UK GDPR requires suitable security for personal data. It does not require EDR or set one patching deadline.
Your choices should match your risks, systems and IT support. Your cyber insurer may set more specific cover conditions.
Cyber insurers often expect SMEs to show that each business device is patched, protected and recoverable. Policy requirements are rarely shown in one place.
Keep a control matrix for each endpoint. Include patch deadlines, active protection and tested backups.
The 3-2-1-1-0 backup rule is a useful ransomware baseline. Compare it with your policy wording and IT provider's setup.
Your insurer-ready baseline before you tick ‘yes’
Every in-scope business device should be known and assigned to an owner. It should be patched, protected and recoverable if it holds business data.
A useful insurer-ready record: device name, owner, usual user, operating system, patch status, encryption, MFA status, endpoint protection status, backup status, and last successful restore-test date. A device that has not checked in should appear as an exception. Do not list it as protected.
Can cloud sync replace a backup?
No. A synced OneDrive, SharePoint or Google Drive folder helps with file access. It is not always a ransomware-resilient backup.
Which controls must every device have?
Each managed business laptop and server needs supported software and security updates. It also needs active endpoint protection and central status reporting.
Disk encryption and multi-factor authentication, or MFA, should apply to devices accessing business accounts or holding personal data.
Evidence worth retaining
Keep monthly or quarterly exports showing device coverage and patch compliance. Keep records of active EDR or anti-malware status, encryption status and backup job results.
Keep restore-test records too. Record who tested it, what they restored and whether the data opened correctly.
A central view only works if you compare records across systems. Separate tool exports alone can give a false sense of safety.
Each month, compare the asset list and identity directory with patching, EDR, anti-malware, encryption and backup consoles. Investigate every mismatch.
Examples include a Microsoft Entra ID device missing from EDR or a laptop with no encryption key in the management portal.
A server may show successful patches but lack ransomware-resilient backups. An endpoint missing for 30 days also needs checking.
The most frequent mistake is trusting a green dashboard without checking its device list. A green score cannot protect devices that never report.
Record whether each mismatch is retired, approved BYOD, offline or unmanaged. Unmanaged devices need action.
This check gives auditable patch and coverage figures. It avoids overly hopeful dashboard totals.
Law, cyber essentials and policy wording differ
In England, UK GDPR requires security that suits the risk. Cyber insurance wording may set stricter conditions.
Does UK GDPR require EDR?
No. UK GDPR requires suitable technical and organisational measures. It does not require one software brand or security tool.
Which policy clauses need checking?
Check the full policy wording, endorsements, proposal form, declarations, conditions and exclusions. A short cover summary may miss key conditions.
Those conditions may cover MFA, critical patches, supported operating systems or offline backups. Check them before you answer insurer questions.
England-specific obligations can vary
Most SMEs in England do not fall directly under the Network and Information Systems Regulations 2018. Some digital service providers and essential-service operators have extra duties.
Financial Conduct Authority-regulated firms may face further operational resilience expectations. Your sector rules can sit beside your insurance conditions.
Good practice and policy conditions are not the same thing. The next section shows how to set sensible internal targets.
Set controls by device risk, not one deadline
Use faster patching and closer monitoring for higher-risk devices. These include internet-facing servers, remote laptops and systems holding customer data.
| Asset or user type | Protection baseline | Patch target | Backup evidence |
|---|
| Remote work laptop | Managed anti-malware or EDR, MFA, encryption | Critical 14 days, high 30 days | Business files recoverable from separate copies |
| Server or cloud virtual machine | EDR, restricted admin rights, MFA | Critical 14 days or urgent review | Immutable copy and recorded restore test |
| BYOD phone or laptop | MFA, screen lock, managed access rules | Access removed if unsupported | Do not store sole business copy locally |
| Offline or shared device | Limited access, documented owner | Review at each connection | Only if it holds unique business data |
How should patch exceptions work?
A patch exception is only acceptable if patching would disrupt an essential system. It may also apply where it breaks supplier-supported software.
It should never mean “we will deal with it later”. Give every exception an owner and end date.
