Why outsource your IT support? In short, because it gives your business a whole team of IT specialists, stronger cyber security and predictable costs, without the expense and risk of building an in-house team. For most growing UK businesses, outsourcing means better IT and less hassle for less money. In this guide we look at exactly what outsourcing means, the main benefits, and how to know when it is the right move.
What does it mean to outsource your IT support?
Outsourcing your IT support means handing the running of your technology to a specialist provider, or managed service provider, instead of relying on an internal hire or an unofficial “office IT person”. The provider looks after your helpdesk, security, monitoring, Microsoft 365 and strategy for a fixed monthly fee. It is the model most small and medium businesses now use, because it gives them enterprise-grade IT without an enterprise budget. Our guide to outsourced IT support explains how the service works in full.
Why do businesses outsource IT support?
The reasons vary, but the benefits are consistent. The main ones are:
Lower, predictable costs. One monthly fee replaces salaries, training and the cost of downtime, and it is easy to budget.
A whole team of specialists. Instead of one person who cannot know everything, you get expertise across helpdesk, security, cloud and strategy.
Stronger cyber security. Managed protection, cyber security, Cyber Essentials and staff awareness are built in as standard.
Proactive support and less downtime. Problems are prevented and fixed early, rather than after they have already cost you time and money.
Scalability. The service grows with you, adding or removing users as your team changes.
Focus on your core business. Your team spends time on the work that matters, not wrestling with IT.
Resilience. Holiday and sickness cover are built in, with no single point of failure if a key person leaves.
When should you outsource your IT?
Most businesses start thinking about outsourcing when their current arrangement starts to hold them back. Common triggers include the same IT problems recurring without ever being fixed, relying on one person who has become a risk, cyber security and Microsoft 365 not being actively managed, slow staff onboarding, or simply having no clear IT strategy or budget. If any of those sound familiar, it is usually a sign that a proactive, managed approach would pay for itself.
Is outsourcing right for your business?
Outsourcing suits businesses of almost any size, but it is especially valuable for small and medium firms that cannot justify a full in-house IT team. Larger organisations often use a hybrid model, keeping someone in-house for day-to-day needs and outsourcing the specialist, security and out-of-hours work. The right answer depends on your size, sector and how much you rely on technology, which is exactly what a short review will tell you. If cost is your main question, see our guide on how much outsourced IT support costs, and if you are weighing up hiring instead, read our comparison of in-house vs outsourced IT support.
How to choose an outsourced IT provider
Look for a provider that is proactive rather than reactive, security-led and genuinely accountable, with named engineers and clear reporting. Local matters too: a provider on your doorstep can be on site when needed and understands your area. As an example, our IT support in Chichester and across West Sussex is delivered by a local team, backed by Cyber Essentials certification and Microsoft Partner status.
Ready to outsource your IT?
Start with a free, no-obligation review of your current setup, security and support. We will show you exactly where the gaps and opportunities are, with a clear plan. Book a free IT review or get a quote to see what outsourcing could do for your business.
Frequently asked questions
Why do businesses outsource IT support?
To get a whole team of specialists, stronger security and predictable costs without the expense and risk of hiring and managing an in-house IT team.
Is outsourcing IT support cheaper than in-house?
Usually, yes. You get a whole team for less than the cost of a single senior hire, with holiday and sickness cover built in and no single point of failure.
Will I lose control of my IT if I outsource?
No. You keep ownership of your systems, data and decisions. The provider runs the day-to-day work and gives you clear reporting and strategic guidance.
Is outsourced IT support more secure?
A good provider makes your business more secure, not less, with managed protection, Cyber Essentials support and monitoring built in as standard.
When is the right time to outsource IT?
When IT problems keep recurring, you rely on one person, security is not actively managed, staff onboarding is slow, or you have no clear IT strategy or budget.
What size business should outsource IT support?
Any size can benefit, but it is especially valuable for small and medium businesses that cannot justify a full in-house IT team. Larger teams often use a hybrid model.
Yes. The UK’s traditional landline is being phased out. The old analogue phone network, known as the PSTN, is being switched off and replaced with digital calling that runs over the internet. If you still have a traditional home or business phone line, it will move to a digital service before the network is retired at the end of January 2027.
What is the UK landline switch off?
The UK landline switch off is the retirement of the old analogue phone network, and every home and business still on it will be moved to digital calling before the deadline. The regulator Ofcom has more on the change.
Here is what that actually means, why it is happening, and the simple steps to make sure your phone, and everything else that quietly relies on your line, keeps working.
Why are landlines being switched off?
The copper based analogue network has carried our calls for well over a century, but it is old, expensive to maintain and increasingly unreliable. Openreach is retiring it and moving everyone to digital voice, where calls travel over a broadband connection instead of copper wires. It is the same shift the mobile and internet worlds made years ago. For the full business detail, see our guide to the PSTN and landline switch-off.
When will my landline stop working?
2023: new analogue phone lines stopped being sold.
Now: existing lines are being migrated to digital in a rolling regional programme.
