Most UK leaders say data security is their top priority. Only about one in three say they would confidently pass their next audit. That gap is where most of the trouble in a small or medium business quietly lives. It is not a lack of intent. It is a hybrid mess of cloud, on-prem and old habits that has built up over years.
Hi, I’m Andy from Initial IT, the Lichfield-based managed IT firm. This is the conversation I have with most new business clients in Staffordshire and the West Midlands: data security is on every board paper, but nobody is quite sure who has access to what, anymore.
Key takeaways
- Saying data security is the priority is easy; passing an audit is harder, especially in a hybrid SMB that has grown organically.
- The pressure points are predictable: who can access what, where data lives, and which old systems are still hanging on.
- Microsoft 365 Business Premium with Intune, Defender and Entra ID conditional access closes most of these gaps in one bundle.
- Cyber Essentials is a sensible first standard to aim for, especially for law firms and accountancy practices.
- Most SMBs do not need more tools, they need fewer, configured properly, with someone watching the alerts.
What is this confidence gap really telling us?
Recent research has 7 in 10 IT leaders putting data security at the top of their list when modernising. Only around 1 in 3 feel confident at their next regulatory audit. That is not a marketing stat, it is a real description of life inside a typical 20 to 60 staff business in Lichfield, Cannock or Burton.
You probably did not set out to build a hybrid IT environment. You added Microsoft 365 for email and Teams. Then cloud accounting. Then a CRM. Then file sharing for clients. Then maybe a server is still sitting in the cupboard doing one specific job nobody quite wants to touch. That is hybrid IT by accident, and it is everywhere.
The questions a hybrid SMB suddenly finds hard to answer
When data lives in five places, simple questions get awkward:
- Who actually has access to which files and systems right now?
- How does client information move between the CRM, the email system and SharePoint?
- Are any old platforms still holding sensitive data that should have been deleted?
- When was the last time access permissions were reviewed?
- If a staff member left last month, has every system been tidied up?
Day to day, nothing feels wrong. The team logs in. Files move. Email flows. But the audit-ready answer is missing because no single person owns the whole picture.
Legacy systems and a thin skills pool make it worse
The same research highlights another pressure point. Many businesses still depend on older systems for critical operations, and more than half struggle to find people with the right skills to manage modern IT properly. In a small business in the Midlands, that often means one person who “knows the system” carrying the whole load, and a lot of held breath when they go on holiday.
AI raises the bar (because it reflects whatever permissions you already have)
Then there is AI. Microsoft Copilot, ChatGPT, every supplier suddenly “has AI”. The catch is that Microsoft 365 Copilot reflects your existing SharePoint and OneDrive permissions. If your folders are over-shared (and most are), Copilot will happily surface the wrong file to the wrong person. AI does not create that problem, but it makes any existing access mess visible quickly.
A practical order of work for a Lichfield, Staffordshire or West Midlands SMB
This is the order we follow with a new client who wants to go from “security is the priority” to “we would pass that audit”:
- Get every user on Microsoft 365 Business Premium. It is the only SMB licence that bundles Intune, Defender for Business, Entra ID P1 conditional access and Microsoft Purview data protection. Our Microsoft 365 licences guide walks through why.
- Turn on multi-factor authentication everywhere, then layer conditional access so sign-ins from unknown devices or risky locations get blocked.
- Tidy SharePoint and OneDrive permissions before turning on Copilot. Remove old “everyone” shares.
- Encrypt and remote-wipe laptops and phones through Intune. A lost laptop should be a paperwork problem, not a data breach.
- Aim for Cyber Essentials certification as your floor. Required for many UK government contracts and a useful proof point for clients.
- Document who has access to what, monthly, and review when anyone joins or leaves.
How we help
This is most of what our cyber security work looks like for SMBs across Staffordshire and the West Midlands. We do the configuration that most providers leave switched off. We hold the audit trail. We help you get and keep Cyber Essentials. If your data security feels like a hope rather than a plan, have a quick chat with me.
Frequently asked questions
How do I know if my UK small business would pass a cyber audit?
Run through the Cyber Essentials self-assessment, or ask your IT partner to do it with you. It maps to the controls a UK insurer or auditor will expect. We do that walkthrough for free for businesses in Lichfield and the wider Midlands as part of an initial conversation.
What is the cheapest way to improve data security across a small team?
Move everyone to Microsoft 365 Business Premium, turn on MFA and conditional access, and use Intune to manage laptops and phones. For around £20 per user per month you get most of what an SMB needs out of one bundle, instead of buying three separate tools.
Should we keep our old on-prem server?
Sometimes yes, sometimes no. Some specialist software still needs a local server. Most general file storage now belongs in SharePoint or OneDrive. The honest answer comes from a proper audit, not a guess.
Is Microsoft 365 Copilot safe to use with client data?
Microsoft 365 Copilot keeps your prompts and answers inside your tenant and does not train public AI models on them. But it reflects your existing file permissions, so tidy SharePoint first. Public AI tools like ChatGPT do not give you that guarantee.
Where can I read more about UK cyber security standards?
The National Cyber Security Centre (NCSC) publishes the most useful guidance for UK SMBs at ncsc.gov.uk. Start with the 10 Steps to Cyber Security.
Quick check: where does your business stand on cyber security?
The questions in our free 2-minute Cyber Security Health Check are the eleven we ask every new client first. Score yourself, see the per-category breakdown, get the three highest-impact fixes for your specific gaps. No marketing list.
Take the 2-minute Cyber Health Check
– Andy Price, Founder & MD, Initial IT · 01543 524 594 · hello@initialit.co.uk