Cybersecurity Awareness Month: 10 Checks for UK Business

Cybersecurity Awareness Month comes round every October, and most of the advice attached to it is the same advice as last year. Use strong passwords. Don’t use the same passwords and don’t click dodgy links.

This post takes a different approach. Below are ten checks you can actually carry out, each tied to a specific thing that has changed, a requirement that now applies, or a figure showing how many UK businesses are getting it wrong.

What is Cybersecurity Awareness Month?

Cybersecurity Awareness Month is always the month of October. Now in its 23rd year, it is led by the National Cybersecurity Alliance together with the US Cybersecurity and Infrastructure Security Agency, and the 2026 theme is “Don’t Make It Easy for Them” (National Cybersecurity Alliance).

It promotes four habits: strong unique passwords, multi-factor authentication, keeping devices updated, and pausing before clicking.

The UK context gives it some weight. The NCSC’s most recent Annual Review reported 204 nationally significant cyber attacks in the year to August 2025, up from 89 the year before, and 18 highly significant incidents, an increase of nearly 50% (NCSC). That works out at roughly four serious incidents a week.

The 10 checks

1. Check what is still running Windows 10

This one is time-critical, so it goes first.

Windows 10 reached end of support on 14 October 2025 (Microsoft). Organisations that bought Extended Security Updates to buy themselves time are now approaching the end of that first year of cover, which runs out on 13 October 2026.

Two details catch people out. ESU does not renew automatically, so Year 2 is a separate purchase with a new key deployed to each device. And the price per device doubles with each year of cover, so delay is expensive as well as risky.

The awkward part is that nothing visible happens when cover lapses. The machine boots, the apps open, staff carry on. It simply stops receiving security patches, quietly.

The check: list every device still on Windows 10, including the ones nobody thinks of as computers. Reception displays, back-office machines, EPOS terminals and anything attached to a piece of equipment all count.

2. Check MFA is on everywhere, not just email

Multi-factor authentication is the single most effective control against stolen passwords, and UK adoption is still surprisingly patchy. The government’s Cyber Security Breaches Survey 2025/2026 found that only 47% of businesses use any two-factor authentication for networks or applications (DSIT).

This also stopped being optional for anyone pursuing certification. Since 27 April 2026, Cyber Essentials requirements v3.3 make MFA mandatory on all cloud services where it is available, and missing it is an automatic fail (IASME).

The check: list every cloud service holding company data and confirm MFA is enforced on each one. Email usually gets covered. Accounting software, the CRM, file storage, the website admin and the domain registrar often do not, and the registrar is the one that lets someone redirect your entire domain.

3. Check your backups restore, not just that they run

Around three quarters of businesses back up to a cloud service, so the habit is well established. Whether those backups work is a separate question, and one that tends to get answered at the worst possible moment.

A green tick in a backup console confirms that a job completed. It does not confirm that the data inside is complete, readable, or recent enough to be useful.

The check: pick one important file and actually restore it. Time how long it takes and note who had to be involved. Then ask the harder question: if ransomware encrypted everything tonight, could an attacker reach the backups too? A backup sitting on the same network with the same credentials is not really a backup.

4. Check who still has access

Accounts accumulate. Someone leaves and their mailbox gets forwarded rather than closed. A contractor finishes a project and nobody revokes the login. An old admin account sits dormant with full rights and no MFA.

Dormant accounts are attractive precisely because no real person is watching them. Nobody notices the unusual login because nobody is expecting any login at all.

The check: export the user list from your main systems and read it. Flag anyone who has left, any shared logins, and any account with administrator rights that does not need them. Shared logins are worth particular attention, because they make it impossible to tell afterwards who did what.

5. Check your domain cannot be spoofed

Phishing remains the most common attack on UK businesses by a wide margin, experienced by 38% of businesses in the last year, and 69% of those affected rated it the most disruptive incident they faced (DSIT).

The version that hurts most is the one that appears to come from you. A fake invoice sent from your own domain to your own customers is convincing because, as far as their mail server is concerned, it is genuine.

Three DNS records prevent this: SPF, DKIM and DMARC. The NCSC recommends every domain you own carries a DMARC record, including domains you never send email from (NCSC). Parked domains are easy targets because nobody is watching them.