End of January 2027: the analogue network is switched off completely.
The final deadline was extended from December 2025 to give people more time to migrate safely, particularly households with vulnerable users or equipment that depends on a phone line. The end result is the same, only the timeline moved.
What it means at home
For most homes the change is simple. Your calls move to digital voice, usually plugged into your broadband router, and in many cases you can keep your existing phone and number. If you have a personal alarm or a telecare pendant, tell your provider, as these need checking before the switch.
What it means for business
Businesses have more to think about, because it is not only desk phones that use a line. Alarms, door entry systems, lift phones, card machines and fax machines can all dial out over analogue lines and may stop working after the switch. The move is also an opportunity: modern VoIP phone systems are cheaper to run and far better for hybrid working than the old lines ever were.
What replaces the landline?
Digital voice, or VoIP: your calls run over the internet through a hosted phone system, keeping your numbers and adding features like mobile apps and call recording.
Modern broadband:SoGEA broadband and full fibre deliver internet without needing a traditional phone line at all. For homes, our home broadband options do the same.
What you should do now
Check what depends on your line, including alarms, lifts and card machines.
Plan your move to digital voice and confirm you can keep your number.
Make sure your broadband is up to the job, upgrading to SoGEA or full fibre if needed.
Do not wait for the deadline, as migrating early avoids any risk of being cut off.
How ATS Connection can help
We help homes and businesses across West Sussex move off the old network smoothly. We check what you have, recommend the right digital phone and broadband setup, port your numbers and manage the switch with no loss of service. Get a quote or call us on 01903 255 159.
Frequently asked questions
Are landlines really being phased out in the UK?
Yes. The analogue phone network is being retired and switched off by the end of January 2027, with all lines moving to digital voice delivered over broadband.
Will I lose my phone number?
No. Your existing number can be ported across to the digital service, so you keep it when you move.
Do I need the internet for a digital landline?
Yes. Digital voice runs over a broadband connection, which is why it is worth making sure your broadband is reliable before you switch.
What happens if I do nothing?
Lines not moved by 31 January 2027 may be put on a temporary, emergency-only voice service, and ISDN and multi-line business systems risk being cut off. It is much safer to migrate ahead of the deadline.
Is digital voice more expensive?
Usually it is cheaper, because there is no separate line rental and calls are often included, plus you gain features a traditional line never had.
In-house vs outsourced IT support is one of the first big decisions a growing business faces. Do you hire someone to look after your IT internally, or hand it to a specialist provider? Both models have their place, but for most small and medium businesses, outsourced IT support wins on cost, expertise and resilience, while larger teams often use a hybrid of the two. This guide compares the two approaches so you can choose the right one for your business.
What is in-house IT support?
In-house IT support means employing one or more people to manage your technology directly. The upside is someone on site who knows your business intimately and is always on your team. The downsides are significant, though: a single hire is expensive once you add salary, National Insurance, training and holiday cover, one person cannot be an expert in everything from networking to cyber security, and if they are off sick or leave, you have a single point of failure with no cover.
What is outsourced IT support?
Outsourced IT support means a specialist provider runs your IT for a fixed monthly fee, covering the helpdesk, security, monitoring, Microsoft 365 and strategy. Instead of one person you get a whole team, with cover built in and broader expertise, usually for less than the cost of a single senior hire. Our guide to outsourced IT support explains how the service works in detail. If you are still deciding, our guide on why outsource your IT support covers the benefits in full.
In-house vs outsourced: the cost comparison
Cost is often the deciding factor. A single in-house IT hire typically costs £35,000 to £50,000 a year once you include salary, National Insurance, training and cover, and you still need to buy tools and monitoring on top. Outsourced IT support is charged as a predictable monthly fee, usually per user, and gives you a whole team for a fraction of that. For a full breakdown, see our guide on how much outsourced IT support costs.
Expertise and cover
This is where outsourcing really pulls ahead. Modern IT spans helpdesk support, cyber security, cloud, Microsoft 365, networking and strategy, and no single person can master all of it. An outsourced provider brings specialists across every discipline, plus holiday and sickness cover so support never stops. An in-house hire, by contrast, is one person with one set of skills and no backup.
Security
Cyber security is now too important and too specialised to leave to one generalist. A good outsourced provider builds managed cyber security, Cyber Essentials and monitoring into the service as standard, with dedicated tools and up-to-date expertise. In-house teams can do this well, but usually need external specialists to fill the gaps, which adds cost.
The hybrid model
It is not always either or. Many larger organisations use a hybrid, or co-managed, model: they keep someone in-house for day-to-day, hands-on needs and outsource the specialist, security and out-of-hours work to a provider. This gives you the best of both, an on-site presence backed by a full external team, and it is often the right answer once you get past a few hundred users.
Which is right for your business?
For most small and medium businesses, outsourced IT support delivers broader expertise, better security and greater resilience at a lower total cost than an in-house hire. Very large organisations, or those with highly specialist needs, may prefer a hybrid model. The best way to decide is to weigh up your size, sector and how much you rely on technology, which a short review will make clear.
