For many UK SMEs, compliance, resilience and technology investment are treated as separate projects. One team considers Cyber Essentials. Another reviews backups. Finance challenges software renewals. Operations wants a better ERP system. Meanwhile, the business continues relying on a mixture of cloud services, telecoms contracts, specialist applications and established core platforms.
That fragmentation creates risk.
A more effective approach is to treat compliance, business continuity and core systems as one strategic technology programme. The objective is not to accumulate certificates or services. It is to create evidence that the business understands its risks, can recover its essential operations and is investing in technology that supports measurable outcomes.
This is the role of the consultancy-led Fractal IT Director: putting strategy at the centre, then using specialist execution services and trusted channel partners where they add value.
Compliance should create evidence, not paperwork
Cyber Essentials and ISO 27001 are often discussed as certification exercises. For an SME, that can make them appear administrative, expensive or disconnected from daily operations.
The better view is that both frameworks can provide structure for improving how technology risk is managed.
Cyber Essentials provides a practical baseline around five core areas: firewalls, secure configuration, security update management, user access control and malware protection. It gives an organisation a defined starting point for reducing common technical exposure.
ISO/IEC 27001 goes further by establishing an Information Security Management System. It asks the organisation to understand its context, identify risks, define controls, assign ownership, measure performance and improve continuously. The ISO practical guide for SMEs is designed to make that approach proportionate and understandable for smaller organisations.
Neither should be treated as paperwork for its own sake.
A consultancy-led compliance programme should help an SME to:
- Define the systems, data, suppliers and users within scope
- Identify the risks that could affect customers, operations and revenue
- Assign accountable owners for important information assets
- Review privileged access, patching and user lifecycle controls
- Document supplier, incident and recovery responsibilities
- Build evidence through testing, reviews and corrective actions
- Decide whether formal certification is commercially or contractually justified
The important word is evidence. A policy that has never been tested is an intention. A backup that has never been restored is an assumption. A supplier assessment that has not been reviewed for years is not meaningful assurance.
Disaster Recovery: continuity must be provable
Business continuity is not established by having a backup product or a document in a shared folder. It is established when the organisation knows what must be recovered, how quickly it must be restored and whether the process works in practice.
That is why Disaster Recovery needs to be designed around business impact.
Two measures are particularly important:
- Recovery Time Objective (RTO): the maximum acceptable time taken to restore a service
- Recovery Point Objective (RPO): the maximum acceptable amount of data that may be lost, measured in time
A finance system may require a shorter RTO than an archive. A warehouse operation may have a different RPO from a marketing platform. The correct objectives depend on operational reality, not a standard supplier package.
For each critical service, an SME should document:
- The business owner and operational purpose
- The required RTO and RPO
- Dependencies such as identity, networking, integrations and suppliers
- Backup frequency, retention and separation
- Recovery order and authorisation
- Manual workarounds and communication arrangements
- The date and outcome of the last recovery test
The National Cyber Security Centre’s response and recovery guidance emphasises preparation, testing and clearly understood responsibilities. Recovery also needs to include more than data. Applications, identity systems, configurations, integrations and operational processes may all be required before the business can function normally.
Testing should happen at several levels. Routine checks can confirm that individual files or databases can be restored. Planned exercises can test applications and dependencies. A wider annual scenario can involve management, suppliers and business users.
A successful test is not one that produces no findings. It is one that reveals weaknesses while the business still has time to correct them.
Dynamics 365 Jump Start: disciplined ERP implementation support
Microsoft Dynamics 365 Business Central can provide a strong ERP foundation for growing businesses, but implementation success depends on more than selecting software.
The Dynamics 365 Jump Start route should be treated as a structured mobilisation and discovery phase. It helps an SME establish whether Business Central fits its processes, data, reporting needs and operating model before a major implementation commitment is made.
This requires functional consulting, not just technical configuration.
