An acquisition can look financially sound while its M&A transaction assumptions overlook inherited technology costs. IT due diligence examines the target’s systems, security, software, suppliers and operating capability before those commitments become yours. The review should identify what could interrupt trading, restrict growth or increase integration costs, then connect each finding to a decision. Start with the acquisition plan, because technology that supports the target today may not support the combined business. Key Takeaways IT due diligence assesses whether the target’s technology can support the acquisition’s commercial assumptions and identifies what the buyer will inherit, need to invest in and integrate. Review systems, software, cyber security, data protection, infrastructure, recovery, suppliers, contracts, staffing and operating costs against the deal plan. Base findings on evidence and record each issue’s business impact, supporting evidence, owner, proposed treatment and estimated cost. Resolve material issues before signing where access permits. Carry any remaining uncertainty and remediation work into the acquisition terms, budget and integration plan. Establish what IT due diligence must answer IT due diligence assesses whether the target’s technology can support the acquisition’s commercial assumptions. It should establish what the buyer will inherit, what needs investment and which dependencies could prevent the planned integration. A reliable inventory helps, but it doesn’t establish whether systems are secure, recoverable or suitable for expansion. Separate the overlapping workstreams: IT due diligence examines infrastructure, applications, support, suppliers and operating costs. Technical due diligence examines software architecture, code quality, development practices and product scalability. Cyber due diligence examines exposure, access controls, incident handling and security operations. For a software business, architecture and intellectual property may dominate. For a professional services acquisition, identity, Microsoft 365, document access and business continuity may matter more. Base IT due diligence questions on the deal’s commercial assumptions. Cover expected user growth, international operations, planned integrations, data pipelines that support these plans and assumed cost savings. Assign owners and sequence the review Appoint a deal sponsor who can resolve commercial questions and a technical lead who can challenge the evidence. Involve legal, finance, security and operational owners where findings affect contracts, forecasts or continuity. Specialist advisers can provide independent scrutiny, but management still owns the acquisition decision. Use a sequence that follows dependencies rather than treating each assessment as an isolated exercise: Define the IT due diligence scope, material systems, business assumptions and access arrangements. Request evidence through a controlled data room against the agreed scope and deal assumptions, with named owners for missing information. Review architecture and software components, then commission appropriate code analysis. Assess cyber security, data management, infrastructure and recovery capability. Review contracts, staffing, operating costs and integration dependencies. Produce a prioritised report with commercial implications, remediation owners and estimated effort. Request architecture diagrams, asset registers, supplier contracts, security reports, recovery records and annual expenditure early. Missing evidence should remain an explicit limitation, rather than becoming an assumption that controls exist. Resolve material issues before signing where access permits. If an assessment must wait, document the uncertainty and its proposed treatment with the deal team. Review software architecture and code Examine design before relying on scan results During technical due diligence, review the software architecture. Check how applications exchange data, authenticate users, separate customers and handle increased demand. Establish which systems depend on unsupported frameworks, undocumented interfaces or manual intervention. Code scanning can identify security vulnerabilities and code quality issues, but it can’t establish whether the architecture supports the acquisition plan. Ask developers to explain deployment, testing, rollback and the effort required for planned changes. Technical debt is future work created by expedient implementation choices or deferred improvements. Record the affected components and business consequences. A backlog count alone doesn’t show whether delivery is constrained. Request an SBOM and establish ownership A software bill of materials, or SBOM, inventories open source components and their dependencies. It’s a starting point for identifying third-party licences and known vulnerabilities, not proof that every component is acceptable. Black Duck’s explanation of an SBOM describes its role in documenting open-source and third-party components. Compare the inventory with deployed versions, dependency records and supplier information. Review open source licence obligations with legal advisers, including distribution conditions and restrictions relevant to the intended use. Establish who owns custom code and whether employee, contractor and supplier agreements support that ownership. Assess infrastructure, cloud and recovery Request IT infrastructure inventories, including servers and hardware, network topology, cloud architecture, administration procedures and annual IT spend. Reconcile recorded IT infrastructure assets with management tools, invoices and support arrangements. Technical due diligence should examine cloud ownership, privileged access, resource configuration, billing commitments, capacity and recovery evidence. Separate current expenditure from costs that will change when contracts end or workloads move. Recovery evidence needs particular attention. Compare business recovery requirements with recorded restore tests, backup coverage and dependencies such as identity, connectivity and encryption keys. A successful file restore doesn’t demonstrate recovery of an entire application. Microsoft 365 also needs its own review. Tenant configuration, licences, permissions and retention settings can affect both security and migration effort. Our Office 365 assessment guide describes the relevant review areas. Where tenant consolidation is planned, involve Microsoft 365 migration support before agreeing dates. Existing email, Teams and SharePoint arrangements influence the work required. Examine cyber security and data protection Assess controls through evidence Use cyber due diligence to assess controls against evidence. Request privileged-account records, multi-factor authentication coverage, endpoint protection reports, patching evidence, penetration-test findings and incident response procedures. Identify unresolved security vulnerabilities and record who accepted each risk. Legal Edge reports that Intechnica found security issues in 1 in 5 businesses across more than 250 engagements in its technology due diligence overview. This finding from those engagements should not be treated as an industry-wide prevalence estimate. Assess authentication methods as well as coverage. The NCSC’s corporate MFA guidance recommends stronger protection against phishing. An enabled setting doesn’t prove that every privileged access route is protected. Review incidents and data obligations Map personal data, processing purposes, processor relationships, retention and international transfers. Review compliance with UK
