Quick Answer
The most effective way to improve data security is to first know where your business data lives. Create a data inventory showing what information is stored in each system, who can access it and who is responsible for it. From there, strengthen core controls including MFA, access permissions, patching, backups, vulnerability management, monitoring and incident response testing.
October is Cyber Security Awareness Month, with the message “Don’t Make It Easy for Them”. For organisations with established security controls, this is an opportunity to assess what is working, where risks remain and what needs to improve.
The UK Government’s Cyber Security Breaches Survey found that 65% of medium-sized businesses and 69% of large businesses experienced a cyber breach or attack in the previous 12 months.
For organisations managing Microsoft 365, remote workforces and sensitive business data, maintaining effective security requires ongoing review, clear accountability and continuous improvement. However, one of the most common security blind spots appears before any technical controls are considered: organisations often do not have a complete picture of where their data actually resides.
Business data is no longer confined to Microsoft 365, on-premises servers or employee workstations. If you don’t know where your data lives, you can’t fully protect it.
So, what should businesses review to strengthen data security?
These 10 areas can help IT teams, business leaders and their security providers assess existing controls, identify gaps and prioritise improvements.
1. Know Where ALL Your Business Data Lives
Many organisations focus on Microsoft 365, but business data often sits across CRM systems, finance and HR platforms, file-sharing services, industry-specific applications, AI tools and other cloud services. Employees may also sign up for software independently, creating data stores that IT doesn’t know about.
As a result, data is often spread across far more systems than organisations realise. Securing Microsoft 365 alone does not address that wider exposure.
A practical first step is to create a data inventory showing:
Which systems hold business data
What information they contain
Who can access it
Who is responsible for each system
Cross-check this inventory against software subscriptions, procurement records and expense claims, and ask department heads which tools their teams use.
Once you know where business data lives, you can make informed decisions about security controls, access management, backups, compliance and risk.
Ask your team: Do we have a complete inventory of every system, application and cloud service that stores business data, and who is accountable for each one?
2. Strengthen Authentication and Explore Passkeys
Multi-factor authentication (MFA) remains a key security control, but not all authentication methods provide the same level of protection. Many MFA approaches can still be vulnerable to phishing, social engineering and MFA fatigue attacks.
Passkeys are a phishing-resistant alternative to passwords. They allow users to sign in using a trusted device and authenticate with a fingerprint or facial recognition. Biometrics are optional, not required.
The National Cyber Security Centre (NCSC) recommends choosing passkeys wherever they are available. Where they are not supported, organisations should continue using strong passwords and MFA.
Review the authentication methods used across your business systems, identify where passkeys are supported and develop a phased rollout plan. Start with administrator accounts and users accessing sensitive information, then expand more widely as support becomes available. Ensure account recovery procedures are in place for users who lose or replace their devices.
Ask your team: Which authentication methods are used across our critical systems, where are passkeys supported, and what is our plan for adopting phishing-resistant authentication for high-risk accounts?
3. Review Who Has Access to What
Employees should only have access to the systems and data they need to perform their roles. This principle, known as role-based access control (RBAC), helps reduce risk by granting permissions based on job responsibilities rather than giving users broad access “just in case”.
While many organisations review access to internal systems, cloud services are often overlooked. CRM platforms, HR systems, finance applications, file-sharing services and other cloud tools frequently contain sensitive business data, yet organisations may struggle to identify who manages them or who has administrator access.
Start by creating a list of the cloud services used across the business and identifying an owner for each platform. Review who has access, what level of access they have and whether those permissions are still required. Pay particular attention to administrator accounts, former employees, dormant accounts and third-party suppliers.
Permissions should be reviewed whenever someone changes role, not just when they leave the business. If access management does not have a clear owner, it becomes difficult to maintain effective control.
Ask your team: Do we know who owns each cloud service, who has administrator access, and whether permissions across our systems still reflect people’s current responsibilities?
4. Keep Software and Devices Patched
Automated patching helps reduce risk, but automation alone does not guarantee systems are up to date. Updates can fail, devices can be offline, systems can stop reporting, and some updates require a restart before they take effect.
With critical vulnerabilities addressed in regular security updates, missing a patch cycle on a server, laptop or other key device can leave known weaknesses exposed. Effective patch management is therefore about verifying outcomes, not just deploying updates.
Review patch reports for failed installations, missing updates and devices that have not reported recently. Assign responsibility for investigating exceptions and confirming they have been resolved. Reviews should cover servers, laptops, third-party applications, firmware and network equipment.
Where possible, use policies to identify, restrict or escalate devices that fall outside patch compliance requirements.
