IT Governance for Small Businesses: Who Should Be in Charge of Cyber Security?

If you run a business, sooner or later a tender form, a big customer or your insurer will ask about your cyber security. Usually they want to see a certificate such as Cyber Essentials, and most owners know they need one. What they don’t know is where to start, and too many end up with a folder of policies nobody reads and a business that’s no safer than it was.

Getting this right is what governance, risk and compliance is about. For a small business it means one joined-up picture: what each standard asks for, what you’ve already done, what’s still a risk, and who’s dealing with it. So when one customer wants Cyber Essentials and another asks about ISO 27001, you only do the work once.

Cyber security is a decision for whoever runs the business

The first thing Dave points out to anyone looking at cyber security is that it is a business decision for the owner and the board, not a job to hand over to IT. Whoever looks after it needs to report to the owner or the board. If they report to IT instead, the difficult decisions never get made.

What stops a business getting safer is rarely the technology. More often it’s a sales director who won’t use the code on his phone, a finance team that wants to keep sharing one login, or a project that keeps slipping because nobody with authority has said it matters. Your IT support can recommend all day long. Only the person running the business can say “we’re doing this”.

What governance, risk and compliance mean for a small business

Why we’re all bad at judging risk

People are good at worrying about the things that happen every week. We’re poor at the rare events that could finish a business, and worse still at the ones nobody saw coming. Everyone knew a pandemic was possible, yet hardly any business had a plan for COVID-19 that turned out to be useful.

You can’t plan for everything, but you can plan for the big ones. Assume that one day criminals will get in, lock up every file you own and demand money to give them back. What would you do on day one? Who would you call? What would stop the business trading? Get the key people round a table and talk it through. Dave’s half-joking suggestion is a zombie apocalypse plan. It sounds daft, but walking through the worst case is how you find the gaps.

Four choices for every big risk

All four are fair answers. Leaving it undecided is the one that hurts. Whoever runs the business needs to know what happens if they choose to do nothing.

The tick-box trap

A public sector contract comes up and the tender asks for a certificate you don’t have. Someone is given the job of getting it, and they go down the list: tick, tick, tick. A few weeks later there’s a certificate on the wall and nothing important has changed.

Turn it round. Start with the risks that would genuinely hurt the business, decide who’s responsible for each one, and then use the certificate to help close those gaps. The work you do for the customer then makes you safer too, and you have far better answers when they come back with questions.

Our free book Cybersecurity Essentials for Business Owners starts from the same place: the risks that would hurt a small business first, then the checklists that help close them.

Which cyber security certificate does my business need?

There are dozens of cyber security standards, and most owners first hear about one when a customer’s tender form asks for it. You won’t need most of them. For most UK small businesses the answer is Cyber Essentials first, Cyber Essentials Plus when bigger public sector work needs it, and ISO 27001 when a large customer insists. Do the work once and it counts towards the others. The government’s National Cyber Security Centre explains the scheme on its Cyber Essentials pages, and IASME runs the certification on its behalf.

Our guide to Cyber Essentials covers how to get it, and Cyber Essentials Plus explains when the extra testing is worth it.

What the standards won’t tell you

All of these standards have their own ideas, and any of them will help get your house in order. Two things are missing from nearly all of them.

First, they don’t put your biggest risks at the top of the list. A standard gives every business the same checklist. Deciding which items matter most for you is still your job, which is why the risk conversation comes first.

Second, they lag behind. Not one of the common standards insists on passkeys yet, and every business should be moving to them.

Policies are easy. Changing how people work is hard.

You can open ChatGPT and have a full set of security policies by lunchtime. They’ll look impressive and nobody will ever read them. Writing a policy is quick. Getting everyone to work differently takes months, and it only happens when the person in charge says it’s happening.

Take the move to passkeys. You don’t need to understand the technology to make that call. You need four answers: what it is, what happens if you don’t do it, how long it will take, and what it means for the people doing the work. That’s the same as any other decision you make about the business.

Don’t make golf course decisions

A lot of owners and directors are wary of technology decisions. They don’t fully understand them and they don’t want to get it wrong, so they do what Dave calls making golf course decisions: they ask a mate at the golf club what he did, and do the same thing.

Your mate’s business isn’t your business. The people who look after your IT will usually have told you what worries them, even if they didn’t explain it in a way that made sense. It’s worth the effort of finding out what they meant.

What comes out of those conversations is budgeting, risk, how the business is structured and where the opportunities are: the things every leader should be spending time on. Treat IT like emptying the bins and you’re putting the whole business at risk.

Who should be in charge of cyber security in a small business?

Somebody has to own it, and they report to you rather than to the IT team. They don’t have to be technical, though it helps: they’ll understand which decisions need making and what’s getting in the way, and they can talk to the board in business terms and to the IT people in theirs.

There will always be more going on than any business can tackle, especially now AI is turning up in every piece of software you use. So the person in charge picks a few things, gets them over the line, and has your backing when they push. If nobody in the business can do that, bring in someone who can. A part-time IT director does exactly this job for businesses too small to need a full-time one.

Plan for the worst on one sheet of paper

When the systems are down, the plan saved on the server is no use to anyone. Dave gives his clients a single page they can print and stick on the wall next to the computer equipment, so the essentials are there when nothing else works.

If an attack does happen, our guide on what to do in a cyber attack covers the first few hours, and how ransomware attacks work explains how criminals usually get in.

A certificate can win you contracts your competitors can’t bid for

When a tender asks for a certificate that most of your competitors don’t hold, you may find you’re one of very few firms able to bid, sometimes the only one. Done properly, money spent on cyber security cuts the risk to the business and opens doors at the same time.