Microsoft 365 access reviews: remove unnecessary permissions
A denied decision doesn’t always remove the underlying permission. These reviews help identify unnecessary group memberships, application assignments and privileged access, but removal depends on the resource type, review settings and how access was originally granted. Start by identifying those access paths, then configure reviewers, recurrence and enforcement. The useful outcome is confirmed removal, supported by evidence, rather than a completed review with outstanding changes. Key Takeaways Microsoft 365 access reviews check whether people still need access to groups, applications and privileged roles. They don’t replace joiner, mover and leaver procedures or sign-in controls. Check access paths beyond group membership, including direct SharePoint permissions, shared links, Teams shared channels and mailbox delegation. A denied decision doesn’t prove that access has been removed. Apply results where supported, check the status and record completed changes or assigned remediation. Choose reviewers with the right business context, set suitable review dates and recurrence, and pilot removal before enabling automatic application. Include active and eligible privileged role assignments in reviews, and retain decisions, justifications and remediation evidence. Define what Microsoft 365 access reviews will cover Separate permissions from sign-in controls An access review is a periodic check of whether someone still needs access. Reviewers decide whether user access to scoped resources should continue. These checks help prevent privilege creep, where permissions accumulate after role changes, temporary projects and supplier engagements. They support least privilege and compliance, but don’t replace joiner, mover and leaver procedures. Conditional Access addresses a different question: under what conditions an account may sign in. A successful sign-in doesn’t prove that existing access permissions are still appropriate. Identify access paths before selecting resources Inventory sensitive Teams, groups, enterprise applications and administrative roles. Record resource owners and group owners, the business purpose, membership source and whether external guests have access. Group membership is only part of the picture. SharePoint direct permissions, Anyone links, Teams shared channels and mailbox delegation may need separate checks. Our Office 365 assessment covers wider configuration and permission issues a group-focused review may miss. Check licensing against the review scope; Microsoft Entra ID Governance features depend on your subscription. Configure reviews in Microsoft Entra Select resources and accountable reviewers For standard group and application access reviews in Microsoft Entra ID, use an account with at least the User Administrator role. Follow Microsoft’s access review configuration guidance and begin with a limited pilot. Sign in to the Microsoft Entra admin center. Open Identity Governance, then start a new review. Select Teams + Groups or Applications, then choose the resources and users within scope. Select Next: Reviews and assign the reviewers. Choose reviewers who understand the business need, rather than whoever receives the fewest notifications. Group owners can assess collaboration access; application owners may be better placed to assess specialist systems. Provide a fallback reviewer in case the selected person is absent or unavailable. A self-review can gather information, but a user’s own decision to approve or deny sensitive access is weak evidence. Set stages, duration and recurrence A single-stage review lets assigned people make decisions within one stage. A multi-stage review uses two or three sequential stages with different reviewer groups. Use a multi-stage review when a decision needs different perspectives, such as business justification followed by application-owner approval. Extra stages extend the process and increase workload. Set Stage duration in days. When it ends, reviewees move to the next configured action or stage. Set the start date and Review recurrence, such as monthly or yearly, according to the resource’s sensitivity and rate of change. Schedule a review around quarter end when that fits the resource’s risk or reporting cycle. Set what happens when reviewers do not respond For access reviews, the non-response setting determines what happens when an item remains undecided. It doesn’t prove that access permissions have been removed. Applying results is a separate step, and removal depends on whether the resource supports the change. Use these settings together rather than treating each as an independent safeguard. Setting Effect Practical consideration Auto apply results to resource Applies decisions after the review expires, including removal of denied access where supported. Pilot removal before using it across sensitive resources. No change Leaves unanswered access unchanged. Escalate outstanding decisions rather than recording them as approved. Remove access Treats unanswered items as removal decisions. Allow for reviewer absence and business-critical access. Approve access Approves unanswered items. Silence doesn’t establish a continuing business need. Take recommendations Uses system recommendations for unanswered items. Understand which signals produced the recommendation. The No sign-in within 30 days recommendation favours approval for users who signed in within that period and denial for those who didn’t. Recent activity is evidence of use, not proof of need. An employee can use a system regularly while retaining permissions beyond their current responsibilities. Enable email notifications and reminders, and require a decision justification where appropriate. During a pilot, apply results manually so administrators can inspect proposed removals before enabling automatic enforcement. Use catalog reviews for related resources Bring multiple resource types into scope A catalog access review requires Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions. Creating one requires at least the Identity Governance Administrator role, so don’t assume the role used for a standard group review is sufficient. A catalog access review can include groups, applications and custom data-provided resources. Reviewers can assess related access together instead of reviewing each resource in isolation. Under Entitlement management, open Catalogs, select the catalog, then Resources and Add resources. Microsoft’s catalog access review documentation describes the configuration and supported resource model. Allow for timing and enforcement differences Changes made within 12 hours before a catalog access review starts may not appear in its results. Don’t treat last-minute membership cleanup as the baseline for a scheduled review. Record which resources were included and when the review started. This makes later differences between review data and current membership easier to explain. Adding resources to a catalog doesn’t guarantee that every target system can remove access automatically. Document the removal process for each resource,