Not sure which model fits?
We can help you weigh it up. Book a free IT review or get a quote, and we will give you an honest, costed recommendation for your business, whether that is fully outsourced or a hybrid approach.
Frequently asked questions
Is in-house or outsourced IT support better?
For most small and medium businesses, outsourced IT support is better on cost, expertise and resilience. Larger organisations often use a hybrid of in-house and outsourced.
Is outsourced IT cheaper than in-house?
Usually, yes. You get a whole team for less than the cost of a single senior in-house hire, with cover built in and no single point of failure.
What are the downsides of in-house IT?
Cost, limited breadth from a single person, and a single point of failure with no cover if they are off sick or leave.
Can I combine in-house and outsourced IT?
Yes. A hybrid or co-managed model keeps someone in-house for day-to-day needs and outsources the specialist, security and out-of-hours work to a provider.
Does outsourcing mean losing control of my IT?
No. You keep ownership of your systems, data and decisions. The provider handles the day-to-day work and reports back to you.
Which is more secure, in-house or outsourced?
A good outsourced provider usually offers stronger, more consistent security, with dedicated tools, monitoring and up-to-date expertise built into the service.
VoIP stands for Voice over Internet Protocol. In plain English, it means making phone calls over the internet instead of a traditional phone line. If you have used WhatsApp calling, Microsoft Teams or FaceTime, you have already used VoIP. Business VoIP takes the same idea and turns it into a full, reliable phone system for your company.
What is VoIP?
So what is VoIP? In short, VoIP means making phone calls over the internet instead of over a traditional phone line, and it is now how most UK businesses make and take their calls. For the technical background there is a helpful overview of Voice over IP.
With the old analogue network being switched off, VoIP is now how UK businesses make and receive calls. Here is how it works, what it costs you to run, and why it is a big upgrade on a traditional line.
How does VoIP work?
Instead of sending your voice down a copper wire, VoIP converts it into digital data and sends it over your internet connection to a hosted phone system in the cloud. That system handles your calls, your numbers and all the clever features, then connects to the wider phone network so you can still call any landline or mobile. You can use a desk handset, a computer, or a mobile app, and it all works as one system.
The benefits of VoIP for business
Lower cost: no line rental, and calls are often included, so most businesses save money.
Work anywhere: your office number rings on your laptop or phone whether you are at your desk, at home or on the move.
Powerful features: call recording, auto-attendant menus, voicemail to email, hold music, call queues and reporting come as standard.
Easy to scale: add or remove users in minutes as your team changes.
One system across sites: every office and home worker sits on the same phone system.
VoIP versus a traditional landline
A traditional line ties a number to a physical socket and charges you line rental for the privilege. VoIP frees the number from the wire, so your team can answer the same number from anywhere, and you gain features a copper line could never offer. With the analogue network being switched off, VoIP is also the natural replacement rather than an optional upgrade.
Is VoIP reliable?
Yes, when it is set up properly. Delivered over a solid business broadband connection such as SoGEA or full fibre, modern VoIP is stable and clear, and it comes with failover options so calls can automatically divert to mobiles if your internet ever drops. Reliability comes down to getting the connectivity right underneath it, which is where a good provider earns their keep.
What do you need to get started?
A reliable broadband connection.
VoIP handsets, or just the app on your computers and mobiles.
A hosted phone system, set up with your numbers, menus and users.
Your existing numbers ported across so nothing changes for your customers.
If you need new numbers as well, we can help you choose the right ones, including local, national and freephone, on our business phone numbers page.
How ATS Connection can help
We design, install and support VoIP phone systems for businesses across West Sussex, handled end to end. We sort the broadband, port your numbers, set the system up around how your team actually works, and support it afterwards. Get a quote or call 01903 255 159.
Frequently asked questions
What does VoIP stand for?
VoIP stands for Voice over Internet Protocol. It means making phone calls over the internet instead of a traditional analogue phone line.
Is VoIP cheaper than a normal phone line?
For most businesses, yes. There is no separate line rental, calls are often included, and one system covers every user, which usually reduces the overall bill.
Can I keep my existing phone number with VoIP?
Yes. Existing numbers can be ported to a VoIP system, so your customers see no change.
Do I need special phones for VoIP?
Not necessarily. You can use VoIP handsets, or simply an app on your computer or mobile. Many existing phones can also be adapted.
Is VoIP reliable enough for a business?
Yes. Over business grade broadband it is reliable and clear, and it includes failover so calls can divert to mobiles if your connection ever drops.
Hybrid working is now normal, but a lot of business phone systems still assume everyone sits at the same desk every day. If your team is split between the office, home and the road, the right phone system keeps you sounding like one joined-up business no matter where anyone is. This guide explains what to look for.
What are remote worker phone systems?
Remote worker phone systems let your team make and take business calls on one number from anywhere, whether that is at home, in the office or on the road. Government home working guidance covers the security side.
