Viewing archives for Technology

How to stop worrying about cybersecurity and compliance: Part II

This article is the second in our two-part report designed to provide busy CEOs with a template for mitigating the stresses and risks of cybersecurity and compliance. Here is part I if you missed it.

Previously we discussed why businesses often procrastinate when it comes to cybersecurity and regulatory compliance. Now it’s time to enumerate how you can mitigate the risks and sleep better at night.

  1. Make a Risks-and-Issues Analysis

Every substantial business should maintain a list of risks and issues, with some analysis of the mitigation options. The board should review this document at least annually, and each risk or issue must be owned by an executive with the expertise and time to manage it.

A certain level of risk is of course inevitable. But you need to know what you have, what’s valuable and what’s vulnerable. Documenting the risks, and having an open discussion about them, will drive sensible decisions about how to mitigate risk and take action when and if the worst happens.

Even better, it avoids sweeping issues under the carpet. Instead, you can confront the real business risks, identify a proportionate response, and ensure you are looking after the things that matter.

Proper backup plans, disaster recovery and crisis management plans will flow from these discussions.

  1. Sort Out Your Cyber Insurance

It’s prudent to consider cyber insurance. But not all cyber insurance is created equal. You need to carefully select an appropriate policy and provider.

The first thing to watch out for is if the provider takes the time to understand your risks and requirements. If they don’t, then they’re simply looking to sell you a policy, and you should walk away.

Next, check the exclusions on the policy. Make sure a member of your board understands the coverage – most importantly, if it covers ransomware payments, recovery costs, and loss-of-business. Remember that cyber insurance may not give you back money that’s stolen from you, that generally requires criminal insurance.

Also, you should learn how claims work with the insurer. If you have to make a claim, will the insurer specify who runs the recovery programme? If so, how quickly can this third party mobilise? If the insurer does not stipulate a third party, don’t wait for an incident to evaluate potential suppliers – identify the best one now.

Ensure that your IT is compliant with the policy. The insurer may impose requirements on your IT, and these requirements may be obscure and complicated. Often the CFO signs the insurance policy without communicating the requirements to the IT team. And the IT team may need to document how they meet the requirements so that the insurer can audit if necessary, otherwise your policy may be invalid!

Finally, are your suppliers’ contracts clear about their liability? And are they appropriately insured?

  1. Get Behavioural and Awareness Training

The weakest security link in any business is often the people. Some of your staff may struggle to understand the issues or to know what secure behaviours really are. You need to clarify your expectations.

Unfortunately, lots of companies have security protocols that no-one reads. Or perhaps people circumvent the rules with the tacit approval of their managers, who are busy and under pressure to deliver results. For example, if managers are writing passwords on Post-its, or accessing email from insecure home computers, then their subordinates will do the same.

Instead you’ll want to foster a culture of security. For example, is your finance manager empowered to challenge an email that looks like it’s from you calling for an “emergency payment?” How are suppliers’ bank details verified? Is your IT staff empowered to call out poor security practices from senior managers?

We recommend awareness training, which is relatively inexpensive – a few hundred or thousand pounds. A small price to pay compared to the expense of getting hacked!

  1. Get Cyber Essentials Plus

For most businesses there is a simple route to getting basic security right – certification from the government-sponsored scheme, Cyber Essentials Plus.

Specifically, this scheme identifies the basic technical measures to ensure your equipment is properly looked after, your network properly setup, and access properly controlled.

Most importantly, Cyber Essentials Plus requires all these things to be independently checked. Don’t ask your existing IT supplier to do it, get an independent assessor!

The total cost of this certification should be just a few thousand pounds and take a few weeks from start to finish.

We advocate that every mid-market business attains Cyber Essentials Plus. It certainly isn’t the whole answer, but it’s a big step forward for a lot of companies.

  1. Do a Penetration Test

A penetration test is when a third party looks for weaknesses in your website. Most companies can have a full, detailed penetration test for just a few thousand pounds.

