For many UK SMEs, compliance, resilience and technology cost control are treated as separate management issues. One project belongs to the board, another to the IT team and a third to finance.
That separation is increasingly expensive.
A Cyber Essentials gap can expose a continuity weakness. An outdated recovery plan can undermine an ISO 27001 programme. A poorly governed Dynamics 365 Business Central implementation can create unnecessary licence and support costs. Meanwhile, legacy infrastructure may continue to carry critical workloads without appearing on a modern technology roadmap.
The better approach is joined-up consultancy.
The Fractal IT Director model looks at the whole technology environment as a connected system: governance, business applications, infrastructure, suppliers, resilience and expenditure. David Evestaff brings practitioner-led experience across Google-certified IT project management, multinational onboarding, IBM i system administration and complex business systems. The objective is not to sell another collection of tools. It is to create an IT strategy that works commercially, technically and operationally.
Compliance should change the operating model
Cyber Essentials and ISO 27001 are sometimes approached as certification exercises: complete the questionnaire, assemble some policies and prepare for an assessment.
That approach usually produces paperwork without maturity.
The National Cyber Security Centre’s Cyber Essentials guidance describes five core technical controls: firewalls, secure configuration, security update management, user access control and malware protection. These controls are practical foundations for reducing common cyber risks, but their value depends on how consistently they are implemented and maintained.
A consultancy-led programme asks more useful questions:
- Which systems are genuinely business-critical?
- Who owns each control?
- How are access changes approved and reviewed?
- What happens when a key supplier or administrator is unavailable?
- Can the organisation demonstrate that controls operate in practice?
- Does the technology estate support the business’s contractual and regulatory obligations?
ISO 27001 extends this thinking into a formal information security management system. It requires an understanding of risk, scope, assets, suppliers, responsibilities and continual improvement. It is not simply a larger version of Cyber Essentials.
For an SME, the sensible route may be to establish Cyber Essentials controls first, then build towards ISO 27001 where customer, sector or supply-chain requirements justify it. The important point is that both should influence the operating model rather than sit in a compliance folder that nobody opens after the audit.
Disaster Recovery is the practical side of business continuity
Business continuity is often discussed in broad terms: keep trading, protect customers and recover quickly.
Disaster Recovery turns that ambition into decisions.
A useful recovery strategy begins with a business impact analysis. This identifies the processes that must continue, the systems supporting them and the maximum tolerable period of disruption. For one organisation, that may mean restoring finance and payroll first. For another, it may mean maintaining warehouse operations, order processing or patient administration.
Each critical service should have an agreed:
- Recovery Time Objective (RTO): how quickly it must be restored
- Recovery Point Objective (RPO): how much data the organisation can afford to lose
- Recovery owner: who makes decisions during the incident
- Fallback process: what staff do while the primary system is unavailable
- Testing schedule: how the recovery plan will be proven and improved
This is where compliance and continuity interlock. ISO 27001 expects organisations to understand information security risks and continuity arrangements. Cyber Essentials encourages secure configuration, patching, access control and malware protection. None of those controls replace a recovery plan, but together they determine whether recovery is realistic.
An SME should consider more than backups. A credible recovery plan may need to cover:
- Identity and multi-factor authentication failure
- Loss of a primary internet connection
- Ransomware affecting endpoints or servers
- Data corruption in a finance or operational system
- A cloud service outage
- Loss of a key technology supplier
- Failure of an on-premise legacy platform
- The absence of the person who normally “knows how everything works”
Backups should be protected, separated from production systems and restored regularly. A backup that has never been tested is an assumption, not a recovery capability.
Disaster Recovery therefore belongs in the wider IT strategy. It should connect with Cloud Solutions, identity management, endpoint security, infrastructure and supplier governance.
Dynamics 365 Jump Start should begin with business design
Microsoft Dynamics 365 Business Central can bring finance, sales, purchasing, inventory, projects and operations into a connected platform. Microsoft describes it as an ERP solution for small and midsize businesses, with integration across Microsoft 365, reporting, workflows and industry extensions. Its capabilities are outlined on the official Dynamics 365 Business Central page.
However, the software is not the strategy.
A Dynamics 365 Jump Start should begin with how the organisation operates today and how it needs to operate in the future. Rushing directly into configuration can preserve inefficient processes in a newer interface. The result is often a technically successful implementation that has not delivered meaningful commercial improvement.
