Guide
Cybersecurity for Startups and SMEs: Practical Guides
Most security work for a small company is the same whether a customer, an investor or a regulator asks for it. These guides cover the controls, documents and exercises that answer all three.
Start here
Cybersecurity Checklist for Startups: 20 Things to Do Before Your First Enterprise Client
The 20 security measures that matter most — ordered by impact. Start with the first 10: they give the biggest risk reduction for the effort.
12 min read
What Is a Cyber Risk Score and How Is It Calculated?
Likelihood and impact, control-based scores and outside-in ratings: how cyber risk scores are calculated, what they miss, and how to use one well.
8 min read
NIST CSF 2.0 for Small Businesses: The Six Functions in Practice
Govern, Identify, Protect, Detect, Respond and Recover explained for small teams, how profiles and tiers work, and why CSF 2.0 is a useful map for NIS2 and DORA.
8 min read
Policies and people
Information Security Policy: What to Include, Section by Section
The eleven elements EU rules list for a security policy, roles and reporting lines, the topic-specific policies underneath, and how to keep it alive.
8 min read
Security Awareness Training: What NIS2 and DORA Expect
Awareness for everyone, role-based training for technical staff, board training, suppliers, and how to show it works, under NIS2, Implementing Regulation 2024/2690 and DORA.
8 min read
Incidents and resilience
How to Write an Incident Response Plan (Free Template)
Step-by-step guide to creating an incident response plan that meets NIS2 and GDPR notification requirements. Includes a free policy generator.
10 min read
Incident Response Tabletop Exercise: 5 Scenarios for Small Teams
Ransomware, invoice fraud, a cloud outage, a misdirected email and a compromised supplier: five scenarios with injects, questions and the reporting clocks they start.
10 min read
Backup and Recovery Requirements Under NIS2 and DORA
Backup plans, storage away from the main network, access control, integrity checks, restore testing, recovery objectives and redundancy, side by side for NIS2 and DORA.
8 min read
Customers and suppliers
How to Answer an Enterprise Customer's Security Questionnaire
What enterprise security questionnaires ask, how to answer honestly without losing the deal, which evidence to attach, and what to do when they ask for a penetration test.
10 min read
Vendor Risk Assessment: A Practical Guide for Startups
How to assess and manage third-party vendor security risk as a startup. Step-by-step process, tier classification, and contractual protections.
11 min read
How to Scope a Penetration Test (and What to Ask the Tester)
Objectives, test types, targets and exclusions, rules of engagement, authorisation, what the report must contain, and the questions to ask before you sign.
9 min read
EU Data Act Cloud Switching Rules: What SaaS and Cloud Providers Must Offer
Who counts as a data processing service, the clauses every cloud and SaaS contract now needs, the switching timeline, the end of switching charges on 12 January 2027, and what customers should ask for.
10 min read
EU Data Act for Connected Products: Access by Design, User Data Rights and What Makers Must Do
Which products and services are covered, the access-by-design duty for products placed on the market after 12 September 2026, the information buyers must get, users' rights to their data, trade secrets and the small-company exemption.
10 min read
Free tools
Cyber Risk Score
15 questions, two minutes.
Cybersecurity Maturity Assessment
39 questions mapped to NIST CSF 2.0.
Security Policy Generator
Draft core security policies.
Vendor Risk Assessment
Score a supplier and set a review date.
Templates
Cybersecurity Starter Pack for Startups · $44.00
90-day roadmap, asset inventory, core procedures, IR plan, questionnaire answers.
Get the templates →Security Policy Bundle for Startups · $49.00
Information security, acceptable use, access, incident response and vendor policies.
Get the templates →Other guides: NIS2 · DORA · GDPR · Cyber Resilience Act · AI Act and AI agents
This guide is for informational purposes only and does not constitute legal advice. Last updated: October 2026.