Your Cyber Insurance Renewal Is Coming. Is Your IT Provider Ready?
Cyber insurance requirements in the UK for 2026: the controls insurers check, the evidence they expect, and questions to ask your IT provider before renewal.
Quick answer: Remote working IT security comes down to four things: knowing which devices touch your data, protecting every login with multi-factor authentication, keeping company files in the cloud rather than on laptops, and training staff to spot phishing at home. Your people are not the problem. Unmanaged devices, shared home networks and weak sign-in rules are. Fix those and hybrid working becomes as safe as the office.
Most Aberdeen businesses moved to hybrid working quickly, often in a matter of days. Laptops went home, staff logged in from kitchen tables and the job got done. Few firms went back and checked how that setup was built. Years later, plenty of companies still run on arrangements that were only ever meant to be temporary.
That matters, because the office used to do a lot of security work for you without anyone noticing. A firewall sat on the edge of the network. Devices were in one place. Someone in IT could walk over and check a machine. At home, none of that applies. This post explains where the real risks sit and the practical steps that close them.
Remote staff are no less careful than anyone else. The risk comes from the environment around them. In the office, every device sits behind a business-grade firewall and connects to a network you manage. At home, the same laptop shares a broadband router with smart TVs, games consoles and a teenager’s downloads.
Home routers often still run the default password and old firmware. Personal phones get used to check work email. Staff print sensitive documents on home printers and leave them on the kitchen table. Each of these is small on its own. Together, they create gaps an attacker can use.
There is also a visibility problem. When nobody can see which devices hold company data, nobody can tell when one goes missing, falls behind on updates or picks up malware.
Across the businesses we support in the North East, the same issues come up again and again.
None of these needs expensive technology to fix. They need clear rules and the right Microsoft 365 settings.
You can’t protect what you can’t see. The first step is a simple list of every device that accesses company email or files, who uses it and whether it belongs to the business or the employee.
Microsoft Intune, which is included in Microsoft 365 Business Premium, makes this practical. Business laptops are enrolled so you can push updates, enforce encryption and wipe them remotely if they are lost. Personal phones can be handled with app protection, which secures the work apps without touching personal photos or messages. Staff tend to accept this far more readily than full control of their own phone.
Once devices are visible, you can set a basic rule: only healthy, up-to-date devices get access to company data.
Stolen passwords remain one of the most common routes into a business. Multi-factor authentication (MFA) stops most of these attacks because a password alone is no longer enough. If you only make one change after reading this, make it this one.
A few points make MFA work well for remote teams:
We cover why this matters in more detail in our guide to what happens after a cyber attack. Most incidents we’re called into began with a single compromised login.
When files sit on a laptop, a lost bag or a failed hard drive becomes a data loss incident. When files live in SharePoint, OneDrive or Teams, the laptop is just a window onto them.
Moving data to the cloud also fixes version chaos. Staff stop emailing attachments back and forth and work on the same document at once. If you’re unsure where different types of file should go, our post on SharePoint vs OneDrive vs Teams sets out a simple structure.
Back up your Microsoft 365 data separately too. Microsoft keeps the service running, but recovering deleted or encrypted files over the long term is your responsibility.
You don’t need to send an engineer to every employee’s home. A short set of guidelines goes a long way:
On the business side, modern endpoint protection and DNS filtering protect the device itself, wherever it connects. This is far more effective than relying on a VPN back to an office server, which is often slow and becomes a single point of failure.
Phishing attacks change their tactics for remote staff. Attackers know people can’t lean over and ask a colleague whether an email looks right. Short, regular training helps far more than a once-a-year presentation.
Focus on a few habits: check the sender address, never approve an MFA prompt you didn’t start, and confirm any payment change by phone using a known number. Make it easy and blame-free to report a suspicious email. The faster someone speaks up, the smaller the damage.
Use this quick review to see where your business stands.
Green: every device is enrolled and up to date, MFA is on for all accounts, files live in Microsoft 365 with a separate backup, and staff get regular phishing training.
Amber: MFA is on for most people, but some personal devices access email without controls, or some files still sit on laptops.
Red: no device list, MFA missing for some accounts, a VPN to an office server is the main protection, and no training in the last year.
If you landed in amber or red, you’re not alone. Most of the businesses we speak to are somewhere in the middle.
Remote working makes offboarding harder. A laptop at someone’s house is easy to forget when they leave, and old accounts stay active longer than they should. Build device return and account removal into your leaver process. Our secure leaver checklist walks through each step.
The same applies to lost or stolen devices. With Intune in place, you can wipe company data remotely within minutes rather than hoping the laptop was encrypted.
Unmanaged devices and stolen passwords cause the most problems. A laptop without updates or a login without MFA gives attackers an easy way in, regardless of where the employee works.
Not always. If your files and apps are in Microsoft 365, a VPN to an office server is often unnecessary. Device management, MFA and conditional access usually give better protection with less frustration.
They can, with controls. App protection policies keep company data inside managed work apps on a personal phone, and let you remove that data if the person leaves.
Cyber Essentials includes home working devices that access company data. They need to meet the same rules on updates, firewalls and secure configuration as office devices.
For a business of 10 to 50 people, the core controls can usually be in place within a few weeks, depending on how many devices need to be enrolled.
If you’re not sure how your hybrid setup would stand up to an attack, we can help. Our cyber security team offers a remote working security review that checks devices, sign-in settings and data storage, then sets out the gaps in plain English. Get in touch to book yours.