What does 3-2-1-1-0 mean?
The 3-2-1-1-0 rule means three copies of important data, stored on two media types.
Keep one copy off-site. Keep one copy offline or immutable.
Zero means no unverified backup errors. Test backups to confirm this.
This is a resilience model, not an insurance policy term. It only becomes a policy requirement if your wording says so.
💡
You might be interested
An encrypted external drive can add an isolated copy for a small business. Store it safely and include it in tested backups.
It should support your main backup system. It should not replace that system.
- Provides a separate copy that is not always connected to the office network
- Helps protect confidential files if the drive is lost or stolen
- Allows a practical restore test away from the main cloud account
View options on Amazon →
How should you govern the process?
Track four simple measures: protected in-scope endpoints, endpoints meeting patch targets, successful restore tests and unmanaged endpoints.
A standard endpoint checklist is not enough for medical devices, industrial control systems or unpatchable legacy systems. These need supplier-led controls and a tailored risk assessment. Backing up a device with no unique business data may be disproportionate. Document that decision and confirm the same data can be recovered elsewhere.
A device control matrix should separate mandatory, recommended and conditional controls. Do not treat every endpoint in the same way.
Supported operating systems, managed anti-malware or EDR, encryption and MFA are normally mandatory for administrator laptops. They also suit remote laptops and servers holding personal or financial data.
Regular backups may be mandatory where an endpoint holds unique local data. A shared kiosk may only need a documented rebuild method.
Recommended controls can include application allow-listing, removable-media controls and stronger web filtering. Conditional controls depend on privileged access, internet exposure, regulated data or policy wording.
This works well in theory, but exceptions often remain open for too long. A dated exception is safer than an informal promise.
Patch management needs published targets for each severity. It also needs a time-limited route for exceptions.
Assess actively exploited critical patches straight away. Deploy them within 14 days where testing allows.
Fix high findings within 30 days. Fix medium findings within 60 or 90 days, based on exposure and asset importance.
If a patch cannot be installed, the system owner, IT lead and risk owner should approve the exception. Record the flaw, business reason, controls, review date and expiry date.
Compensating controls can remove internet access or restrict administrator rights. They can also separate networks or increase EDR monitoring.
Review exceptions often and close them when a supported fix arrives. This turns a policy into a working control.
Common questions
Do cyber insurers require EDR for every device?
Cyber insurers do not always require EDR for every device. Many require effective endpoint protection managed from one place.
Check policy wording and proposal questions. Remote laptops and servers may face stricter conditions than low-risk shared devices.
Is OneDrive a proper business backup?
OneDrive alone is not a full ransomware-resilient backup. Deletion and encryption can sync across files.
Keep separate copies with retention and restricted deletion rights. Test restores every three to six months for critical data.
How quickly should an SME install critical patches?
A sensible internal target is 14 days for critical flaws, where feasible. Review actively exploited flaws urgently.
High-risk issues can often be fixed within 30 days. Insurer wording may demand a different deadline.
Does antivirus mean all our laptops are protected?
No, antivirus only counts if the agent is active, current and reporting centrally. Check for devices that have not checked in.
Also check expired licences and disabled protection. A missing agent leaves a laptop outside your control.
What proof will an insurer ask for after a cyber incident?
An insurer may ask for declarations, device lists, patch reports, MFA settings and endpoint reports. It may also ask for backup restore evidence.
Keep dated exports and documented exceptions. A claim review may check whether stated controls worked in practice.
Do we need to back up every business device?
No, a device without unique business data may not need its own backup. Its data must be recoverable elsewhere.
Document that decision. Make sure the device can be rebuilt with its needed settings and applications.
The essentials:- Use one device inventory to spot missing patches, protection, encryption and backup coverage.
- Treat 14 days for critical flaws and 30 days for high-risk flaws as internal targets.
- Keep isolated or immutable backup copies, then prove recovery with recorded restore tests.
- Check policy wording and declarations separately from UK GDPR, Cyber Essentials and general good practice.
Further reading
If you want to learn more about this topic, these sources may interest you:
