Key takeaways, 2026
- FTTP plus 5G failover: the 2026 minimum, a single line is no longer acceptable for any business that loses money during downtime.
- MFA everywhere: passkeys are now mainstream, SMS codes are deprecated, and password-only accounts fail Cyber Essentials in 2026.
- M365 vs Google Workspace: £18.10 or £11.50 per user per month, identical security posture if configured correctly, MDM is the key add-on.
- Cyber Essentials Plus: £1,500 a year, mandatory for public-sector supply chains, increasingly required by cyber-insurers.
8
Layers
From line to LLM, all required.
£18.10
M365 Business Premium
Per user, per month, 2026.
£1,500
Cyber Essentials Plus
Annual audit fee.
£40
ICO fee, tier 1
Annual data-protection fee.
1. Connectivity: FTTP first, with a 5G failover
With copper-based ADSL and FTTC switch-off well underway under Openreach's PSTN retirement programme, every new UK business connection in 2026 should be FTTP (fibre to the premises). Order 500 Mbps or 1 Gbps symmetric on a business-grade contract with a target fix time, not a consumer plan with best-effort support.
A single circuit is no longer acceptable for any business that loses money during downtime. The 2026 default is FTTP plus a 5G or 4G failover with automatic cutover at the router. Three Business, EE Business and Vodafone Business all sell unlimited business SIMs with priority access for under £25 a month. For mission-critical sites, swap the failover for a second wired circuit from a different carrier on a separate physical path.
The router matters. A business-grade router with VLAN separation lets you split staff Wi-Fi, guest Wi-Fi, the till network and CCTV onto isolated segments, which is the single easiest control to pass on a Cyber Essentials Plus audit. Common UK SME choices include Cisco Meraki MX series, Ubiquiti UniFi Dream Machine Pro, FortiGate 40F or 60F, and Draytek Vigor 2865.
2. Endpoint: managed laptops, MDM mandatory
Every laptop, phone and tablet that touches business data must be enrolled in mobile device management (MDM). MDM enforces disk encryption, screen-lock timeouts, security patches and remote wipe on a lost device. Without it, a stolen laptop is a reportable ICO incident.
Pick the MDM that matches your fleet: Microsoft Intune for Windows-heavy estates (included in Microsoft 365 Business Premium), Jamf Pro for Mac-only or Mac-heavy estates (£3.33 per device per month), and Google Workspace endpoint management for Chromebook and Android. Mixed estates should consolidate on one MDM rather than running two in parallel.
3. Identity: SSO and MFA on every account
Identity is now the perimeter. Every business account must sit behind a single sign-on (SSO) provider with multi-factor authentication enforced. The three mainstream choices for UK SMEs are Microsoft Entra ID (formerly Azure AD, included with M365), Google Workspace identity, and Okta Workforce Identity for businesses with a complex SaaS estate.
In 2026, passkeys are mainstream. They are phishing-resistant, sync across a user's devices via Apple, Google or Microsoft accounts, and remove the password from the equation entirely. Roll them out as the default second factor and keep an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password) as a fallback. SMS codes should be turned off everywhere they can be turned off, they were declared insecure by NIST as far back as 2017 and the consumer phishing kits have caught up.
Must-have, 2026
- ▸FTTP primary line with a 5G or 4G failover;
- ▸MFA on every account, passkeys preferred over SMS;
- ▸MDM enrolment for every device that touches business data;
- ▸DMARC, SPF and DKIM enforced on the email domain;
- ▸Cloud-to-cloud backup for the SaaS estate;
- ▸ICO data-protection fee paid, with a basic privacy notice published.
Should-have, 2026
- ▸Cyber Essentials Plus certification;
- ▸EDR or XDR on every endpoint (CrowdStrike, SentinelOne, Defender);
- ▸DNS-layer filtering (Cisco Umbrella, Cloudflare for Teams);
- ▸Internal AI usage policy and an enterprise LLM tool;
- ▸Documented incident response plan with named owners;
- ▸Cyber insurance with a minimum £250,000 limit.
4. Email: M365 or Google Workspace, with DMARC enforced
For a UK SME in 2026, the choice is between Microsoft 365 Business Premium at £18.10 per user per month and Google Workspace Business Standard at £11.50 per user per month (or Business Plus at £17.30 for richer security and Vault retention). Both bundle email, calendar, video calls, shared drives, MDM and basic DLP. Pick the one that matches your team's existing habits.
On day one, enforce DMARC at p=reject alongside SPF and DKIM on your sending domain. UK business email impersonation losses ran to over £200 million in 2024 and 2025 combined, and most successful attacks targeted domains with no DMARC policy. Both M365 and Google Workspace ship with one-click admin tooling for this.
Microsoft 365 vs Google Workspace, side by side
| Feature | M365 Business Premium | Google Workspace Business Plus |
|---|---|---|
| Price per user | £18.10/month | £17.30/month |
| Storage per user | 1 TB OneDrive | 5 TB pooled Drive |
| Desktop apps | Word, Excel, PowerPoint, Outlook | Browser-first, no native installs |
| MDM | Intune included | Endpoint management included |
| Built-in AI | Copilot add-on (£24.70/user/month) | Gemini add-on (£17.40/user/month) |
| Best fit | Windows estates, Office-heavy teams | Chromebook and Mac estates, collaborative docs |
Prices verified May 2026 against Microsoft UK and Google Workspace UK, excluding VAT.