This is essential if your website includes custom software or any kind of ecommerce services! Poor technical practices can result in custom software being full of holes. The OWASP top 10 is a list of the standard vulnerabilities that almost all hackers focus on – ensure your penetration test includes checks against this list.

Typically, penetration test findings are divided into high, medium and low priority. Address all high- and medium-priority issues immediately. Address low-priority issues on a case-by-case basis.

  1. Comply with GDPR

The General Data Protection Regulations came into force in Spring 2018 with much fanfare. Since then it’s all gone a bit quiet, and a lot of people are hoping it will go away entirely! But the rules are in force, with high penalties for breach.

The good news is that for the most part, the compliance measures are sensible and worthwhile. And most businesses can organise an expert assessment of their GDPR compliance for a few thousand pounds.

The recommendations can be complicated, and GDPR compliance can be a long process. So you’ll need to plan the work as a series of projects. Someone at board-level needs to have ownership of it, preferably someone both commercial and sensible in their approach.

GDPR compliance can be daunting. But you will make useful steps towards well-managed and well-organised back office systems. Consider it a useful tool quite apart from the legal requirements. In the end, your company will run more efficiently and make better use of its data, which is a valuable asset.

  1. Comply with ISO27001

ISO27001 is a more serious information security and management standard. Some companies have this standard imposed on them by corporate or government customers.

Either way, if your business is complex or has specific security requirements then ISO27001 provides you with a means to foster a culture of security. For example, if you manage sensitive data or valuable IP; if you want to demonstrate your credentials to demanding corporate clients; or if you plan for your business to offer important IT services, then ISO27001 gives you a means to embed security into every aspect of your business operations.

This is another standard that requires external assessment. Although it may only cost a few thousand pounds, implementing the necessary changes can be complicated and invasive. But that’s why companies brag about their ISO27001 accreditation — it’s a demanding standard and it means something.

Remember: Secure Companies Are More Efficient and Reliable

Let’s emphasize that the above steps are sensible. They will make your business more secure, so that you can your customers can sleep soundly. And in the event of a problem – because there are always problems – you will have mitigated the damage, and your business will recover more quickly, and you can avoid criticisms or accusations of negligence.

One final point: well-maintained systems and security practices will make your business far more effective, profitable and reliable.

You may like to visit our Knowledge Centre which includes all content related to this topic.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

How to stop worrying about cybersecurity and compliance: Part I

This article is the first in our two-part report designed to provide busy CEOs with a template for mitigating the stresses and risks of cybersecurity and compliance.

It is not an exaggeration to say that most days we hear from companies who have been hacked. Their reputations are damaged, they’ve lost money, and they’re not sure what to do next.

Freeman Clarke CIOs, CTOs and IT Directors have deep experience in helping clients navigate these dangerous waters. But the uncertainty can begin much earlier: we’ve also seen how even the threat of a cyberattack makes many CEOs of mid-market companies feel exposed and uncertain.

Another stress is the related issue of compliance: many companies are at risk of huge contractual penalties from their customers in the event of a data breach or the like. And the law is tighter than ever, with big government fines making headlines.

For business in heavily regulated industries, security standards and good practice are part of the corporate culture. But for most businesses in ordinary markets, the situation is far more ambiguous.

These are complex issues. And a CEO’s time is short. It can be difficult to find a simple, affordable strategy for security and compliance. There is often no-one in the boardroom with the necessary technical knowledge, experience, and sensible attitude to lead the approach.

That’s why we’ve prepared this two-part report: to provide busy CEOs with a template for mitigating the stresses and risks of cybersecurity and compliance.

Why it’s hard to get started

In our experience the underlying issue is that mid-market companies lack the expertise to feel confident. The IT team understands the technical issues; business teams understand the commercial issues. But there may not be someone at the executive level with a firm grasp of all sides of the problem.

Meanwhile, external advisors are typically selling expensive products like AI-based intrusion detection, data loss prevention software, or advanced malware protection. But they’re often more concerned with making a sale than helping your company.

