When you choose a cloud supplier for your business, it's important to know whether they follow the National Cyber Security Centre (NCSC) good practice guidelines. These guidelines are designed to help organisations protect their data and systems from cyber threats. Ensuring your cloud provider aligns with these standards reduces risks such as data breaches, service downtime, and compliance issues that can affect your business operations and reputation.
Why this matters for UK SMEs
For a typical UK SME with between 10 and 200 employees, using cloud services is often essential for daily operations—whether it's storing customer data, running applications, or enabling remote work. If the cloud supplier doesn't meet recognised security standards, your business could face interruptions, data loss, or regulatory scrutiny under UK GDPR and the Data Protection Act 2018. This can lead to lost productivity, damage to customer trust, and potential fines.
For example, imagine a mid-sized marketing firm that stores client campaign data and personal information in the cloud. If their cloud provider experiences a security breach due to weak access controls or poor patch management, sensitive client data could be exposed. A good IT partner would help the firm assess the supplier's security practices, verify compliance with NCSC recommendations, and implement additional safeguards like multi-factor authentication (MFA) and regular backups to mitigate risks.
What to check when assessing a cloud supplier
- Ask for evidence of security certifications: Does the supplier hold recognised standards such as Cyber Essentials Plus, ISO 27001, or have they been independently audited against NCSC guidelines?
- Review their security controls: What measures do they have for access management, data encryption (at rest and in transit), and vulnerability patching?
- Understand their incident response: How quickly do they detect and respond to security incidents? Do they have clear communication processes for notifying customers?
- Check data location and backup policies: Where is your data stored? Are backups regularly taken, tested, and stored securely?
- Evaluate compliance with UK data protection laws: Does the supplier support your obligations under UK GDPR and the Data Protection Act 2018, including data subject rights and breach reporting?
- Request a security questionnaire or supplier assessment: Use this to compare providers and ensure they meet your security expectations.
- Confirm use of multi-factor authentication (MFA): MFA should be enforced for all administrative and user access to cloud systems.
- Ask about logging and monitoring: Are security logs maintained and regularly reviewed to detect suspicious activity?
Common pitfalls to avoid
Many SMEs assume cloud providers automatically handle all security aspects. However, shared responsibility models mean you still need to verify and manage your own security controls, such as user access rights and device security. Another common issue is not having clear contractual terms around security responsibilities and incident notification timelines.
By proactively checking these areas, you reduce the risk of unexpected downtime or data loss that could disrupt your business and harm your customers' trust.
If you're unsure how to assess a cloud supplier's security posture against NCSC good practice, consider consulting a trusted managed IT provider or IT advisor. They can help you review proposals, ask the right questions, and implement controls that keep your business secure and compliant.