Cybersecurity that starts with the data, not the firewall

The usual split

Security lives in one building. Data lives in another. Access is wide, logging is noisy, and the incident plan assumes a network event, not a quiet export from a warehouse. Cyber Essentials PLUS is a useful floor: it proves the basics were independently tested. It is not a data-handling policy.

What we actually put in place

Classify the stores that matter. Shrink who can reach them. Encrypt at rest and in flight. Keep an audit trail a human can read. Rehearse the afternoon when a laptop is lost or a contractor account is left on. That is the same work as a catalogue: names, owners, grain, risk.

From Leamington Spa we design this for teams who already have G-Cloud constraints and UK GDPR on the wall. The controls should be small enough that people follow them on a Monday.