A practical Jump Start should examine:
- Current finance, sales, purchasing, stock and operational processes
- Which activities fit standard Business Central functionality
- Where a justified extension or integration may be required
- Data quality, ownership and migration complexity
- User roles, permissions and segregation of duties
- Reporting, workflow and integration requirements
- Licensing requirements and future user growth
- Testing, training, cutover and post-launch support
The Microsoft overview of Dynamics 365 Business Central explains its role as an ERP platform for small and midsize businesses. Microsoft’s go-live guidance also highlights the importance of testing, business sign-off, migration validation and operational readiness.
Licensing discipline matters. An implementation should not begin with the assumption that every user needs the same access or that every available feature belongs in the initial scope. The right question is how the ERP system supports the business, what must be controlled and what can be introduced later.
Data migration deserves equal attention. Multiple test migrations, reconciliation, duplicate checking and business-owner approval are essential. A technically successful import can still produce operational failure if stock, customer, supplier or financial data cannot be trusted.
IBM i Management is a specialist consultancy discipline
Some organisations depend on established platforms that remain central to finance, distribution, manufacturing, logistics or specialist operational processes.
Where businesses operate IBM Power Systems or AS/400 environments, IBM i Management should be treated as a specialised, high-value technical consultancy niche rather than a generic support task.
The strategic question is not automatically whether an established platform should be replaced. It may be whether it is properly documented, secured, monitored, integrated and protected through a tested recovery process.
Effective IBM i management can include:
- Version, PTF and patch governance
- User profiles, privileged authority and access reviews
- System health, capacity and performance monitoring
- Backup, restore and high-availability planning
- Audit journalling and security event review
- Application and interface dependency mapping
- Supplier coordination and operational runbooks
- Recovery testing aligned with business RTO and RPO
David’s background in IBM i system administration provides practitioner-led context when reviewing these environments. That experience matters because strategic recommendations must reflect how systems actually operate, not merely how they appear on an asset register.
Technology Expense Management can fund resilience
Compliance and Disaster Recovery are often delayed because the budget is assumed to be unavailable. In many cases, the first step should be to examine existing expenditure.
Technology Expense Management is a cost rationalisation discipline that reviews the full technology estate, including:
- Software and cloud licences
- Microsoft subscriptions
- Telecoms and connectivity
- Voice services
- Hardware and maintenance
- Backup and security products
- Specialist platform support
- Supplier contracts and renewal dates
The objective is not indiscriminate cost-cutting. It is to identify spend that no longer reflects actual usage, risk or business value.
A TEM review should reconcile invoices with users and entitlements, identify duplicated tools, reclaim dormant licences, challenge automatic renewals and assess whether cloud resources are correctly sized. It should also account for total cost of ownership, including migration, support, training and exit costs.
Every proposed saving should be tested against security, compliance, supportability and recovery objectives. Removing an unused subscription may be sensible. Reducing backup retention without reviewing the RPO may be reckless.
The result should be a clearer technology budget, with savings redirected towards controls and projects that matter.
Strategy first, execution second
Once the strategy is clear, execution services have an important role.
Managed IT Services, Cloud Solutions, Network Solutions, Helpdesk Support and Voice and Connectivity should operate as practical layers supporting the agreed plan.
They may provide monitoring, user support, cloud administration, secure connectivity, communications resilience, patching and supplier coordination. However, they should not become substitutes for leadership or strategic decision-making.
David’s experience in Google-certified IT project management and multinational onboarding supports this consultancy-first model. The aim is to connect board-level priorities with the technical detail required to deliver them, using specialist partners where scale or specific expertise is needed.
For a UK SME, the most valuable technology conversation is rarely “Which product should we buy?”
It is more likely to be:
- Which systems are essential to revenue?
- What evidence do customers and regulators expect?
- How quickly must we recover?
- Can our core platforms be trusted and supported?
- Are we paying for technology that no longer serves the business?
- What should happen first, and what can wait?
Answer those questions properly and compliance, continuity and core systems stop competing for attention. They become part of one coherent technology strategy.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, ISO 27001, Cyber Essentials, UK SME IT consultancy, business continuity, cost rationalisation, implementation support
Join The Discussion