Northwatch Group
A mountain valley at night between snowy slopes, a low light over the far ridge.
Continuity

Security is continuity.

Good security keeps the work going when something goes wrong. This is how we think about it.

01What an incident actually costs

Many incidents at small organisations start with something ordinary: a door left open, an account not closed, someone tricked once. The cost is rarely one big bill. It is a run of smaller ones.

Downtime
Work stops while things are put right. Of the businesses that identified a cyber breach or attack in the past year, 11% said it stopped staff doing their day-to-day work (Cyber Security Breaches Survey 2025/2026).
Lost data
Files that were only on one laptop, or only in one mailbox, may not come back.
Lost trust
Clients expect their information to be looked after. A breach is a conversation with each of them.
Regulatory exposure
A personal data breach that is likely to put people at risk must be reported to the Information Commissioner's Office within 72 hours of becoming aware of it, where feasible (ICO, Personal data breaches: a guide, updated 2025).
Insurance questions
47% of businesses have some cover for cyber risks, but only 10% hold a specific cyber policy (Cyber Security Breaches Survey 2025/2026). Insurers usually ask what controls and plans are in place.

How common is it? In the past year, 43% of businesses and 28% of charities identified a cyber breach or attack, and phishing was by far the most common kind: 38% of businesses and 25% of charities (Cyber Security Breaches Survey 2025/2026).

Four ordinary examples

A break-in

The laptops go, and the client files go with them if they were not encrypted or kept anywhere else.

A compromised mailbox

Someone else reads your email and sends your clients fake invoices from your real address.

A propped fire door

Wedged open for deliveries: a fire-safety problem and an unwatched way in at the same time.

A leaver with access

Months later they can still open the shared drive, the client system or the front door.

02Physical and digital are one risk

The same gap is usually both. Treating them separately leaves the join between them open.

Physical becomes digital

  • An unlocked comms cupboard gives anyone the network.
  • A laptop left in a car is a copy of your files in someone else's hands.
  • A visitor at an empty reception desk is next to a logged-in screen.

Digital becomes physical

  • A door code sent round by email lives in every inbox it reached.
  • Door entry on the same network as the guest Wi-Fi can be reached from the car park.
  • An out-of-office reply can tell anyone when the building is empty.

03How we think about risk

  1. Identify. What matters most to the work, and what could get in its way.
  2. Judge. How likely each risk is, and how much it would hurt if it happened.
  3. Treat. Reduce it, transfer it (insurance, contracts), avoid it (stop doing the risky thing), or accept it knowingly.
  4. Stay proportionate. Spend where it changes the outcome. No gold-plating, and nothing bought because it sounds reassuring.

04Continuity planning

A continuity plan answers four questions before you need the answers. Only 25% of businesses have a formal incident response plan, and 44% of small businesses have a continuity plan that covers cyber security (Cyber Security Breaches Survey 2025/2026).

What to keep running
The few things the organisation cannot do without: taking calls, paying staff, seeing clients, meeting deadlines.
How fast it must come back
For each one, how long you can manage without it, and what you would use in the meantime.
Who does what
Named people and deputies, who to call (insurer, IT provider, bank, the ICO), and where the contact list lives when the systems are down.
Testing the plan
A walk-through of one realistic scenario with the people involved. The NCSC's free Exercise in a Box is a good place to start.

05Where we fit

  1. AssessYour premises, people and systems, within a written scope.
  2. Write the prioritiesEvery finding ranked, with its evidence.
  3. Fix in the right orderThe right fixes first, with you or your providers.
  4. Check againA follow-up against the first report.

Start with an assessment

Security assessment from £400

An independent look at your organisation's security: physical, digital or both. Findings and priorities in writing, so you know what to fix first.

On-site visits are quoted with travel.

Ask about an assessment

Questions

Is business continuity only about IT?

No. A fire, a flood, a break-in or a key person leaving can stop the work as surely as a cyber attack. A useful plan covers premises, people and systems together.

We are a small organisation. Do we need a written plan?

A short one, yes. It should say what has to keep running, how quickly it must come back, and who does what. A few pages that people have read are worth more than a long document nobody opens.

How often should the plan be tested?

At least once a year, and after any big change such as a move, a new system or a key person leaving. A tabletop walk-through of one realistic scenario is usually enough to find the gaps.

Does cyber insurance replace a plan?

No. Insurance can cover some of the cost, but it does not restore your systems or reassure your clients, and insurers will usually ask what controls and plans you already have.

Sources

Start with a security assessment.

Ask about an assessment Book a 20-minute call

The call button opens an email asking for three times that suit you. Or use the contact form, or email hello@northwatchgroup.com.