If you run a professional services firm, a health clinic, a legal practice, an accounting business, a bookkeeping firm, or anything else that holds sensitive information about other people — this article is for you.
The single most common belief we hear from owners in these industries is: "we're too small to be a target." It's an understandable instinct. It's also completely disconnected from how attackers actually work in 2026. Automated tools scan the internet indiscriminately. Insurance and referrer expectations are rising every year. Larger clients now put security questionnaires in front of even tiny suppliers.
So what does "reasonable security" actually look like when you're a business of five, or fifteen, that holds client records that would matter if they leaked?
The security floor we won't compromise on
Every managed client — regardless of tier — gets:
- Endpoint Detection and Response (EDR) on every device, so an infection gets isolated before it spreads.
- Multi-factor authentication on every account, enforced by policy, not left as an opt-in.
- Patching and vulnerability management, so the "we'll get to it" list doesn't include the browser exploit from three weeks ago.
- Email filtering with anti-phishing and impersonation protection, because email is still the front door for most attacks.
- Backup verification, meaning we regularly test-restore backups instead of just checking that the job ran green.
- An incident response plan on file, and actually tested, so if the worst happens, we're not writing one at 2am on a Sunday.
- Dark web credential monitoring on your domains, so if a staff email address turns up in a breach dump, you find out from us, not from a stranger.
This isn't an upsell. It's the floor.
Why the floor is fixed
Because if we don't hold this line, we can't credibly protect the businesses this article was written for. And because insurers, regulators and larger clients are all moving in the same direction — evidence-based security, not attestation. The businesses that have it are winning contracts. The ones that don't are quietly losing them.
What sensitive-data organisations get on top of the floor
- Data classification and access control tailored to the record types you hold.
- Retention and deletion policies documented for regulator questions.
- Vendor risk reviews for the software you connect to your record system.
- A short, plain-English evidence pack you can hand to anyone who asks.
Book a baseline compliance review. We'll show you where you sit against the floor, in one sitting.
Book a baseline review