on, and the evidence that recovery arrangements work. Use a self-assessment to find questions and assign actions, then verify important answers with records or a practical exercise.
PUBLISHED
What CyberScan can establish
CyberScan’s guided review uses ten self-reported questions to produce a suggested action plan. It does not scan systems, inspect account settings, test a backup or certify a control. Answers remain in the open page’s memory until you leave or reload; a downloaded plan is a copy you keep. The public website check covers a different, limited set of external observations.
Compare the assessment routes and their coverage, or read how the current application handles data.
Review what sits behind the website
The domain registrar, DNS service, hosting account, business email and booking or sales platform can all affect your ability to trade. Ask who controls each account and whether recovery arrangements still work when the usual administrator or device is unavailable. The NCSC’s small-organisations guidance covers protecting important accounts and choosing stronger sign-in methods where supported.
Keep an account record that points to the approved recovery procedure without containing passwords or recovery secrets. Agree who should be contacted if access is lost and how that person can be reached outside the affected system. Revisit ownership when staff or providers change. A tick beside an account setting is a statement to verify, not a substitute for evidence.
Sources: NCSC: Secure your important online accounts (opens in a new tab)
Make recovery practical
Backups need to support the information and services your business would have to restore. The NCSC recommends protecting backup arrangements and checking that recovery works. A successful backup notification and a successful restore exercise answer different questions. Decide with the service owner what to restore, where to test it and how to record the outcome safely.
The NCSC’s incident-preparation guidance also asks organisations to identify critical information, assign responsibilities and keep relevant supplier contacts accessible. For your own plan, choose an alternative way to communicate if the normal mailbox is unavailable. Link each exercise to a realistic business task, record the gaps found and give each improvement an owner.
Sources: NCSC: Backing up your data (opens in a new tab); NCSC: Prepare for incidents (opens in a new tab)
Four practical steps
- Choose a critical business service. Name a service such as taking bookings, communicating with customers or issuing invoices. Record the business owner and the systems and providers it relies on.
- Check access and recovery evidence. Review administrator ownership, stronger sign-in options, recovery procedures and relevant backup records. Mark missing evidence as unknown.
- Exercise a realistic interruption. Agree a safe scenario with your provider, such as losing access to the normal mailbox. Test the communication and recovery procedure without exposing real customer data.
- Assign the improvements. Record what happened, who owns each gap, the target date and the evidence needed next time. Revisit the plan after material service or personnel changes.
Worked example: The booking service works, but recovery has not been tried
Synthetic worked example. This describes a planning exercise, not a business incident or a tested recovery service.
| Stage | Evidence and decision |
|---|---|
| Starting answer | A business believes that its booking data is backed up, but the person completing the review cannot find a recent restore record. |
| Uncertainty | A public website response does not establish backup contents, access to the provider account or the ability to restore a usable booking record. |
| Owner and action | The service owner asks the provider for the backup scope and agrees a safe restore exercise. An alternative contact route is kept outside the normal mailbox. |
| Evidence and follow-up | Record the exercise date, data and service functions recovered, access problems found and responsible owners. Keep any untested dependencies open. |
Critical service and recovery exercise plan
A blank CSV for service dependencies, owners, recovery procedures, supplier-contact references and exercise outcomes. Store the completed plan where authorised people can reach it during an interruption.
Download blank CSV templateOpen in a spreadsheet application and replace the blank-entry rows with your own records. The template contains no findings, formulas or macros. Completing it does not upload it to CyberScan.
Common questions
Does completing the review certify my business?
No. It produces a plan from your answers. It is not Cyber Essentials certification, an independent audit or a verification of your controls. Use the plan to collect evidence and arrange any separate assessment you need.
Are my guided review answers stored?
The current review keeps answers in the open page’s memory. Leaving or reloading clears them. If you download or print the resulting plan, you are responsible for that copy. The separate protected workspace has its own records and handling described on the security and privacy page.
Can a website scan confirm that my backups work?
No. Public DNS and web responses do not reveal whether the correct data is backed up or can be restored. Ask the service owner for the backup scope and a documented, suitable recovery test.
What if an incident is already happening?
Use your organisation’s incident procedure and the responsible provider’s support. The NCSC response and recovery collection offers guidance on handling incidents. CyberScan’s review is a planning aid and is not an incident-response service.
Sources: NCSC: Small Business Guide to Response and Recovery (opens in a new tab)
Primary sources
NCSC: Secure your important online accounts (opens in a new tab)NCSC: Backing up your data (opens in a new tab)NCSC: Prepare for incidents (opens in a new tab)NCSC: Small Business Guide to Response and Recovery (opens in a new tab)Sources checked . Check the linked guidance and your provider’s current instructions before changing a live service.
Choose your next step
Answer ten questions and turn your current understanding into a practical plan with evidence to request.
Start the guided security reviewRelated security topics
Website security
Understand website security headers, HTTPS and public check limits. Plan a change, assign an owner and record evidence with a website control template.
Explore website securityVulnerability management
Turn a scanner finding into an owned remediation task. Check asset attribution, vendor evidence, business impact and the result of a suitable retest.
Explore vulnerability management