A consultancy-led Jump Start should establish:
-
The business case
What problem is Business Central expected to solve? Is the priority better financial control, improved stock visibility, faster reporting, reduced manual administration or stronger scalability? -
The process model
How do orders, purchasing, fulfilment, invoicing, projects and approvals flow through the organisation? Which processes should be standardised, redesigned or retired? -
The control environment
Which users require access to finance, purchasing, inventory or reporting functions? How will segregation of duties, approval controls and leaver management be handled? -
The continuity requirements
What happens if Business Central, an integration, the identity platform or the network is unavailable? Where are the dependencies and fallback procedures? -
The total cost
Which licences, extensions, integrations, support arrangements and user roles are genuinely required? Can the design scale without creating unnecessary technical debt?
This is where the implementation connects to compliance and Technology Expense Management. The right configuration can improve governance and reduce duplication. The wrong one can create a polished version of the same inefficiency.
Evestaff IT Support and Consultancy acts as the strategic layer: defining the requirements, coordinating specialist execution and ensuring the infrastructure supports the intended operating model. Where additional technical delivery is required, a trusted network of channel partners can provide scale without turning the consultancy into a software reseller.
IBM i Management belongs on the strategic map
Many businesses still rely on IBM i environments for core finance, manufacturing, distribution, logistics or retail workloads. These platforms can be highly dependable, but they are not automatically low-risk simply because they have been stable for years.
The strategic questions are more useful than the age of the platform:
- What business process depends on it?
- Who understands the operating environment?
- How are backups and recovery tested?
- What interfaces connect it to newer systems?
- Are administrator skills concentrated in one person?
- What is the cost of retaining, modernising or replacing it?
IBM i Management is therefore a specialised technical consultancy domain, not a generic support add-on. IBM i, Power Systems and related environments may require specific operational knowledge, disciplined change control and a realistic assessment of business risk.
A modernisation strategy does not always mean immediate replacement. In some cases, the most responsible option is to stabilise the platform, document dependencies, improve recovery capability and create controlled integration points. In others, it may be appropriate to plan a gradual transition to newer applications.
Either way, the decision should be based on business criticality, resilience, cost and capability rather than fashion.
Technology Expense Management should protect resilience, not weaken it
Cost rationalisation is not the same as cutting technology expenditure indiscriminately.
Technology Expense Management provides a more disciplined approach by linking every material cost to business value, risk and operational need. A useful technology cost inventory should include:
- Hardware and infrastructure
- Cloud consumption
- Software and SaaS subscriptions
- Business Central licences and extensions
- Connectivity and telephony contracts
- Backup, security and monitoring services
- Support agreements
- Supplier renewal dates
- Contractual notice periods
- Owners and business criticality
The aim is to identify waste without weakening the controls that protect the business.
For example, an organisation may discover unused software licences while simultaneously underfunding restore testing. It may have overlapping security tools but no clear incident response ownership. It may be paying for multiple connectivity services without knowing whether they provide genuine resilience or simple duplication.
This is where cost and continuity must be assessed together.
A rationalisation exercise should ask:
- Does this service support a critical business process?
- Is it a control, a dependency or an optional convenience?
- Is the supplier contract aligned with our recovery expectations?
- Are we paying for unused capacity or inactive users?
- Would removing it increase operational or compliance risk?
- Can the same outcome be delivered more simply?
Managed IT Services, Helpdesk Support, Network Solutions and Voice and Connectivity can all support the strategy, but they should remain bolt-on execution services. They are not substitutes for defining the operating model.
The consultancy sequence
For a UK SME, the practical sequence is not “buy security, then buy backup, then review costs”. It is:
- Establish business priorities and critical processes.
- Map applications, infrastructure, suppliers and dependencies.
- Assess Cyber Essentials and ISO 27001 requirements against actual operations.
- Define Disaster Recovery objectives and testable recovery procedures.
- Shape a Dynamics 365 Jump Start around process, control and commercial outcomes.
- Review IBM i dependencies and specialist management requirements.
- Apply Technology Expense Management to licences, suppliers and service contracts.
- Use Managed IT Services and other execution capabilities to maintain the design.
This is the essence of the Fractal IT Director approach: zoom out to understand the whole business, then zoom in far enough to make each technical decision accountable.
For organisations seeking broader business support beyond IT, the wider Evestaff group provides the appropriate gateway to related services. The technology strategy remains the anchor.
Compliance, continuity and cost are not three competing priorities. Properly designed, they reinforce one another. Strong governance clarifies what must be protected. Disaster Recovery proves whether protection is meaningful. Technology Expense Management ensures the organisation funds what matters.
That is consultancy-led IT: strategy first, infrastructure second, and execution only where it advances the business.
SEO tags: Disaster Recovery, Dynamics 365 Jump Start, IBM i Management, Technology Expense Management, ISO 27001 consultancy, Cyber Essentials consultancy, Business Central implementation, UK SME IT consultancy, Managed IT Services, Cloud Solutions, Network Solutions, Helpdesk Support, Voice and Connectivity
Join The Discussion