Practical Guides

A five-step framework for identifying assets, mapping threats, scoring risks, and building a prioritised treatment plan. Includes regulatory mapping for NIS2, ISO 27001, and UK GDPR.

How to move from antivirus to EDR, automate patch deployment within the Cyber Essentials 14-day window, enforce BitLocker encryption, and manage devices with Microsoft Intune.

How to configure SPF, DKIM, and DMARC, secure mailboxes with MFA, deploy Microsoft Defender for Office 365, and build process controls that block business email compromise.

A six-step framework for building a cybersecurity programme from the ground up. Covers baseline assessment, control prioritisation, budget sequencing, and how to measure progress.

The six NIST phases, playbooks for ransomware, BEC, data breaches, and account compromise, GDPR and NIS2 notification obligations, and how to test the plan with tabletop exercises.

Cyvra guides businesses through ISO 27001 certification: the six steps, realistic timelines, costs, and what a full implementation engagement covers.

NIS2 requires 10 specific cybersecurity controls. Covers what they are, how to implement them, and incident notification before a breach forces your hand.

Understand PCI DSS v4.0 requirements for UK merchants. Learn which SAQ applies to your business, the 12 core requirements, and how to reduce your compliance scope.

The EU Cyber Resilience Act requires security-by-design for connected products. Vulnerability reporting from September 2026; full compliance December 2027.

Zero Trust replaces perimeter security with identity verification on every request. Five pillars, Conditional Access, NIS2 and ISO 27001 alignment.

Most Microsoft 365 tenants run default settings built for adoption, not security. Credential attacks and phishing campaigns succeed because basic hardening controls are never...

DORA has applied since January 2025. Step-by-step gap analysis framework for FinTechs covering all five pillars and a prioritised remediation roadmap.

Passkeys replace passwords with device-bound cryptographic keys that cannot be phished. This guide covers how FIDO2 works, what enterprise rollout looks like, and where legacy...

Ransomware appeared in 88% of SMB breaches. Covers what it does, key defences, what to do in the first 48 hours, and how to recover without paying.

Ransomware hit your organisation? Cyvra responds within hours. Six recovery steps: backup validation, eradication, GDPR notification, and hardening.

NIST CSF 2.0 and NIS2 share the same underlying controls. Implement them once to cover both frameworks and avoid duplicated security work.

Most SMEs spend 1-2% of revenue on IT. Benchmarks suggest 4-7% for professional services. Five categories, hardware cycles, and how to build an IT budget.

IT service desk essentials for SMEs: support tiers, ticketing, SLA targets and when a managed provider makes more sense than in-house IT.

Microsoft 365 Copilot amplifies data risks before it improves productivity. Covers oversharing, DLP gaps, and what to configure before you switch it on.

How to govern AI use in your organisation: map what you are using, classify by risk, write an AI policy, meet UK GDPR obligations, and assess EU AI Act applicability.

How to implement AI in your business: define the objective, prioritise use cases, assess data readiness, select technology, pilot, test, and measure the business result.