Healthcare IT support: planning secure clinical services
Healthcare IT support needs to protect clinical access, patient data and recovery capability, not simply resolve tickets. A fast service desk response can still leave appointments disrupted if nobody owns the clinical application, network connection or supplier escalation. Secure planning starts with defined responsibilities, tested recovery and support commitments that match your operating hours. Compare providers against those requirements before comparing monthly prices. Key Takeaways Define who owns the service desk, infrastructure, clinical applications, supplier escalations and recovery tasks before support begins. Choose managed support or contract staffing based on the responsibilities and capacity your organisation needs to retain. Set access controls, supplier requirements and incident priorities around UK data protection duties and clinical risk. Set recovery point and recovery time objectives for each clinical system, then test complete restoration. Compare contracts by scope, service hours, exclusions, project costs and exit terms, not by monthly fee alone. What healthcare technology support should cover A managed service normally covers user assistance, device maintenance, security monitoring, patching, backups and supplier coordination. Clinical applications need separate attention because a provider may manage the workstation without controlling the electronic patient record system or its hosting platform. Separate front-line and wider support The service desk is the contact point for incidents and requests. Wider IT support covers infrastructure maintenance, security administration, capacity planning and technical projects. Tier 1 handles basic issues such as password resets and initial diagnosis. Tier 2 investigates more complex device, network and application problems. Tier 3 provides specialist engineering and escalations. Define when tickets pass from the service desk to clinical software suppliers, so they don’t circulate between teams. Inventory EHR systems, patient portals, prescribing tools, scanners, connectivity and authentication services. Include NHS Spine dependencies where relevant, but don’t assume every provider can maintain those integrations. Continuous monitoring and planned patching support cybersecurity, but every alert needs an owner and an escalation route. Unsupported devices need replacement plans or compensating controls. Our vulnerability management services address weaknesses that routine ticket handling may leave unresolved. Choose managed support or contract staff Managed IT support provides an ongoing service with agreed responsibilities, tools and performance commitments. Contract staffing provides engineering capacity under an agreed assignment. Either model can support an NHS organisation, but each leaves different management responsibilities with the customer. Managed services provide an operating function A managed IT services provider normally supplies its own service desk, ticketing platform, monitoring tools and escalation process. The contract should assign responsibility for maintenance, reporting and coordination with other suppliers. Recurring fees can move some expenditure into operating costs. Hardware purchases, migrations and major clinical-system changes may still require separate capital or project budgets. Contract staffing fills defined capacity gaps Contract staffing places vetted engineers into short-term or long-term assignments. NHS organisations use it for projects, vacancies, specialist skills, holiday cover and sickness absence. The organisation usually retains responsibility for IT support, including priorities, supervision and service performance, unless the agreement says otherwise. An engineer covering a vacancy doesn’t automatically provide overnight monitoring, incident management or disaster recovery. Define the assignment and its management separately. Map UK compliance to practical controls UK GDPR and the Data Protection Act 2018 govern how healthcare organisations process and protect patient data. Outsourcing support doesn’t transfer the organisation’s accountability for its processing decisions. Protect health data and control supplier access Health information is special-category personal data. Processing requires a lawful basis and an applicable special-category condition, as explained in the ICO’s UK GDPR guidance. Document controller and processor roles, processing instructions, subcontractors, retention and international transfers in supplier reviews and information governance records. Cloud storage doesn’t remove these obligations. Apply least-privilege access, multifactor authentication, separate administrator accounts and usable audit logs to support data security. Staff also need clear reporting procedures; our cyber security awareness training supports that operational requirement. For US covered entities and relevant business associates, HIPAA compliance sets a separate framework with access controls and audit documentation. HIPAA compliance is relevant when a supplier acts as a business associate to a covered entity. HIPAA compliance doesn’t establish GDPR compliance in the UK. Treat NHS assurance and certifications separately The Data Security and Protection Toolkit provides NHS assurance, with a distinct assessment category for IT suppliers. A supplier’s assessment doesn’t replace the healthcare organisation’s own responsibilities. Cyber Essentials provides evidence against baseline technical controls. Cyber Essentials Plus adds independent technical testing. Neither proves that every clinical system or recovery process is secure. ISO/IEC 27001 certification concerns an information security management system. Its scope needs to include the contracted service activities. These credentials support supplier assessment; they don’t replace contractual controls, technical evidence or NHS information governance requirements. Set response commitments around clinical risk A service-level agreement (SLA) should define incident priorities, acknowledgement, technical engagement, restoration targets, updates and escalation. Response time alone doesn’t show how quickly clinicians regain access. BCN’s G-Cloud 14 healthcare listing provides a concrete comparison benchmark. Its standard hours are 08:00 to 18:00 Monday to Friday, with extended hours of 07:00 to 19:00. The listed