Nine basic security tasks. Could anyone at your firm do all of them?

16 October 2026 · Carl Heaton · Security

Somebody in your business is responsible for security. It might be the IT manager, the office manager, an outside IT provider, or you. Here is a fair question to put to them: are there nine basic jobs you could do confidently if you had to?

The Government asked exactly that, and more than half of UK businesses said no to at least one. The headline will get the attention. The list of nine is the part worth keeping, because you can run it against your own firm in about ten minutes.

What the survey found

The Department for Science, Innovation and Technology published Cyber security skills in the UK labour market 2026 on 29 September. Ipsos interviewed the person responsible for security at 982 businesses, plus charities and public sector bodies, between August and October 2025.

57% of businesses were not confident carrying out at least one of nine basic tasks. That is roughly 808,000 firms, up from 49% the year before. Among large businesses the figure was 24%. This is a small-firm problem.

The nine tasks

These are the tasks, with the share of businesses that said they were not confident doing each one:

Detecting and removing malware (malicious software such as ransomware): 38%
Storing or transferring personal data securely: 31%
Restricting the software that runs on devices: 28%
Setting up a configured firewall (the filter between your network and the internet): 26%
Choosing secure settings for devices or software: 15%
Setting up automatic updates: 11%
Setting up new user accounts and logins securely: 10%
Controlling who has admin rights (the accounts that can change anything): 9%
Creating backups: 7%

Most of this list is Cyber Essentials, the Government-backed baseline certification, under different wording. Firewalls, secure settings, updates, user accounts, admin rights, and malware protection are the ground it covers. Handling personal data and taking backups sit outside it, and both still matter.

Read the number with some care

Three things are worth knowing before you repeat the 57%.

It measures confidence, not ability. Nobody was tested. The researchers say the rise may reflect "higher awareness" of where organisations stand, not a real decline. Their interviews found that the breaches at Marks and Spencer, Co-op, Harrods, and Jaguar Land Rover had put security in front of boards. A firm that has started asking hard questions will report less confidence than one that has not. That is progress, even if it looks like the opposite on a chart.

The low numbers deserve suspicion too. Only 7% said they were not confident creating backups. Creating one is the easy half. Restoring from it under pressure is the half that counts, and we covered that in what makes a backup a backup.

The biggest gap is the one you find out about last. Malware detection sits at 38%, up from 23% a year earlier. Separately, 47% of the people responsible for security in businesses were not confident dealing with a breach or attack and had not handed that job to anyone else. Those two together describe a firm that would be slow to notice a problem and unsure what to do next.

Sam Thornton of the consultancy Bridewell told The Register why small firms score this way: security there is often "just one part of someone's wider role rather than a dedicated job". That is a description of how small businesses work, not a criticism of the person doing it.

Outsourced is not the same as covered

The survey found 35% of businesses outsource some part of their security. Of those, only 29% had outsourced all nine basic areas. Most had handed over some tasks and kept others.

That split is normal and perfectly sensible. The risk is not knowing where the line falls. If your IT provider looks after the firewall and the antivirus, who decides which staff get admin rights? Who checks that updates are actually installing? A task that each side assumes the other is doing is a task nobody is doing.

What to do

Run the list. Take the nine tasks to whoever looks after your IT. For each one, write down who does it: someone in the business, your IT provider, or nobody. A name, not a department.
Ask your IT provider to confirm their half in writing. The useful question is "which of these nine are in our contract?" A good provider will answer quickly. A vague answer tells you something too.
If you are the one who looks after the computers, say where you are not confident. Being unsure about malware removal or firewall rules is the normal position, as the survey shows. It is a far better conversation to have now than during an incident.
Use Cyber Essentials as the yardstick. You do not have to certify to use the questions. IASME, which runs the scheme, publishes the self-assessment questions for free. We have a plain-English guide to what Cyber Essentials actually involves, and a view on when to do it.
Decide who you would ring. Write down who gets called if something goes wrong, and what happens in the first five minutes. That closes the widest gap in the survey without buying anything.

How Steelwise can help

Going through the nine tasks with you and whoever runs your IT, and working out which gaps matter for a business your size, is a short piece of security advisory work. Get in touch and we will tell you honestly what needs fixing and what does not.