Why traditional phone systems struggle with hybrid work
A traditional system ties each extension to a physical handset in the office. When staff work from home, calls get missed, people hand out personal mobile numbers, and you lose the professional front and the call records that matter. It also makes it hard to know who is available. Hybrid teams need a system built around people, not desks.
What a modern remote phone system does
Modern VoIP phone systems run in the cloud, so the same system reaches every person wherever they are working. The key features for hybrid teams are:
One number, any device: your office number rings on a desk phone, laptop and mobile app at the same time.
Presence and status: see who is available, on a call or away, across the whole team.
Call routing: send calls to the right person or team automatically, wherever they are.
Voicemail to email: messages land in the inbox so nothing is missed at home.
Call recording and reporting: keep the same records and oversight you had in the office.
Keep work and personal separate
One of the biggest wins is that staff no longer use personal mobiles for work. They make and take business calls through the app, so your number is shown, calls are logged, and personal numbers stay private. When someone leaves, the number and history stay with the business.
What you need for reliable remote calling
Remote calling is only as good as the connection behind it. Each location needs decent broadband, and the office benefits from a business grade line such as SoGEA or full fibre. A good setup also includes failover, so if someone’s home internet drops, calls divert automatically to their mobile.
Getting the numbers right
Hybrid teams often want a professional national or local presence rather than a scatter of mobile numbers. We can help you choose and set up the right numbers on our business phone numbers page, and port any existing numbers across.
How ATS Connection can help
We set up cloud phone systems for hybrid and remote teams across West Sussex, so everyone works from one system whether they are in the office or at the kitchen table. We handle the connectivity, the apps, the numbers and the support, and our remote IT support can look after the laptops and accounts your team use at home. Get a quote or call 01903 255 159.
Frequently asked questions
What is the best phone system for remote workers?
A cloud based VoIP system is best, because it reaches staff on a desk phone, laptop or mobile app using the same business number, wherever they are working.
Can staff use their office number from home?
Yes. With a hosted phone system the office number rings on their home device or mobile app, and outbound calls show the business number too.
Do remote workers need to use their personal mobiles?
No. They make and receive business calls through the app, so personal numbers stay private and every call is still logged by the business.
What internet do I need for a remote phone system?
A reliable broadband connection at each location. Business grade broadband in the office and failover to mobile give the most dependable setup.
Is a cloud phone system secure?
Yes. Reputable hosted systems use encryption and secure data centres, and calls and records stay within the business rather than on personal devices.
Thinking about a memorable business number but not sure what it will cost, either for you or for the people calling you? The rules around 03, 0845 and 0800 numbers are widely misunderstood. Here is a clear, up to date breakdown of what each type of number really costs in the UK.
What is the cost of an 0800 number?
The 0800 number cost sits with the business rather than the caller, because 0800 and 0808 numbers are free to call, so it pays to understand how each number type is charged. The regulator Ofcom sets the rules.
The two costs to understand
Every non-geographic number has two sides: what it costs the caller, and what it costs you as the business. Getting these the right way round is the key to choosing wisely.
0333 and 03 numbers
0333 numbers (and all 03 numbers) cost callers exactly the same as calling a standard 01 or 02 landline, and they are included in any inclusive minutes bundle on mobiles and landlines. For the business, an 03 number is inexpensive to run and gives you a professional national presence that is not tied to one town. For most businesses, 0333 is the sweet spot.
0345 and 0344 numbers
0345 and 0344 numbers work just like 03 numbers for the caller: charged at standard geographic rates and included in bundles. They are often held by established businesses that moved over from older 0845 and 0844 numbers. If you still have an 0845 number, moving to 0345 keeps the familiar digits while making calls cheaper for your customers.
0800 and 0808 freephone numbers
0800 and 0808 numbers are free for the caller, including from mobiles. That makes them powerful for sales lines, customer service and anything where you want to remove every barrier to picking up the phone. The trade off is that the business pays for the inbound calls, so the cost sits with you rather than the caller. Used well, a freephone number can pay for itself in extra enquiries.
The old 0845 and 0844 numbers
These numbers add a service charge on top of the caller’s normal rate, so they are now seen as customer unfriendly and, in some sectors, are not allowed for customer service lines. If you still run one, it is worth moving to an 03 number to keep your customers happy and avoid complaints.
Which number should your business choose?
Want a professional, low cost national number? Choose 0333.
Moving from an old 0845 number? Switch to 0345 to keep it familiar but cheaper to call.
Running sales or support lines where you want maximum calls? Consider 0800 freephone.
Still on 0844 or 0845? Move off it, as it puts customers off and may breach the rules.
How ATS Connection can help
We supply and manage the full range of business numbers, and route them into your VoIP phone system so calls reach the right people wherever they work. See the options on our business phone numbers page, or get a quote and we will recommend the right setup. Call 01903 255 159.
Frequently asked questions
How much does it cost to call an 0333 number?
0333 numbers cost the same as calling an 01 or 02 landline and are included in inclusive minutes on mobile and landline plans, so most callers pay nothing extra.
Are 0345 numbers free to call?
No, but they are charged at standard geographic rates and included in call bundles, so they cost the caller the same as a normal landline number.
Who pays for an 0800 freephone number?
The business does. 0800 and 0808 numbers are free for the caller, including from mobiles, with the inbound call cost paid by the company.
Should I move away from an 0845 number?
Usually yes. 0845 and 0844 numbers add a service charge for callers, are seen as customer unfriendly, and are banned for some customer service lines. Moving to 0345 or 0333 is better.
Which business number is best?
For most businesses a 0333 number is ideal: cheap to run, free within bundles for callers and a professional national presence. Choose 0800 where you want to encourage the maximum number of calls.
Choosing an IT support company is one of the more important decisions a business makes, because the right partner keeps you running and the wrong one costs you time, money and sleep. Here is a practical checklist of what to look for, and the questions to ask before you sign anything.
How to choose an IT support company
Knowing how to choose an IT support company comes down to a few essentials: proactive monitoring, clear response times, security built in and honest, jargon-free advice. The NCSC small business guide is worth reading alongside this.
Start with what you actually need
Before comparing providers, get clear on your situation: how many staff and devices, what software you rely on, whether you have servers or are fully cloud, your security and compliance needs, and where your current pain points are. A good provider will ask these questions too. If you are not sure, a free IT assessment will map it out.
What to look for in an IT support company
Proactive, not just reactive: they should monitor and maintain your systems to prevent problems, not only fix them after they break.
Clear response times: written service levels so you know how quickly you will get help.
Security built in: cyber security, patching, backups and disaster recovery as standard, not costly extras.
Local and reachable: a provider who knows your area and answers the phone when you call. See what good local IT support looks like.
Plain English: advice without jargon, and reporting you can actually understand.
Room to grow with you: support that scales as your business changes.
Questions to ask before you sign
What are your guaranteed response and resolution times?
Is support proactive, and what do you monitor?
What is included in the monthly fee, and what costs extra?
How do you handle cyber security and backups?
Can you share references or reviews from similar businesses?
What is the contract length and notice period?
What happens to my data and systems if we ever leave?
Red flags to avoid
Be wary of providers who only appear when things break, who cannot give clear response times, who lock you into long contracts with painful exit terms, or who talk in jargon to avoid straight answers. Vague pricing and no references are warning signs too. The switching process should be smooth, and if you are leaving a provider now, our guide on managed IT support shows what good looks like.
Do not just chase the lowest price
The cheapest quote often hides thin cover, slow response or extras that are billed separately. Look at the whole package: response times, what is included, security, and whether you trust the team. Reliable IT that prevents downtime is worth far more than a low headline fee, as anyone who has lost a day to an outage will tell you.
How ATS Connection can help
We provide proactive, fully managed IT support for businesses across West Sussex, including our Chichester IT support, with clear response times, security built in and honest, jargon-free advice. Talk to us, or get a quote. Call 01903 255 159.
Frequently asked questions
How do I choose the right IT support company?
Start by defining your needs, then compare providers on proactive monitoring, guaranteed response times, built-in security, local reachability and clear pricing, and check references before you sign.
What questions should I ask an IT support provider?
Ask about guaranteed response times, what is included in the fee, how they handle security and backups, contract length and notice, references, and what happens to your data if you leave.
How much should IT support cost?
It is usually a predictable monthly fee based on the number of users and what is included. Focus on value and cover rather than the lowest headline price, as cheap quotes often hide gaps.
What is the difference between proactive and reactive IT support?
Reactive support only fixes issues after they happen. Proactive support monitors and maintains your systems to prevent problems in the first place, which means less downtime.
How long should an IT support contract be?
Look for reasonable contract lengths and fair notice periods. Be cautious of long lock-ins with difficult exit terms, and always check what happens to your systems and data if you leave.
The short answer: Cyber Essentials requires five technical controls across every device and cloud service in scope: firewalls, secure configuration, security update management, user access control and malware protection. Since 27 April 2026 the rules are stricter: missing multi-factor authentication on any cloud service that offers it is now an automatic fail, and so is not installing critical or high-risk updates within 14 days. You certify by completing a self-assessment that an independent assessor marks, and the certificate lasts 12 months.
Cyber Essentials is the UK government’s baseline cyber security certification. It is run by the National Cyber Security Centre (NCSC) with IASME as the scheme’s delivery partner, and it proves your business has the controls in place to stop the most common internet-based attacks, such as phishing, password guessing and exploiting unpatched software.
There are two levels. Cyber Essentials is a verified self-assessment: you answer a set of questions about your IT and an independent assessor marks them. Cyber Essentials Plus covers the same requirements but adds a hands-on technical audit of your systems.
It is widely used. Government figures show 61,430 certificates were awarded between July 2025 and June 2026: 46,245 at Cyber Essentials and 15,185 at Cyber Essentials Plus.
What changed in April 2026?
