Small business cyber security questions.

39Security designs, deploys and manages cyber security controls for established small businesses. Core services include Microsoft 365 backup, email filtering, MDR and EDR, managed firewalls, awareness training, vulnerability management, incident-response planning and standards readiness support.

The packages are primarily designed for organisations with roughly 10–50 users and turnover around £750,000–£5 million. Scope can be adjusted for smaller teams, multi-site businesses and organisations with higher regulatory or client requirements.

Choose the protection outcome closest to your needs, build an initial business security plan and provide the organisation details required for onboarding. 39Security confirms the technical scope, responsibilities and any hardware before activation, with secure hosted payment available for agreed services.

Microsoft 365 provides resilient cloud services and retention features, but many businesses also require an independent backup with separate retention, granular recovery and managed restore testing. The correct design depends on legal, operational and recovery requirements.

EDR is endpoint detection and response technology installed on managed devices. MDR adds people and process: security analysts investigate alerts, assess risk, contain threats where authorised and escalate incidents through an agreed response route.

No. 39Security provides readiness, implementation and evidence support for ISO/IEC 20000-1, ISO/IEC 27001 and ISO/IEC 42001. An independent accredited certification body performs the certification audit and issues any certificate.

The main service area is Essex, Kent, Hertfordshire and London, with remote managed services available more widely across the United Kingdom. On-site requirements are agreed as part of the service scope.

Yes. 39Security can add specialist security monitoring, backup, firewall, vulnerability and incident-response capability while the existing provider continues normal IT support. Responsibilities and escalation routes are documented during onboarding.

The assessment reviews Microsoft 365, identity, endpoints, email, backups, firewalls, staff awareness, vulnerability management and incident response. It provides an immediate risk band and prioritised next actions.

The response depends on the retained service and agreed authority. Typical actions include triage, evidence preservation, account or endpoint containment, recovery coordination, stakeholder communication and a post-incident review. Emergency response is not guaranteed unless a suitable agreement is already in place.