Often the starting points should be relatively inexpensive training sessions that will cultivate a culture of compliance in your staff. At the same time, there are simple steps to reduce threats and to minimise impact in the event of a breach.

The ideas are straightforward, but their execution can be complicated. Boards need to accept that secure practices might not be as convenient or simple as the status quo. But keeping your business secure is worth the investment of effort and, when done well, the positive impact enormously outweighs the negative.

But, above all, given the real risks and regulatory environment, there is no longer any alternative to taking action!

The basics of security and compliance

You may have heard that there’s no such thing as being truly secure. Well, that’s true — when it comes to cybersecurity, there is no finish line. But there are a set of basic, practical steps that every business should put in place.

Consultants, product vendors, and the media would have you believe that it’s much more complicated. But based on our years of experience with hundreds of mid-market companies, nearly every single hack or breach were a result of basic errors — mistakes due to carelessness, lack of training or lack of expertise.

Yes, sophisticated attacks do happen. But they’re very rare. And even when sophisticated attacks have occurred, basic measures have allowed our clients to recover quickly with limited damage.

Our follow-up article provides a clear roadmap to help you rest easier when it comes to security and compliance. In the meantime, for more straightforward advice about cybersecurity, see our article on the 13 Strategic Steps to Cyber-Security for Non-Technical Board Members.

And here is part II of cybersecurity and compliance.

Visit our Knowledge Centre which includes all content related to this topic.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

How to choose an ERP product and solution provider

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss a number of topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on How to choose an ERP product and solution provider.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

Get Real: How does tech fuel business growth?

We recently launched Freeman Clarke in the US and hosted an event where 3 panellists discussed how technology fuels business growth. The 3 panellists; Matt Pritchard, Ramin Behesti and Jonathan Giaramita who all work within different industries, job roles and business sizes, came to conclusion that despite these variables the driver to successful growth through technology was down to people, process and organisational challenges.

We filmed a quick interview with each of the panellists before the event to get their opinion on the subject matter – and their take on how technology has affected their business.

Matt Pritchard, VP Digital and Innovation, Campbell’s Soup Company

Ramin Beheshti, Chief Product and Technology Officer, Dow Jones

Jonathan Giaramita, CFO, The BP Group

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

Key steps to prevent ERP projects going wrong

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss a number of topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on Key steps to prevent ERP projects going wrong.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

ERP pearls of wisdom from our experts

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss several topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on ERP pearls of wisdom from our experts.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

ERP horror stories from our experts

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss a number of topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on ERP horror stories from our experts.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

How can ERP deliver transformation

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss a number of topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on How can ERP deliver transformation.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

ERP disasters and how to prevent them

We have recorded a series of discussions about ERP. Two of our Regional Directors (Christine Parker Stubbs and Victor Kemeny) and two of our Principals (Kev Cooper and Peter Taylor) discuss a number of topics relating to the success and complexities of embarking on such a project; The transformational effect they can have, the pitfalls, horror stories, choosing the right products and suppliers and how to get started.

This audio focuses on ERP disasters and how to prevent them.

You can listen to the other audios in this series here.

Freeman Clarke is the UK’s largest and most experienced team of part-time (we call it “fractional”) IT leaders. We work exclusively with ambitious organisations and we frequently help our clients use IT to beat their competition. Contact Us and we’ll be in touch for an informal conversation.

A Concise Introduction to Integration Problems Part I: How to Spot Them

Subscribe to our Business Insights

Plain English board-level briefings focused on technology strategies to deliver competitive advantage and business success.

* Please enter an email address
newnewsletterrecipient

You can unsubscribe at any time.

Thank you.

You’ll now receive regular expert business insights.

Call us on 0203 020 1864 with any questions.

Graeme Freeman
Co-Founder and Director

Subscribe to our Business Insights

Plain English board-level briefings focused on technology strategies to deliver competitive advantage and business success.

* Please enter an email address
newnewsletterrecipient

You can unsubscribe at any time.

Thank you.

You’ll now receive regular expert business insights.

Call us on 0203 020 1864 with any questions.