The current rules are version 3.3 of the requirements, assessed with the Danzell question set, for anyone who bought an assessment from 27 April 2026. Businesses that opened an account before then can finish under the previous (Willow) questions. The changes that matter most, according to IASME and the NCSC, are:
MFA is now an automatic fail. Multi-factor authentication is mandatory for every cloud service where it is available, whether it is free, included or a paid extra. Not having it enabled means you fail.
Cloud services cannot be excluded. Microsoft 365, Google Workspace, your accounting package and any other cloud service that holds organisational data must be in scope.
Two new auto-fail questions on updates. High-risk and critical updates for operating systems, router and firewall firmware, and applications must be installed within 14 days of release.
Passwordless sign-in is recognised. The definition now explicitly covers FIDO2 authenticators such as passkeys and security keys.
More emphasis on backups, and a clearer definition of what counts as a cloud service.
Each legal entity is named on the certificate, and any excluded infrastructure must be described.
The Cyber Essentials requirements, control by control
These are the five controls you are assessed against, with the specific rules that catch businesses out. The wording in quotation marks is from the NCSC requirements document.
1. Firewalls
Every device in scope must be protected by a correctly configured firewall, either a boundary firewall such as your router or the software firewall on the device itself. The default administrator password on routers and firewalls must be changed to a strong, unique one (or remote administration disabled entirely), administration from the internet must be off unless there is a documented business need, and any inbound rule that is no longer needed must be removed.
2. Secure configuration
Devices and cloud services must be set up securely rather than left on factory settings. That means removing unnecessary software and accounts, turning off auto-run, and requiring a PIN, password or biometric to unlock devices. The password rules are specific:
With multi-factor authentication, passwords must be at least 8 characters, with no maximum length.
Without MFA, passwords must be at least 12 characters, or at least 8 characters with automatic blocking of common passwords.
Devices must lock after repeated failed attempts, or throttle guessing.
3. Security update management
All software in scope must be licensed and supported by its vendor. Updates must be installed “within 14 days of release” where the vendor rates them critical or high risk, or where they fix vulnerabilities with a CVSS v3 score of 7 or above. Unsupported software must be removed or placed in a separate sub-set that cannot reach the internet. In practice this is where old Windows 10 PCs without Extended Security Updates, unsupported servers and forgotten firewall firmware cause failures.
4. User access control
Everyone gets their own account, with only the access their job needs. Administrator accounts must be separate from everyday accounts and must not be used for email or web browsing. Accounts must be removed or disabled when people leave. Above all: “Authentication to cloud services must always use MFA.” Administrator accounts need MFA too.
5. Malware protection
Every device in scope needs protection against malware. For most businesses that means up-to-date anti-malware software that scans files and web pages automatically. Application allow-listing is an accepted alternative on some devices, such as phones that only install apps from an official store.
What has to be in scope?
The default scope is your whole organisation. You can certify a “well-defined and separately managed sub-set” instead, but only if it is separated from the rest of the network by a firewall or VLAN, and a scope that leaves out end-user devices is not acceptable. In scope means:
Every laptop, desktop, server, tablet and phone that accesses organisational data or services.
Staff-owned phones and laptops that access work email or files (bring your own device).
Home and remote workers’ devices, and the routers or firewalls that protect the office.
Every cloud service that holds or processes your data, which since April 2026 cannot be excluded.
Thin clients, virtual desktops and anything else users sign in to.
Certifying your whole organisation is also what unlocks the free cyber insurance described below.
Cyber Essentials checklist: check your readiness
Answer the 13 questions below before you buy an assessment. Your readiness score and a list of what to fix update as you go, and the two checks that fail the assessment on their own are flagged. The NCSC also offers a free Cyber Essentials Readiness Tool that gives tailored guidance.
If several lines are a no, that is normal, and it is exactly what a readiness review is for. Our free IT security review checks the access-control side in about twelve minutes.
How do you get Cyber Essentials certified?
Certification is quick once your IT meets the requirements. The steps are:
Close the gaps first. Use the checklist above or a readiness review. Most of the time and cost is here, not in the assessment.
Buy an assessment through IASME or a licensed certification body. You receive a login to the online assessment portal and have 6 months to complete it.
Answer the question set accurately, describing your scope, devices and cloud services. A board-level person must sign off the answers.
An independent assessor marks it. IASME says most assessors aim to return results within 3 days.
Fix anything flagged. If you fail, you get two working days to correct and resubmit at no extra cost. After that you reapply and pay again.
Receive your certificate and your listing on the public register, valid for 12 months.
The fee is set centrally by organisation size, from £320 plus VAT for up to 9 employees to £600 plus VAT for 250 or more. Our Cyber Essentials cost guide has the full fee table, the cost of Cyber Essentials Plus and what we charge for a supported certification.
UK organisations with turnover under £20 million that certify their whole organisation can opt in to £25,000 of cyber liability insurance at no extra cost, including a 24-hour incident response helpline, according to IASME.