response targets distinguish in-hours support from restricted overnight cover. Priority Standard or extended hours Out-of-hours response P1 Within 30 minutes Within 60 minutes P2 Within 2 hours Not included in the stated P1 cover P3 or P4 Within 4 hours Not included in the stated P1 cover Its out-of-hours provision offers 24/7 support for P1 incidents only, except on Christmas Day. These supplier-specific terms aren’t an NHS-wide standard. A 30-minute response target can be met while a clinical system remains unavailable. Restoration targets and escalation responsibilities need separate wording. Define priorities through clinical impact, including unavailable prescribing, inaccessible records and site-wide connectivity failures. Specify whether the response clock pauses during supplier escalation. Major incidents also need named decision-makers and containment authority. Our cyber incident response services address security incidents that require investigation and recovery beyond routine troubleshooting. Plan cloud access and tested recovery Cloud platforms can improve record availability, but availability depends on connectivity, identity services and application design. Backup planning must address failures in those dependencies as
Choosing IT support for law firms: questions to ask
Choose IT support for law firms by comparing documented responsibilities, legal software experience, security evidence and recovery commitments. A fast help desk is useful, but its response time does not establish whether the provider can restore a document system before a filing deadline. The distinction is accountability: someone must own the incident even when several suppliers are involved. Start with the service scope, then examine the evidence behind each commitment. Key Takeaways Compare written service scopes, exclusions and supplier responsibilities across support, security, cloud services, backup, Microsoft 365 and legal software. Check references and experience with the firm’s actual practice and document-management applications, including how the provider coordinates with software vendors. Request evidence of security controls, access reviews, patching, incident responsibilities and successful recovery tests. Outsourcing administration doesn’t transfer the firm’s responsibilities. Define SLA stages, uptime measurements, recovery objectives and urgent-incident ownership. Confirm pricing, handover and exit responsibilities before committing. What should IT support for law firms include? A complete service should cover routine operations, user support, security and recovery. Buying these separately can work, but responsibilities must remain clear wherever suppliers share access or depend on each other. Use these categories to compare proposals. Service category What the scope should establish Managed IT services Monitoring, maintenance, patching, asset records and reporting. Help desk and technical support Supported users, devices, hours, locations and escalation routes. Cybersecurity Endpoint protection, email security, identity controls, monitoring and training. Cloud services and hosting Platform management, secure remote access and supplier responsibilities. Backup and disaster recovery Protected systems, retention, restoration testing and recovery objectives. Microsoft 365 management Licensing, tenant configuration, access, email and collaboration services. Legal software support Application knowledge, integrations and coordination with software vendors. An omitted category remains an operational responsibility, even when it falls outside the monthly fee. Our IT support and technology services cover several of these areas; the contract should define which apply to the firm. What evidence demonstrates experience in the legal sector? How many comparable practices does the provider support? Request references from practices with similar applications, working arrangements and operational dependencies. Experience supporting a conveyancing practice may not translate directly to a litigation team using different document and case-management systems. Uptime Legal suggests that fewer than 20 real law firm clients usually indicates surface-level legal experience. Treat that as its screening benchmark, not an accreditation standard. Client numbers alone don’t establish technical competence, service quality or familiarity with the firm’s software. Does that experience include the actual applications? Ask whether the provider’s engineers offer relevant legal software support and hold relevant certifications, where available. Check for experience with Clio, PCLaw, Time Matters or the firm’s chosen practice management software. Document management also matters. NetDocuments and iManage permissions, Microsoft 365 integrations and remote access dependencies can create problems beyond the application itself. Request an explanation of a typical escalation process, including the boundary between the IT provider and software vendor. A provider can understand legal workflows without being authorised to modify every application configuration. How will client information be protected? Which controls are included and maintained? The cyber security baseline should include endpoint protection, email filtering, multi-factor authentication (MFA), identity and access management, encryption, threat monitoring and security awareness training to protect sensitive client data. Identify who reviews alerts and who can isolate devices or disable compromised accounts. Reliable Technology recommends weekly security-log reviews, monthly vulnerability scans, quarterly recovery tests and patching within days of updates. These are operational recommendations, not regulatory deadlines. High-risk vulnerabilities may require faster action, while automated monitoring shouldn’t depend on a weekly review. The ABA’s 2023 Cybersecurity TechReport reported that 29% of respondents’ firms had experienced a security breach. This is historical US survey evidence, not a current UK breach rate. What evidence supports cyber security, confidentiality and compliance? The SRA’s cybersecurity advice calls for a tailored security policy. Its remit covers England and Wales; firms elsewhere should apply their own regulator’s requirements. The ICO’s data security guidance explains the UK GDPR requirement for appropriate technical and organisational measures. Outsourcing administration doesn’t transfer the firm’s responsibilities. Require access-review records, patch reports, recovery-test results, processor terms and documented incident responsibilities. These provide evidence for governance, compliance and cyber insurance questionnaires; a product list doesn’t. For sharing sensitive client data, specify encrypted portals, expiring secure links, MFA and automatic upload or download notifications. Notifications provide visibility, but they don’t prevent an authorised recipient from mishandling downloaded material. If you suspect a data breach, isolate affected accounts or devices and follow the agreed incident plan. What