---
title: Are You Doing Enough to Protect Your Data?
description: Concern over cyber threats has hit an all-time high, with a recent survey finding that 79% of organisations now rank cyber risk as a top-five concern.
image: https://blog.grantmcgregor.co.uk/hubfs/data-protection.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Digital Transformation, Cyber Security
# Are You Doing Enough to Protect Your Data?
Grant McGregor Team
24 October 2019 • 6 min read
# Concern over cyber threats has hit an all-time high, with a recent global cyber risk perception survey finding that 79% of organisations now rank cyber risk as a top-five concern.
While concern might be high, this isn’t necessarily translating into action.
PwC’s 2018 Global State of Information Security survey found that only 51% of executives have an accurate inventory of employee and customer personal data.
Which leaves us pondering: are companies doing enough to protect their data?
### The need for improved data protection
[GDPR](https://www.grantmcgregor.co.uk/2019/one-year-on-from-gdpr-whats-changed/) has helped to raise the topic of information governance up the agenda for many organisations. It has strengthened the concept of “personal information” in law at the same time as giving the regulator real teeth when it comes to enforcing the regulations.
The UK’s [Department for Digital, Media, Culture & Sport](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/813599/Cyber_Security_Breaches_Survey_2019_-_Main_Report.pdf) found that 30% of businesses and 36% of charities have made changes to their cyber security as a result of GDPR.
Nevertheless, as the threats continue to grow, businesses are still not doing enough – and are continuing to fall victim to cybercrime. The DDMC&S reports 32% of businesses and 22% of charities report having cyber security breaches or attacks during 2018. The figures are much higher among medium businesses (60%), large businesses (61%) and high-income charities (52%). Sadly, many businesses are also not aware that a breach has occurred in the first place.
In the first six months of this year, the [MidYear QuickView Data Breach Report 2019 reports](https://www.forbes.com/sites/daveywinder/2019/08/20/data-breaches-expose-41-billion-records-in-first-six-months-of-2019/#429229e2bd54), there have been more than 3,800 publicly disclosed breaches exposing an incredible 4.1 billion of compromised records.
### The need to view cyber security as an essential part of all business initiatives
Unfortunately, too often, cyber security is viewed as an add-on to business as normal rather than an integral part of day-to-day operations. Even with new programmes and initiatives, cyber security is rarely “baked in”. However, it is something that now needs to be considered alongside Health and Safety and HR policies etc.
The [2019 Marsh-Microsoft Global Cyber Risk Perception survey](https://www.microsoft.com/security/blog/2019/09/18/marsh-microsoft-2019-global-cyber-risk-perception-survey-results/) found 77% of its respondents are adopting or have adopted cloud computing, robotics, or artificial intelligence – yet only 36% said they are evaluating cyber risk as part of those transformation projects.
Perhaps this surprising lack of action is explained by some other findings of the same survey.
It found there is declining confidence in people’s own ability to understand and assess cyber risks, preventing cyber threats and responding to and recovering from cyber attacks.
It’s not the fault of the organisation - it’s an ever-changing landscape that requires specialist knowledge. But there is a responsibility to ensure appropriate measures are in place.
### What do organisations need to do to protect data better?
The National Cyber Security Centre (NCSC) has issued guidance to help organisations take control of the cyber security agenda.
In 2018, [it issued a toolkit of five questions](https://www.ncsc.gov.uk/news/ncsc-releases-core-questions-help-britains-biggest-boards-understand-their-cyber-risk) that senior management can ask to ensure that cyber security is being tackled correctly within the organisation. It pointed out that cyber security is now a mainstream business risk and can no longer be deemed to be the sole responsibility of the IT team.
• How do we defend our organisation against [phishing attacks](https://www.grantmcgregor.co.uk/2019/the-10-phishing-red-flags-your-people-need-to-know-about-right-now/)?
• What do we do to control the use of our privileged IT accounts?
• How do we ensure that our software and devices are up to date?
• How do we ensure our partners and suppliers protect the information we share with them?
• What authentication methods are used to control access to systems and data?
Ciaran Martin, NCSC Chief Executive said, “There is no such thing as a foolish question in cyber security. The foolish act s walking away without understanding the answer, because that means you don’t understand how you’re handling this core business risk.”
Practical steps to take now to protect your data
The answers to the five NCSC-issued questions will help you to see where the gaps are in your current information governance and cyber security policies and practices.
It is likely that some – or all – of the following activities will need to be part of the response in order to help you to better protect your data.
• Implement some practical anti-phishing awareness training with your staff, such as our [human firewall training programme](https://www.grantmcgregor.co.uk/it-software-and-solutions/gm-cyber-aware/).
• Don’t just leave cyber security to your cloud provider or IT Support company – actively review their policies and procedures before signing and on renewal. Don’t just take their word for it; demand evidence – and make sure the boundaries of where responsibility lies are both clearly and contractually defined and clearly understood by all parties.
• Undertake the[Government’s Cyber Essential scheme](https://www.grantmcgregor.co.uk/2019/event-cyber-essentials-why-its-good-for-business/); don’t allow your organisation to become the low-hanging fruit picked off by hackers. Plus, you’ll increasingly need the certificate for tenders or in order to work with larger organisations.
• Review the [NCSC’s 10 steps to cyber security](https://www.ncsc.gov.uk/collection/10-steps-to-cyber-security), which include beefing up network security, developing policies for remote and home workers and investing in malware prevention. They are a useful companion to the Cyber Essentials outlined in the government scheme.
• Develop a plan, in conjunction with your MSP if necessary, to[audit and manage all updates](https://www.grantmcgregor.co.uk/2019/why-are-software-updates-or-patches-so-important/). It’s a relatively simple way to ensure you don’t leave your organisation vulnerable to attack.
• Have a plan for what to do in a worst-case scenario. Don’t wait until the worst happens before you start thinking about how to respond. If you have procedures in place that just need to be activated, you’ll be able to limit the damage much more effectively, as well as being better able to fulfil your legal responsibilities under GDPR.
• Consider whether you need to invest in cyber insurance. The Marsh survey found that 53% of organisations still don’t have any kind of cyber insurance in place.
Do you need help with any of these steps? The Grant McGregor are always on hand to help or advise – please get in touch if you need support.
Grant McGregor Team
24 October 2019 • 6 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2020-10-22T15:33:42.586Z",
"datePublished" : "2019-10-24T11:22:42.000Z",
"headline" : "Are You Doing Enough to Protect Your Data?",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/data-protection.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/2019/are-you-doing-enough-to-protect-your-data",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```