5. Backup: the 3-2-1 rule still applies to SaaS
Microsoft and Google replicate your data, they do not back it up. If a user deletes a SharePoint folder more than 30 days ago, or a ransomware payload encrypts a OneDrive, only an independent cloud-to-cloud backup restores it. The mainstream SME options in the UK are Datto SaaS Protection, Veeam Backup for Microsoft 365, Acronis Cyber Protect and Barracuda Cloud-to-Cloud Backup, all priced between £2.50 and £4.50 per user per month.
Apply the 3-2-1 rule: three copies of every file, on two different media, with one copy off-site. For most SMEs this means the live data in M365 or Google Workspace, an automated daily backup with a third-party tool, and an offline or air-gapped copy of the most sensitive datasets (HR records, financials, customer contracts).
6. Security: Cyber Essentials Plus, EDR, DNS filtering
Cyber Essentials is the UK government's baseline security certification, run by the NCSC's delivery partner IASME. The self-assessed Cyber Essentials tier costs around £320, and the audited Cyber Essentials Plus tier costs roughly £1,500 a year depending on company size. Plus is mandatory if you handle MOD, NHS or central-government contracts, and most cyber-insurance policies now require at least the self-assessed tier as a precondition.
Beyond Cyber Essentials, two controls have become non-negotiable in 2026: endpoint detection and response (EDR or XDR) on every laptop and server, and DNS-layer filtering to block known malicious domains before the request reaches the browser. Microsoft Defender for Business is bundled with M365 Business Premium and is good enough for most SMEs. Higher-risk businesses (legal, finance, healthcare) typically move up to CrowdStrike Falcon Go or SentinelOne Singularity.
7. Compliance: UK GDPR, ICO and your sector
Every business processing personal data must register with the Information Commissioner's Office (ICO) and pay the annual data-protection fee: £40 for tier 1 (micro), £60 for tier 2 (small) and £2,900 for tier 3 (large). Failure to register is itself a fineable offence, separate from any breach.
Sector overlays apply on top. Financial services firms are regulated by the FCA and must comply with its operational resilience rules. Healthcare providers handling NHS patient data must complete the NHS Data Security and Protection Toolkit (DSPT) annually. Telecoms providers are subject to Ofcom rules on automatic compensation, mid-contract pricing and network resilience. Map your obligations on day one, do not wait for the first audit.
8. AI policy: enterprise LLMs and a one-page rulebook
By 2026 nearly every UK SME has staff using generative AI daily, whether sanctioned or not. The pragmatic move is to give the team a tool that respects data boundaries and write a short, clear policy that everyone signs.
The mainstream enterprise options are Microsoft 365 Copilot for Business (£24.70 per user per month, integrates with M365 data with tenant-level boundaries), ChatGPT Enterprise (custom pricing, no training on your prompts) and Google Gemini for Workspace (£17.40 per user per month, integrates with Workspace data). Pair the tool with a data loss prevention (DLP) policy in your admin console that blocks uploads of customer records, financial data and source code to consumer AI sites.
The internal AI policy itself should fit on one page and cover: what tools are approved, what data must never be pasted into any LLM, how to flag an AI-generated deliverable to a client, and what to do if a sensitive prompt is accidentally submitted. Review it twice a year, the underlying tools evolve faster than annual policy cycles.
Frequently asked questions
Universal multi-factor authentication on every account, ideally using passkeys or an authenticator app rather than SMS. The ICO and Cyber Essentials both treat the absence of MFA as a baseline failure in 2026, and roughly 80% of credential-related SME breaches reported to the ICO in 2025 involved an account that was either password-only or used SMS-only MFA.
Budget around £500 to £900 per employee per year for a baseline stack in 2026. That covers Microsoft 365 Business Premium or Google Workspace Business Plus, an EDR licence, cloud backup for the SaaS estate, a managed business router, Cyber Essentials Plus certification, and a small contingency for incident response. Heavier needs, such as CAD workstations or compliance-grade backups, push the figure to £1,200 or more.
Both are fine. Microsoft 365 Business Premium (£18.10/user/month) wins if you already use Windows, Office desktop apps and need Intune for endpoint management. Google Workspace Business Standard (£11.50/user/month) or Plus (£17.30/user/month) wins if your team is on Chromebooks and Macs, you want a cleaner shared-doc model, and you do not need Office desktop apps. Mixed stacks work, single stack is simpler.
If you sell to UK central government, the NHS, MOD or anyone in their supply chain, yes, it is mandatory. For everyone else it is voluntary, but the £1,500 cost is far cheaper than the average ICO fine and many cyber-insurance policies now require at least basic Cyber Essentials. Pass the audit once, then renew annually.
Two layers. First, give them an enterprise AI tool with proper data boundaries: Microsoft 365 Copilot, ChatGPT Enterprise, or Google Gemini for Workspace. Second, apply data loss prevention (DLP) policies in your Microsoft Purview or Google Workspace admin console to block uploads of sensitive content to consumer AI sites. Cover both in a one-page internal AI policy that staff sign on join.
The 3-2-1 rule means three copies of the data, on two different media, with one copy off-site. It absolutely still applies to M365 and Google Workspace: Microsoft and Google do not back up your data for you, they replicate it. If a user deletes a SharePoint file 31 days ago, or ransomware encrypts a OneDrive, only an independent backup (Datto, Veeam, Acronis, Barracuda) restores it.