do response and recovery commitments mean? What does the service level agreement promise? A service level agreement (SLA) should distinguish acknowledgement, technical engagement, workaround and resolution. An automated ticket receipt should not count as an engineer starting work. Synergy Technical recommends initial responses measured in minutes for critical incidents and a few hours for minor issues, with tiered resolution commitments. These are examples for negotiation, not universal standards. Its example of 99.9% uptime also needs a defined measurement period, covered systems, exclusions and planned-maintenance notification. Availability for a hosting platform does not establish availability for the entire legal workflow. What can actually be restored? Document backup frequency, retention and recovery time objectives (RTOs), meaning the intended time to restore service. Define recovery point objectives (RPOs) too: how much recent data the firm could lose. A synchronised copy can reproduce a deletion, ransomware-encrypted file or configuration error. Synchronisation alone does not establish recoverability. Require independent recovery arrangements and evidence of successful restoration, including permissions and application dependencies. A restored file is not sufficient if staff still cannot open the matter. Our business continuity and recovery support can help connect technical restoration with essential operations. Recovery priorities should reflect filing, hearing and billing dependencies, rather than treating every system equally. Who owns an urgent legal software incident? The IT provider should retain ownership of coordination when an incident crosses application, Microsoft 365, permissions, hosting, device or vendor boundaries. Uptime Legal identifies these overlapping dependencies as common in legal software support. For
How shared Microsoft 365 mailboxes become access risks over time
Shared mailbox security risks build up slowly. A shared mailbox can be safe on the day you create it. Over time, permissions pile up, people change roles, forwarding rules appear, nobody remembers why the mailbox exists, and the list of who can read it grows longer than anyone can explain. The fix is to treat each shared mailbox as something with a lifecycle, meaning a named owner, blocked sign-in on its own account, a regular access review and someone watching for changes. This matters because the addresses involved are the ones every attacker already knows. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the last 12 months, and phishing was the most common type, affecting 38% of businesses. Addresses such as info@, accounts@ and sales@ sit in public and attract plenty of it, and our overview of how many UK businesses were breached in 2026 shows how routine that has become. What are the main shared mailbox security risks? The main shared mailbox security risks are permissions that grow and never shrink, sign-in left enabled on the mailbox’s own account, Send As rights that hide who actually sent a message, forwarding rules nobody notices, and mailboxes with no owner. None is dramatic on day one. Together, over months and years, they leave more people with access than you can account for. Risk How it develops What it puts at stake Permission creep Access is added for holiday cover or a busy period and never taken away More people can read sensitive mail than ever should Movers keep old access Someone changes role but keeps what they had before Staff see client, HR or finance mail they no longer need Sign-in left enabled Every shared mailbox has a user account, and older or converted mailboxes may need checking A reset or stolen credential gives direct access Send As anonymity Delegates send as the mailbox without their own name appearing Harder to trace who sent a message Hidden rules and forwarding An attacker or a well-meaning user sets up forwarding Mail leaks quietly for weeks or months No owner A mailbox is created for a project and then forgotten Nobody reviews it, tidies it or switches it off Mailbox as an identity A shared address is used to register tools and services Whoever reads the mailbox can reset those passwords Retention and licensing gaps Mail grows past limits or needs archiving, retention or legal hold Mail stops arriving or is not kept as required How a shared mailbox drifts over time For illustration, picture a finance@ mailbox set up for three people in the accounts team. In the first month the access list is short and everyone knows why. By the end of the first year, a manager has been added for cover, a temp has come and gone, a director asked for access and kept it, and someone moved to another team. The mailbox now has nine people with access and no record of why. Nothing was done carelessly. Each step was reasonable. That is exactly how the risk grows, and it is the same pattern we describe in user access risks in recruitment firms, where fast growth leaves permissions far ahead of the process for checking them. In our experience working with UK SMEs, shared mailboxes are the part of Microsoft 365 that nobody owns. They are not quite a person and not quite a system, so they fall between the joiner process and the leaver process. A leaver checklist for Microsoft 365 usually covers the person’s own mailbox and licences, and it should cover their access to shared ones as well. Why attackers like shared mailboxes Shared mailboxes tend to hold exactly what criminals want. Finance mailboxes hold invoices, remittance details and supplier conversations. HR mailboxes hold personal data. General enquiry mailboxes receive attachments from strangers all day, so a malicious one does not look out of place. The route in is usually one of the people with access. If a delegate’s account is phished, the attacker inherits everything that person can reach, including every shared mailbox they are on. This is how business email compromise tends to unfold, with the attacker reading threads, then sending a convincing message from a trusted address asking for a payment to new bank details. So protecting a shared mailbox largely means protecting the people who can open it. That starts with strong sign-in. Standard MFA is a good baseline, though MFA can still be phished, so move towards passkeys and phishing-resistant sign-in for anyone with delegated access to sensitive mailboxes. Make sure your anti-phishing settings in Microsoft 365 cover the people who use shared mailboxes, not only the mailbox addresses themselves. Should you block sign-in on shared mailboxes? Yes. Microsoft explains that every shared mailbox has a corresponding user account that is not intended for direct sign-in, and it advises blocking sign-in for that account and keeping it blocked. Microsoft also says every new shared mailbox has sign-in blocked by default, but older or converted mailboxes should still be checked. People should reach the mailbox through their own account using delegated permissions. The reason is simple. If sign-in is enabled, an admin resetting the password or an attacker obtaining it gives direct access to the mailbox, with no useful individual identity attached and none of the controls you apply to named users. Microsoft sets this out in its guide to creating a shared mailbox. Older mailboxes are the ones to look at first, particularly any that began life as a leaver’s mailbox and were converted to shared. If a shared password was ever handed round, anyone who knew it still held the keys until sign-in was blocked and the account secured. A zombie tech audit is a good way to find mailboxes and accounts like this that nobody has looked at for years. Full Access, Send As and Send on Behalf The three permission types behave differently, and most reviews
Switching IT Support Providers: A Practical Handover Plan
Your current IT provider’s last day shouldn’t be the first day your replacement team discovers how the business works. For UK SMEs, switching IT support providers needs careful coordination, clear ownership and a tested fallback plan. You can reduce avoidable disruption by transferring knowledge and access before responsibility changes hands. However, a well-planned transition still needs room for unexpected problems. If you’re managing the change as an owner, operations director or IT manager, start with the contractual dates and account access. Prepare for switching IT support providers before giving notice Set the boundaries of the transition before announcing an end date. The incoming team needs enough time to understand your systems and prepare. Check the contract, notice period and handover duties Read the existing agreement for notice dates, renewal terms, exit arrangements and agreed handover support. Identify which services continue until the contract ends and which need separate arrangements. Support, software licensing, internet connectivity and backup services may have different end dates. Record these separately so cancelling support doesn’t accidentally interrupt another service. Assign one named person within your organisation to manage the change. They should coordinate both providers, approve the schedule and resolve questions about responsibility. Give them a deputy for absences. Also define what the replacement service will cover. Our managed IT support service guidance outlines responsibilities such as documentation and supplier coordination, which need clear ownership during the handover. Confirm business ownership of systems and admin access Administrator access and ownership are different. An engineer may manage Microsoft 365 without your business controlling the tenant’s recovery contacts or subscription arrangements. Record the organisation associated with each domain, Microsoft 365 tenant, Microsoft Azure subscription, backup platform and software licence. Identify any service held through the outgoing provider’s account or supplied under its licensing arrangement. Your business needs authorised contacts who can reach these services independently. Include domain registrar access, billing contacts, account recovery details and appropriate administrative roles. Test that your authorised business contacts can sign in using their own accounts. Then establish how the incoming team will receive delegated access without making either provider the business’s only route into an essential system. Build a complete IT handover before the new provider starts A useful handover pack explains what exists, how it connects and who looks after it. Keep it accessible to your business and transfer sensitive information securely. List devices, systems, suppliers and open support issues Build an inventory covering laptops, servers, firewalls, network equipment, business applications and cloud services. Include software licences, renewal dates, supplier contacts and service accounts. For each item, record its business owner, technical administrator and the location of its current documentation. Network diagrams should show connections between offices, remote workers and hosted systems. Add unresolved support tickets, recurring faults and planned changes. An intermittent connection problem or scheduled accounting software upgrade shouldn’t become a surprise during onboarding. Separate known problems from new transition issues. This helps the incoming team investigate correctly and prevents an existing fault from confusing acceptance checks. Date the records so engineers can distinguish current information from older configurations. Check backups and recovery plans before changing responsibility Establish what is backed up, where copies are stored and who can restore them. Include business data and the configuration information needed to rebuild essential services. Record the latest successful recovery test, rather than relying only on a successful backup notification. The NCSC’s guidance on backing up data provides practical advice for small organisations. Agree who monitors backup jobs and investigates failures throughout the transition. Responsibility must remain explicit whilst both teams have access. Before a higher-risk change, documentBefore a higher-risk change, document the rollback steps, decision-maker and recovery dependencies. Agree alternative working arrangements and post-change testing with the incoming provider.ut sharing passwords by email Use an approved business password manager or a controlled secure handover process. Never send passwords through ordinary email or place them in an unrestricted document. Where possible, give engineers individual accounts with permissions appropriate to their tasks. Record who receives access, what they can administer and when that access starts. Keep multi-factor authentication enabled throughout. Arrange authorised authentication methods for the replacement team rather than sharing one person’s authentication codes. The NCSC’s multi-factor authentication guidance addresses protection for corporate online services. Also identify credentials used by automated processes. Changing a service account password without updating its dependent applications can interrupt scheduled tasks. Stage the change to keep day-to-day work moving A staged transition gives both providers clear responsibilities whilst your staff continue working. Plan around operational needs, including payroll and month-end deadlines. Agree a staged onboarding plan with named owners Set milestones for discovery, documentation review, access setup, monitoring and support transfer. Assign a named owner and escalation contact to each milestone. A shared responsibility schedule should state who handles incidents during every stage. Avoid arrangements where both providers assume the other is investigating a failed backup or unavailable application. Where possible, schedule higher-risk changes outside busy periods. However, an evening change still needs available decision-makers and staff who can test affected services. Define rollback before work begins: what triggers it, who approves it and how the previous working configuration will be restored. For businesses with several locations, our phased IT supFor businesses with several locations, consider starting with one office or support category before expanding. Avoid combining the handover with unnecessary infrastructure changes.a short message once the timetable and support routes are agreed. Explain the change date, how to report issues and any temporary instructions. Include the new helpdesk email address or telephone number, along with an internal contact if those channels fail. Make the information available somewhere staff can reach without relying solely on email. Tell managers how to escalate urgent problems affecting customers or essential work. They should know which provider is responsible at that point in the transition. Explain any expected changes to remote support tools or sign-in prompts. Staff should know how to recognise authorised requests and report suspicious ones. Finally, remind employees not to send passwords to engineers. Support instructions
The Importance of Penetration Testing in Cybersecurity
The importance of penetration testing comes down to one thing. It shows you how a real attacker could get into your business before one does. A scanner lists weaknesses that might exist. A penetration test has a skilled person try to exploit them, link them together and show what they could actually reach. That tells you which fixes matter first and whether your defences work in practice, and it gives customers, insurers and auditors something firmer than a promise. It is not a one-off cure though, and it only reflects the day it was carried out. The UK figures make the case plainly. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the last 12 months, and that is only the incidents people noticed. Our overview of how many UK businesses were breached in 2026 shows what that looks like in practice. What is penetration testing? Penetration testing is an authorised, controlled attempt to break into your systems using the same tools and techniques as a real attacker. It matters because it proves which weaknesses are genuinely exploitable, how far an attacker could get and what to fix first, which a scan or a checklist cannot show on its own. It is sometimes called ethical hacking, and it is always done with written permission and an agreed scope. If you want the mechanics, we have a plain English guide to network penetration testing. The NCSC describes a penetration test as a way to gain assurance in your vulnerability management, and compares it to a financial audit. Your finance team tracks the numbers every day, and an outside audit checks that the processes hold up. Its guidance on penetration testing is worth reading before you commission one. That framing explains both the value and the limits. Why penetration testing is important A penetration test turns a vague worry into a ranked list of specific problems. Instead of wondering whether your firewall rules, your cloud settings or your staff would hold up, you find out, with evidence. Benefit What you get Why it matters Finds exploitable weaknesses Real attack paths, not a list of possible flaws You fix what an attacker could actually use Prioritises your fixes Findings rated by risk with advice on putting them right A limited budget goes to the right place first Tests your defences A check on whether controls and monitoring work in practice Shows the gap between policy and reality Supports compliance Independent evidence for auditors, customers and insurers Meets contract and framework expectations Reduces the chance of a breach Fewer easy routes in Less disruption, less cost, less explaining In our experience, the value is rarely the headline finding. It is the awkward discovery that something everyone assumed was locked down is not, such as an old system nobody owned or a setting that was changed during a rush. A zombie tech audit before the test often turns up the same kind of forgotten asset, and it makes the scope far more accurate. For a fuller look at the business case, see why your business needs regular penetration testing. Penetration test or vulnerability scan? A vulnerability scan is automated and lists known weaknesses. A penetration test is human-led and shows which of them can actually be exploited, how they combine and what damage follows. You need both. Scanning gives you frequent, broad coverage, and testing tells you whether that coverage is catching what matters. We compare the two in penetration testing vs vulnerability scanning. This is also where people get confused about Cyber Essentials. Cyber Essentials Plus includes independent technical verification, but it is a defined set of tests and device checks, not a full penetration test. It is a good baseline, and our piece on why your business should become Cyber Essentials accredited explains what it does cover. A separately scoped penetration test goes deeper into attack paths, chained weaknesses and misconfigurations. Types of penetration test Different tests answer different questions, so match the type to the risk you are worried about. Type What it tests When it fits External network What an attacker can reach from the internet Almost every business, especially with remote access or public services Internal network What an attacker or rogue user could do once inside After a compromised laptop or account, or with sensitive internal systems Web application Weaknesses in your own or bespoke software Customer portals, online ordering and in-house tools Cloud Configuration, permissions and access in your cloud tenancy After a migration or when storing sensitive data in the cloud Social engineering How staff respond to phishing and pretexting When people are the most likely way in The split between inside and outside trips up a lot of buyers, so internal vs external network penetration testing is a useful read before you scope anything. How often should you do penetration testing? Test at least once a year and after any significant change, such as a new network, a cloud migration, a major application release or a move to a new office. If you handle card payments, the PCI Security Standards Council sets out penetration testing requirements in PCI DSS, including internal and external testing at least every 12 months and after significant infrastructure or application changes under Requirement 11.4. Higher-risk or fast-changing environments may justify testing more often. Other pressures point the same way. Article 32 of the UK GDPR expects a process for regularly testing, assessing and evaluating the effectiveness of your technical and organisational security measures, and the UK data protection regulator, commonly still known through the Information Commissioner’s Office, enforces it. Insurers also ask harder questions each year, as we cover in cyber insurance renewals. There is more on timing in how often you should run network penetration testing, and why IT compliance matters sets out the wider obligations. What penetration testing cannot do This part is often missing from sales material. The NCSC is clear that a test validates your systems
