Compliance dates can be more than diary reminders. Used well, they prompt a business to check whether its controls work in practice, whether essential systems can be restored and whether technology spending still supports its priorities.
For UK SMEs, the trigger might be a Cyber Essentials renewal, an ISO 27001 surveillance audit or a customer asking for evidence of operational resilience. The right response is not to buy tools in a rush. It is to work through a clear sequence: understand the obligation, assess the business risk, test recovery and then decide what to change.
Start with the deadline, and establish what applies
Not every compliance timetable applies to every SME. Cyber Essentials may be required by a customer, contract or procurement process; it is not a universal legal requirement for all businesses. Where certification is required, it needs to be renewed annually. UK Government guidance for suppliers describes the scheme’s 12-month certification period and renewal expectation.[^1]
ISO/IEC 27001 follows a different cycle. Certification is normally maintained through surveillance audits during the certification period, with recertification required before the certificate expires. Confirm the schedule directly with your certification body, as the audit plan and dates matter.[^2]
FCA operational resilience rules are relevant to firms within scope, not to every small business. For those firms, 31 March 2025 marked the end of the transition period for meeting the regime’s requirements, including mapping important business services, setting impact tolerances and testing resilience. The work does not end at that date: firms need to maintain their capabilities, address vulnerabilities and learn from tests and disruptions.[^3]
SMEs serving regulated customers may also face resilience questions through supplier assessments or contract terms, even if they are not directly subject to the FCA rules. Establish the source of each requirement before committing to a particular control or timetable.
Turn the compliance calendar into a practical review
A useful first step is to create one schedule that includes certification dates, surveillance audits, customer assurance requests and key contract renewals. Add an owner for each activity and allow time to gather evidence, fix gaps and retest controls.
Then ask three questions:
- What evidence will be expected? Identify the policies, records, access reviews, supplier information and test results relevant to the requirement.
- Which services must keep running? Agree what the business needs to continue, what disruption it can tolerate and who makes recovery decisions.
- What needs to change before the date? Separate immediate remediation from longer-term investment, and assign owners and review dates.
The aim is to make audit preparation part of routine management, rather than a last-minute exercise in finding documents. An independent certification body or regulator remains responsible for its own assessment; consultancy support can help a business prepare, understand gaps and coordinate improvements.
Test Disaster Recovery against business needs
A written recovery plan is not evidence that recovery will work. A practical Disaster Recovery exercise checks whether people can restore the services they need, within timeframes the business has agreed are acceptable.
Start by identifying the applications and dependencies behind important processes. These may include identity and user access, data, finance systems, cloud services, network connections, telephony, integrations and external suppliers. A backup is only useful if the business can access it, restore it and operate the resulting service.
Set recovery objectives with business owners rather than accepting default settings from a supplier. Consider how much data loss is tolerable, how long a process can be interrupted, who can authorise recovery and what manual workarounds are available. Then test a realistic scenario: for example, restoring a critical system, recovering a key data set or operating while a supplier service is unavailable.
Record the outcome, including failed assumptions, recovery times, unresolved dependencies and actions with named owners. A short, well-documented test that exposes a real gap is more valuable than a polished plan that has never been tried.
Treat system change as part of the control plan
Compliance reviews can reveal that a core business system is difficult to support, poorly integrated or dependent on knowledge held by one person. That is a reason to assess modernisation, not to assume that a new platform will automatically solve control or continuity issues.
For organisations considering Microsoft Dynamics 365 Business Central, a structured Dynamics 365 Jump Start can help frame implementation support around business processes, data, user roles, integrations and reporting. Address those topics early, alongside migration, testing, training and recovery considerations. The purpose is to make a sound technology decision and plan its execution, not simply to install software.
Businesses with established IBM platforms should include them in the same assessment. Specialist IBM i Management can help clarify support arrangements, dependencies and continuity requirements for critical workloads. These systems may remain valuable parts of an estate; the key is to understand how they fit with current processes and recovery plans.
Where the review identifies issues across Cloud Solutions, Network Solutions or Voice and Connectivity, treat them as connected parts of the service rather than isolated purchases. Helpdesk Support and Managed IT Services can then provide day-to-day execution against the agreed strategy. The consultancy question comes first: what does the business need, what risks must it manage and how will success be measured?
Use Technology Expense Management to fund priorities
A compliance deadline can expose not only control gaps but also duplicated, unused or poorly aligned technology costs. Technology Expense Management (TEM) provides a structured way to review recurring expenditure and decide whether it supports business needs.
Map the costs associated with systems and services: subscriptions, support agreements, connectivity, hardware, hosting, security tools and recovery arrangements. Check renewal dates, licence allocation, ownership, usage and overlap between services. Confirm what is contractually required before reducing or cancelling anything.
The objective is not indiscriminate cost-cutting. Removing a control that supports recovery or audit evidence may create greater risk than the saving justifies. Instead, compare the current cost with the value, service level and risk reduction delivered. Record decisions, owners and the expected outcome so that later reviews can test whether the change worked.
A practical sequence for the next review
A compliance-driven roadmap can be organised into four steps:
- Confirm the obligation: identify whether it comes from certification, regulation, a customer or a contract.
- Assess the current position: map essential services, system dependencies, owners, evidence and renewal dates.
- Test and prioritise: exercise Disaster Recovery, document gaps and rank actions by business impact and deadline.
- Deliver and review: implement changes, check the results and revisit costs through Technology Expense Management.
For firms within the FCA regime, keep operational resilience under ongoing review rather than treating it as a one-off deadline. Other SMEs can use the same discipline proportionately, guided by their contracts, customer expectations and the consequences of disruption.
David’s practitioner-led approach combines strategic IT consultancy with the infrastructure needed to deliver the plan. The Fractal IT Director role in practice. Relevant experience includes Google-certified IT project management, multi-national onboarding and IBM platform administration. Specialist channel partners can provide focused technical execution where required, while the strategy and business priorities remain central.
For the wider Evestaff group of services, visit evestaff.co.uk. For IT consultancy and support, explore Evestaff IT Support and Consultancy.
A deadline is useful when it changes what happens next. Start with the requirement, test the services that matter, plan system improvements deliberately and make sure each pound of IT spend has a clear purpose.
[^1]: UK Government: PPN 014, Cyber Essentials scheme.
[^2]: International Accreditation Forum: Mandatory Document for the Audit and Certification of a Management System.
[^3]: FCA: Operational resilience.
Join The Discussion