How is Cyber Essentials Plus different?
Cyber Essentials Plus is the same set of requirements, verified by an assessor testing your systems rather than just reading your answers. You must hold the basic certificate first, and IASME says the Plus audit must be completed within 3 months of it. The tests in the current NCSC test specification are:
An external vulnerability scan of your internet-facing systems.
An authenticated internal scan of a sample of devices to confirm patching.
Checks that malware protection works, including on email and web downloads.
Checks that multi-factor authentication is configured on cloud services.
Checks that administrator and user accounts are properly separated.
Any single failed test fails the assessment. Under IASME’s 2026 rules, if the patching tests fail, the retest checks a new random sample of devices as well as the original ones, and a second failure revokes the basic certificate too.
How does Cyber Essentials renewal work?
Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, and there is no automatic renewal. You complete a fresh assessment against whichever question set is current at the time, so each year’s renewal can include new rules, as April 2026’s MFA change did. IASME notes that a renewed certificate runs for 12 months from the date you submit, not from the old expiry date, so there is no benefit in renewing early, but letting it lapse can break a contract that requires continuous certification.
Put the expiry date in the diary a month ahead, check the new question set for changes, and fix anything new before you start the assessment.
Who needs Cyber Essentials?
Cyber Essentials is voluntary for most businesses, but it is increasingly a condition of winning work:
Central government suppliers. Under Procurement Policy Note 014, contracts that involve citizens’ personal information or government ICT systems require Cyber Essentials or Cyber Essentials Plus, renewed every year of the contract.
Defence suppliers. The Ministry of Defence expects certification across its supply chain where defence information is handled.
Larger customers. Organisations that sign the government’s Cyber Resilience Pledge commit to checking Cyber Essentials coverage across their supply chains and taking a risk-based approach to requiring it.
Regulated professions. Law firms are not required to hold it by the SRA, but it is a sensible way to show clients and insurers that you take security seriously. See does the SRA require Cyber Essentials?
There is a financial case too. The government states that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance than those without it, according to a joint statement from DSIT and major UK banks.
ATS Connection is Cyber Essentials certified and we take businesses through Cyber Essentials certification every year, from readiness review to submission, through an independent certification partner. The controls then stay in place as part of our managed cyber security.
Frequently asked questions
What are the five Cyber Essentials requirements?
Firewalls, secure configuration, security update management, user access control and malware protection. Each has specific rules, such as MFA on all cloud services and installing critical updates within 14 days.
What changed in Cyber Essentials in April 2026?
From 27 April 2026 the Danzell question set and version 3.3 of the requirements apply. MFA on cloud services became an automatic fail if missing, cloud services can no longer be excluded from scope, and two new auto-fail questions check that high-risk updates are installed within 14 days.
How long does it take to get Cyber Essentials?
IASME says most assessors aim to return results within 3 days. The time that varies is fixing gaps beforehand, which can take anything from a few days to several weeks depending on your IT.
How long is a Cyber Essentials certificate valid?
12 months. You then complete a new assessment against the current question set to renew.
Is MFA mandatory for Cyber Essentials?
Yes. Multi-factor authentication must be enabled on every cloud service where it is available. Since April 2026, not having it enabled is an automatic fail.
Do staff-owned phones count for Cyber Essentials?
Yes, if they access organisational data or services such as work email. They must meet the same requirements, or be kept out of scope by preventing them from accessing work data.
What happens if you fail Cyber Essentials?
You get two working days to fix the issues and resubmit at no extra cost. If you still fail, you must reapply and pay the fee again.
Can I do Cyber Essentials myself?
Yes. Any organisation can buy an assessment and complete it directly. Many small businesses use an IT partner because the difficult part is making the IT compliant and answering the questions accurately, not the form itself.
A business continuity plan is what keeps you trading when something goes wrong, whether that is a cyber attack, a flood, a power cut or a key system failing. It is not just for large companies. Small businesses are often hit hardest by disruption because they have less slack to absorb it. This practical guide walks through how to build a plan that actually works.
Put simply, a business continuity plan sets out how you keep trading through a disruption and recover afterwards. The NCSC guidance on backing up data is a good place to start on the IT side.
What is a business continuity plan?
A business continuity plan sets out how your business will keep its most important operations running during and after a disruption, and how it will recover fully. It answers three questions: what could stop us working, how do we keep going in the meantime, and how do we get back to normal. Done well, it turns a potential crisis into a manageable incident.
Why every business needs one
Downtime is expensive, and small businesses feel it fastest.
Cyber attacks, hardware failures and human error are common, not rare.
Customers and insurers increasingly expect a plan to be in place.
A clear plan removes panic and guesswork when something does happen.
How to build a continuity plan, step by step
Identify your critical functions. List the activities you cannot operate without, such as taking orders, serving customers or processing payments.
Assess the risks. Work out what could disrupt each function, from cyber attacks to power and premises issues.
Set your recovery targets. Decide how quickly each function must be back (recovery time) and how much data you can afford to lose (recovery point).
Put protections in place. This is where backups, disaster recovery, security and redundancy come in.
Write the plan. Document who does what, key contacts, and step-by-step actions for the most likely scenarios. Our free business continuity plan template takes you through this in eight short steps and gives you a finished plan to download as a PDF or Word document.
Test and review it. A plan you have never tested is a guess. Run through it, fix the gaps, and review it regularly.
The IT side: backup and disaster recovery
For most businesses, the biggest continuity risk is losing access to systems and data. Reliable, tested backups and a disaster recovery plan are the foundation, so that if a server fails or ransomware strikes, you can restore quickly rather than starting from scratch. The golden rule is that a backup you have never tested to restore is not a backup you can trust.
Common mistakes to avoid
Writing the plan once and never testing or updating it.
Assuming backups work without ever restoring from them.
Focusing only on IT and forgetting people, premises and suppliers.
Keeping the plan in one place that becomes inaccessible in a crisis.
How ATS Connection can help
We help West Sussex businesses build practical continuity into their IT, with reliable backups, tested disaster recovery and proactive managed IT support that reduces the chance of disruption in the first place. Not sure where you stand? Start with a free IT assessment, or get a quote. Call 01903 255 159.
Frequently asked questions
What is a business continuity plan?
It is a documented plan for keeping your most important operations running during a disruption, such as a cyber attack or system failure, and recovering fully afterwards.
Do small businesses need a continuity plan?
Yes. Small businesses often suffer most from disruption because they have less capacity to absorb it, so a simple, tested plan is well worth having.
What is the difference between business continuity and disaster recovery?
Business continuity is the broad plan for keeping the whole business running. Disaster recovery is the IT focused part, covering how you restore systems and data after an incident.
What are recovery time and recovery point objectives?
Recovery time is how quickly a function must be back up. Recovery point is how much data you can afford to lose, measured as the gap since your last good backup.
How often should I test my continuity plan?
Regularly, and at least once a year, plus whenever your systems change. Testing, especially restoring from backups, is the only way to know the plan actually works.
IT disaster recovery is your plan for getting systems and data back up and running after something goes wrong, whether that is ransomware, a failed server, accidental deletion or a flooded office. For a small business, the difference between a good recovery plan and none at all can be the difference between a bad day and a closed business. Here is what you need to know.
In short, IT disaster recovery is how you get systems and data back after ransomware, a failure or accidental deletion. The NCSC guidance on backing up your data underpins any good plan.
What is IT disaster recovery?
IT disaster recovery is the set of tools and procedures that restore your technology after a disruptive event. It is the IT focused part of wider business continuity planning, and it answers a simple question: if we lost access to our systems and data right now, how would we get them back, and how fast?
Why small businesses are especially at risk
Smaller businesses are targeted by cyber criminals precisely because their defences are often weaker, and they have less financial cushion to survive extended downtime. A single ransomware attack or server failure without a tested recovery plan can wipe out records, halt trading and cost far more than the protection would have. The good news is that solid recovery is well within reach for any SME.
The building blocks of a recovery plan
Reliable, automated backups: your data backed up regularly, with copies held offsite or in the cloud.
The 3-2-1 rule: three copies of your data, on two types of media, with one kept offsite.
Recovery targets: how quickly systems must return (recovery time) and how much data you can afford to lose (recovery point).
Tested restores: proof that you can actually recover the data, not just back it up.
A documented plan: who does what, in what order, when the worst happens.
Backup is not the same as disaster recovery
This trips up a lot of businesses. A backup is a copy of your data. Disaster recovery is the whole process of getting your business operational again, which includes the backups but also the systems, the order of restoration and the people. You can have backups and still have no recovery plan. Reliable backup and disaster recovery ties the two together.
Protecting against ransomware
Ransomware is now the most common disaster IT teams face. The defence is layered: strong security and staff awareness to reduce the chance of infection, plus offline or immutable backups that ransomware cannot encrypt, so you can restore rather than pay. Certification such as Cyber Essentials helps put the preventative controls in place.
How to test your recovery plan
Schedule regular test restores from your backups.
Time how long a full recovery actually takes, and compare it to your target.
Run a tabletop exercise of a realistic scenario with the team.
Fix the gaps you find, and review the plan whenever systems change.
It is the tools and procedures for restoring your IT systems and data after a disruptive event such as ransomware, a server failure or accidental deletion, so the business can get back to work.
Is a backup the same as disaster recovery?
No. A backup is a copy of your data. Disaster recovery is the whole process of getting your business operational again, which uses backups but also covers systems, order of restoration and people.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of media, with at least one copy stored offsite or in the cloud. It protects you if any single copy or location is lost.
How can I protect my business from ransomware?
Use layered security and staff training to reduce infection risk, keep offline or immutable backups that ransomware cannot encrypt, and test that you can restore from them.
How often should I test my disaster recovery plan?
Regularly, and at least once a year, plus whenever your systems change. Test restores are the only way to be sure your backups and plan actually work.