6 Key Features of Microsoft 365 Copilot Business.
Copilot Chat An AI chat interface powered by GPT-4 and your company’s work data. Ask questions, generate content, search across emails and documents, or automate tasks—all in one place. Copilot Pages A living workspace where you can turn AI-generated ideas into organised content that your team can refine, edit, and share. AI Agents Custom or pre-built agents that automate repetitive tasks—from gathering data to pulling reports to drafting updates. SMBs can create their own agents using natural language. Personal AI Assistant in Key Apps Copilot works directly inside Word, Excel, PowerPoint, Outlook, and Teams to help refine drafts, analyse data, summarise emails, and keep meetings productive. Teams Integration for Collaboration In Teams, Copilot can summarise discussions, track action items, extract follow-ups, and integrate information from multiple channels. Strong Security and Compliance SMBs get enterprise-grade protection, including data privacy, Microsoft Graph grounding, and alignment with Microsoft 365 compliance rules. Who Is It For? Copilot Business is ideal for organisations that: Have 300 or fewer employees. Already use Microsoft 365 Business plans. Want to boost productivity without increasing headcount. Need help streamlining communication, documentation, financial tasks, or customer support. Are ready to adopt AI but require security and compliance guardrails. How Microsoft 365 Copilot Business Transforms Day-to-Day Work For Owners & Leaders Quickly analyse financials and sales trends. Create polished presentations for investors or clients. Generate business reports using existing data. For Customer‑Facing Teams Summarise customer emails and create replies. Prepare meeting notes and next steps. Create proposals and marketing materials. For Operations Automate routine workflows. Summarize cross‑department communication. Build process documentation fast. For Finance & Admin Generate budgets and expense summaries. Pull insights from Excel data. Simplify reporting and documentation. Ready to bring AI‑powered productivity into your business? Unlock smarter, faster work with Microsoft 365 Copilot Business—start your journey today. Contact us on 0800 3196032 or email us at sales@northernstar.co.uk
Why Businesses Should Embrace AI Tools Like Microsoft Copilot
In today’s fast-paced digital landscape, businesses are under constant pressure to work smarter, move faster, and make better decisions. Artificial intelligence is no longer a futuristic concept—it’s a practical advantage. Tools like Microsoft Copilot are transforming the way organisations operate by enhancing productivity, collaboration, and decision-making at every level. One of the biggest advantages of Copilot is its ability to automate repetitive tasks, giving employees valuable time back for strategic and creative work. From drafting documents to analysing data, Copilot streamlines workflows across Word, Excel, Outlook, Teams, and more, helping teams achieve more with less effort Businesses also benefit from enhanced collaboration, as Copilot helps teams stay aligned, manage shared documents, and communicate effectively—no matter where they’re working from. With intelligent, data-driven insights powered by the Microsoft Graph, Copilot supports better decision-making and helps employees work smarter, not harder. Another compelling advantage is personalised assistance. Copilot adapts to individual work styles, offering tailored recommendations that make everyday tasks faster and more intuitive. This not only boosts productivity but also improves user satisfaction and reduces stress. Finally, Copilot delivers all of this while maintaining enterprise-grade security and compliance, giving organisations the confidence to embrace AI safely. Ready to Transform Your Business? Now is the perfect time to explore how Microsoft Copilot can streamline your operations, empower your teams, and sharpen your competitive edge. Take the next step—start integrating Copilot today and unlock a smarter, more efficient way of working. Contact us now and let Northern Star guide you on your AI Journey. Call us on 0800 319 6032 or email us at sales@northernstar.co.uk
The Benefits of Outsourcing Your IT to a MSP
In today’s fast-paced digital landscape, businesses of all sizes are increasingly turning to MSPs to manage their IT needs. Outsourcing IT isn’t just a trend—it’s a strategic move that delivers tangible advantages across cost, expertise, security, and operational efficiency. Cost Savings and Predictable Expenses MSPs offer predictable, subscription-based pricing, allowing businesses to budget more effectively and avoid the surprise costs associated with maintaining an in-house IT team. By paying only for the services you need, you can allocate resources where they matter most and reduce the burden of hardware, software, and security upgrades. Access to Specialised Expertise Technology evolves rapidly, making it challenging to keep up. MSPs employ teams of experts who stay current with the latest trends, tools, and best practices. Whether it’s cybersecurity, cloud computing, or data management, you gain access to professionals who deliver high-quality support and strategic guidance—often beyond what’s feasible for most internal teams. Enhanced Security and Compliance Cyber threats are a growing concern for every business. MSPs provide robust security measures, including proactive monitoring, threat detection, and compliance management. Their expertise helps safeguard sensitive data and ensures your business meets regulatory requirements, reducing the risk of costly breaches or fines. Scalability and Flexibility Business needs fluctuate, and IT requirements must adapt. MSPs offer scalable solutions that can expand or contract in line with your organisation’s needs. Whether you’re expanding, integrating new technology, or managing seasonal demands, an MSP can quickly adjust resources to match your evolving needs—without the delays and costs of hiring or restructuring. Focus on Core Business Activities Outsourcing IT allows your team to concentrate on what they do best. Instead of being bogged down by technical issues, your staff can focus on strategic goals and core business functions, driving growth and innovation. Improved Uptime and Reliability MSPs use advanced monitoring and automation to prevent issues before they cause downtime. With 24/7 support and proactive maintenance, your business enjoys greater reliability and fewer disruptions. Ready to transform your IT operations and unlock new efficiencies? Contact us today to discover how partnering with Northern Star can help your business thrive. Let’s start the conversation and build a smarter, more secure future together! Email us at sales@northernstar.co.uk or call one of our sales team on 0800 319 6032