The check: look up your DMARC record. If it does not exist, or it says p=none and has done for a year, your domain can still be used to send convincing fakes. A policy of none is a monitoring setting, not protection.

6. Check how quickly you actually patch

Cyber Essentials expects critical and high-risk security updates to be applied within 14 days. Only 34% of UK businesses have a policy to do so (DSIT).

Having a policy and meeting it are different things, and the gap usually lives in the same few places: the laptop of someone who always postpones the restart, the server that cannot be rebooted during business hours, and the line-of-business application whose vendor has not certified the latest version.

The check: find the device in your organisation with the oldest pending update. That device is your real patching timescale, whatever the policy says.

7. Check your password policy is not working against you

This is the check that usually surprises people.

If your systems force everyone to change their password every 90 days, you are following advice the NCSC has withdrawn. Its guidance states plainly that regular password changing harms rather than improves security, because users respond by making small predictable variations of the password they already had (NCSC).

The NCSC instead recommends dropping complexity rules in favour of minimum length, suggesting the “three random words” approach for memorable passphrases, supporting password managers, and reducing reliance on passwords altogether through MFA.

Cyber Essentials v3.3 now points further ahead, referencing passkeys and FIDO2 authenticators as preferred alternatives to passwords entirely.

The check: find out whether forced password expiry is switched on. If it is, turning it off is a rare security improvement that staff will actually thank you for.

8. Check you would know what to do in the first hour

Only 25% of UK businesses have a formal incident response plan (DSIT). Among large businesses the figure is 76%, which tells you something about who has been through one.

There is also a legal clock. Under UK GDPR, a notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it (ICO). Three days sounds generous until you spend the first two working out what happened.

The check: write one page. Who gets called first, who can authorise taking systems offline, where the backups are and who can restore them, your insurer’s number, and who decides whether the ICO needs telling. Keep a copy somewhere that does not depend on the network being up, because a plan stored only on the encrypted file server is not a plan.

9. Check your suppliers

Your security now includes everyone with access to your systems or data. Very few businesses look at this: just 15% review the risks posed by their immediate suppliers, and 6% look at the wider supply chain (DSIT).

The exposure is easy to underestimate. Your bookkeeper has access to your accounting system. Your web developer has access to your hosting. Your IT provider has administrative access to everything. A compromise at any of them is a compromise at yours.

The check: list every supplier who can log into something of yours. Ask the important ones two questions: do they hold Cyber Essentials, and how would they tell you if they were breached. The answers, or the silence, will be informative.

10. Check your staff have had something recent and realistic

Only 19% of businesses ran any cyber security training or awareness activity in the last year (DSIT). Given that phishing is both the most common and the most disruptive attack type, that is a meaningful gap.

Interviewees in the same survey noted that phishing has become harder to spot, with AI making impersonation attempts more convincing. The old advice about spelling mistakes and odd greetings has aged badly.

The check: rather than booking an annual slideshow, make sure every member of staff knows one thing: who to tell, immediately and without embarrassment, if they think they have clicked something they shouldn’t. The organisations that handle incidents well are usually the ones where people report quickly instead of hoping it resolves itself.

If you only do three of them

Ten checks is a lot for one month. If capacity is limited, the three with the best return are MFA everywhere (check 2), a backup you have personally restored from (check 3), and one page describing what happens in the first hour (check 8).

Between them, those three cover the most common way in, the thing that gets you back, and the half-day of confusion that usually makes an incident worse than it needed to be.

Frequently asked questions

When is Cybersecurity Awareness Month?

Every October. 2026 marks the 23rd year, with the theme “Don’t Make It Easy for Them”.

What are the five Cyber Essentials control areas?

Firewalls, secure configuration, security update management, user access control and malware protection. Around 24% of UK businesses have controls in all five areas, though only 5% hold the certification itself.

How long do I have to report a data breach in the UK?

72 hours from becoming aware of it, where the breach is likely to result in a risk to people’s rights and freedoms. Not every incident is notifiable, but the clock starts whether or not you have worked out the details yet.

Is Windows 10 still safe to use?

Only with Extended Security Updates in place. Without them, the device receives no operating system security patches, and nothing on screen tells the user that.

Should staff change their passwords regularly?

No. The NCSC advises against forced password expiry, because it pushes people towards predictable variations of passwords they already use. Long passphrases, a password manager and MFA do more.