Ask your team: Can we show which devices remain unpatched, why they are unpatched, and what is being done to remediate them?
5. Make Sure your Backups Actually Work
Backups are essential for recovering from ransomware, accidental deletion and system failure, but a successful backup report does not prove the business can recover everything it needs, within the time it needs it.
Many organisations back up Microsoft 365 but overlook data held in cloud services such as accounting, payroll, CRM and HR platforms. A Microsoft 365 backup will not recover data from those systems. For each service, understand what recovery capabilities the provider offers and whether additional backup arrangements are required.
Map backup and recovery arrangements against your data inventory, including cloud services, to identify gaps. For each critical system and dataset, define:
How quickly it must be recovered (Recovery Time Objective, or RTO)
How much data the business could afford to lose (Recovery Point Objective, or RPO)
Then verify that recovery arrangements can meet those requirements, including any reliance on the cloud provider. Recovery should be tested regularly to confirm data can be restored completely and is usable in practice.
Ask your team: If our cloud accounting, payroll or CRM system became unavailable, how would we recover the data, how quickly could we resume operations, and how much recent information might we lose?
6. Train Your People to Recognise Scams
Security awareness training is most effective when it goes beyond completion rates to assess how well employees recognise and respond to threats. Phishing, fake invoices, suspicious payment requests and social engineering attempts can all bypass technical controls by exploiting human behaviour.
Organisations should reinforce training regularly, use realistic simulations to identify areas of vulnerability and tailor follow-up support where needed. Tracking trends in reporting rates, repeat mistakes and responses to simulated attacks can help security teams assess whether awareness measures are reducing risk.
Ask your team: How do we measure whether security training changes employee behaviour, and how do we address the gaps it reveals?
7. Strengthen Your Microsoft 365 Security
Microsoft 365 offers security capabilities that can help organisations manage risks such as unauthorised access, compromised accounts, unmanaged devices and data leakage. However, having access to these features does not guarantee effective protection.
Conditional Access can help enforce access policies based on factors such as user identity, device compliance and sign-in risk. Microsoft Intune supports device management and compliance, while Data Loss Prevention (DLP) helps identify and prevent the inappropriate sharing of sensitive information. Advanced threat protection capabilities can help detect and respond to malicious emails, links and attachments.
Ask your provider: Are our Microsoft 365 security features configured effectively for our key risks, and are there any gaps in our current licensing or protection?
8. Review Security Scanning and Vulnerability Management
Vulnerability scanning should feed into a structured process for prioritising findings by risk, assigning ownership and tracking remediation through to resolution.
Your IT or security provider should verify that fixes are effective and ensure unresolved vulnerabilities are risk-assessed and appropriately mitigated.
Ask your provider: How are findings prioritised, assigned and tracked, and how do you verify remediation is effective?
9. Monitor for Unusual Activity
Cyber incidents can happen at any time, including outside normal business hours. Security monitoring can help identify suspicious logins, unusual file access, malware activity and signs of account compromise before an incident escalates.
Generating alerts is only the first step. Effective monitoring requires clear processes for investigating threats, prioritising alerts and responding appropriately. Organisations should understand their provider’s coverage, escalation procedures and out-of-hours responsibilities.
Ask your provider: Who investigates and responds to security alerts outside business hours, and how quickly are high-risk alerts acted on?
10. Test Your Response Before an Incident Happens
When a cyber incident occurs, teams need clear procedures for containing the threat, making decisions and coordinating a response. Incident response plans should define roles, decision-making authority, escalation routes and communication responsibilities across technical teams, senior leadership and external providers.
Tabletop exercises and realistic scenarios help test whether these arrangements work in practice, expose gaps and identify improvements.
Ask your team: When did we last test our incident response plan, and have the resulting actions been completed?
What is the biggest takeaway for data security?
There is no single solution that makes an organisation secure.
Strong security comes from combining access controls, MFA, patching, backups, vulnerability management, monitoring, employee awareness and tested response processes. Just as importantly, organisations need confidence that each control is operating as intended.
This Cyber Security Awareness Month, choose one or two areas to review in more detail. Asking the right questions can reveal gaps that are otherwise easy to miss.
Strengthen Your Security with Nexus Open Systems
As your business, systems and risks evolve, regular reviews can help identify weaknesses and ensure your controls continue to protect what matters most.
At Nexus Open Systems, we provide practical Managed Cyber Security Services that help organisations reduce risk without unnecessary complexity.
Free IT Audit
Not sure where your biggest risks are?
Our team can review your IT environment, including cyber security, backup strategies, business continuity, device management, AI tools and governance.
You’ll receive clear, practical recommendations with no jargon or hard sell.