Managed security for small firms: what to outsource

Key takeaways

Managed security services let a small business outsource the security processes it cannot staff: device management, patching, monitoring alerts, backup checks and user access. The owner still decides risk appetite, approves access and leads the response to a serious incident. Cyber Essentials is a sensible baseline for most UK SMEs.

• Outsource: device management, patching, monitoring, backups.
• Keep: risk decisions, access approval, incident leadership.
• Use Cyber Essentials as a baseline.
• Test your incident plan once a year.

Which security processes can be outsourced?

Routine, technical processes with clear standards: managing laptops and phones, applying updates, monitoring security alerts, checking backups, managing user accounts and multi-factor authentication, and running phishing awareness campaigns. These are where small firms fall behind because nobody owns them.

• Which business processes should you outsource?
• Cyber security without an IT department

What must the owner keep?

Decisions about risk and access. Which data is most valuable, who should see what, how much to spend, and what to do in a serious incident, including whether to notify the ICO within 72 hours of becoming aware of a reportable breach. A provider advises; the business decides and remains accountable.

• Risk appetite and budget.
• Approval of access to sensitive data.
• Leading incident response.
• Breach notification decisions.

• Who is responsible for data protection in a small firm?
• Processes with sensitive data: can they be outsourced?

What is a sensible security baseline?

Cyber Essentials covers five controls: firewalls, secure configuration, user access control, malware protection and security update management. It is government-backed and certifiable, and some public sector contracts require it. The NCSC's guidance for small organisations covers the same ground in plain terms.

• Patch management: keep software updated without drama
• Backup checks: test restores before you need them

When is managed security more than you need?

A very small business with a handful of devices and cloud apps may cover the basics itself with good settings, multi-factor authentication and automatic updates. Managed security pays off as devices, staff and data grow, or when customers ask for evidence of controls.

• How much volume makes a process worth outsourcing?
• Data security with an outsourced team

What does this look like in practice?

A pattern we see: small firms have security tools but nobody reads the alerts. Outsourcing the monitoring matters more than buying another tool.

• See client work
• BPO Solutions for UK businesses

Managed security checklist

Agree these with any provider.

• Which devices and accounts are covered.
• Patching and update timescales.
• Alert monitoring hours and response times.
• Backup checks and restore tests.
• Who approves new access.
• Incident plan and contact list.

• IT processes to outsource in a small business
• The process selection score: outsource, split or keep?

Next step

Tell us how many staff and devices you have and how security is handled today. We will tell you which processes we would hand over first.