There's a playbook for not getting hacked. Most businesses have never seen it.
The CIS Controls are a prioritised list of the defences that stop real-world attacks. The global community behind them studies real attacks and keeps the list current. Banks and governments build their security on it. We use it to protect Suffolk businesses and show you, with a score, exactly where yours stands.
Most small-business security is bought, not planned
A firewall from one salesperson. Antivirus from another. A backup somebody set up years ago. Each piece felt sensible at the time, but nobody can tell you what it all adds up to or what's still wide open.
Security by gut feel
- A pile of products, each one sold to you as "essential"
- No way to tell whether any of it actually made you safer
- The next spend decided by whoever rings you next
- Insurance forms answered with hopeful guesses
- Antivirus and crossed fingers
Security by playbook
- One prioritised list, written by people who study real attacks
- A score you can see and watch improve
- Every pound aimed at your biggest risk first
- Evidence for insurers, customers and Cyber Essentials
- You always know what's next, and why
18 controls. Priority order. Plain English.
Maintained by the Center for Internet Security and battle-tested for over a decade, the controls read like a to-do list because that's exactly what they are. Here's the whole thing, translated.
Know every device you own
Inventory & Control of Enterprise AssetsKnow every app you run
Inventory & Control of Software AssetsKnow where your data lives
Data ProtectionDitch the out-of-the-box settings
Secure Configuration of Assets & SoftwareKnow exactly who has an account
Account ManagementGive people only the access they need
Access Control ManagementPatch weaknesses before they're found
Continuous Vulnerability ManagementKeep the security cameras rolling
Audit Log ManagementGuard the front doors: email & web
Email & Web Browser ProtectionsStop malicious software cold
Malware DefencesBackups that actually restore
Data RecoveryKeep the network kit locked down
Network Infrastructure ManagementWatch for intruders, all the time
Network Monitoring & DefenceTrain people to spot the scam
Security Awareness & Skills TrainingVet the companies you rely on
Service Provider ManagementBuild software the secure way
Application Software SecurityHave a plan for the bad day
Incident Response ManagementAttack yourself before they do
Penetration TestingNobody starts with all 18. The playbook has a defined starter level called essential cyber hygiene. It is designed for smaller businesses and blocks the large majority of common attacks. Priority order is the whole point: first things first.
Less worry, less waste, more proof
You'll know exactly where you stand
No more wondering "are we OK?" at 2am. Your security becomes a score with plain-English notes: what's solid, what's exposed, and what it means for your business.
Money aimed at risk, not fear
Priority order means your budget goes at the biggest risk first, and much of the starter level is setup and process, not new kit. You stop buying products that don't move your score.
Proof when it counts
Insurance proposal forms, customer security questionnaires and Cyber Essentials are answered with evidence instead of guesses. Increasingly, that's the difference between winning work and losing it.
Score. Plan. Climb.
Score
We measure your business against the playbook and turn the result into a score with plain-English notes. You get an honest picture without jargon or scare tactics.
Plan
Together we pick the order: quick wins first, urgent gaps next, nice-to-haves later. You see the cost and effort of each step before anything happens.
Climb
We work the list as part of your monthly service and re-score as we go. Security stops being a vague worry and becomes a number that keeps getting better.
Want to see this applied to Microsoft 365? The West View M365 Security Standard assesses the environment, closes the important gaps and continuously improves the baseline.
What most owners ask next
Aren't we too small to be a target?
Attackers don't pick targets any more. Their software scans the whole internet for any business with a gap. In the government's latest Cyber Security Breaches Survey, 43% of UK businesses (including 46% of small businesses) were hit by a breach or attack in a single year. Small firms get hit because they're less defended, not less valuable. The playbook exists precisely so a 10-person business can close the same gaps a bank would, without a bank's budget.
We've already got antivirus. Isn't that enough?
Antivirus is control 10 out of 18. It's genuinely useful, but most incidents start with a phished password, a forgotten account or an unpatched app. Antivirus sees none of those coming. (Phishing is the UK's most common attack by a distance.) That's why the playbook covers people, accounts and settings, not just software.
Our IT company says they've got it covered.
Great. Ask them one question: "covered against what list?" If the answer is "trust us", that's a feeling, not a measurement. Any provider doing the job properly should be able to show you where you stand against a recognised standard, in language you understand.
Is this another certificate, like Cyber Essentials?
No. The CIS Controls are the working playbook, while Cyber Essentials is the badge. The two overlap heavily: work through the CIS list and certification (increasingly required for contracts and insurance) becomes a formality instead of a scramble.
Do we have to do all 18 at once?
No, and you shouldn't. The controls come in levels, and the starter level is specifically designed for smaller businesses without in-house security people. It's the highest-value slice: the essentials alone block the large majority of common attack methods.
What does it cost?
The conversation about where you stand is free. Much of the starter level is configuration and process that secures what you already own. And because the list is prioritised, the investment spreads over time, aimed where it matters most.
Owen Williams · Managing Director
Want to know your score?
Book a relaxed 30-minute call with Owen. We'll talk through where your business stands against the playbook in plain English, with no hard sell.
01449 798119 · enquiries@westviewit.co.uk