IT for regulated businesses: compliance you can prove

Tenders, insurers and auditors tend to ask the same questions. Is multi-factor authentication switched on for everyone? Are backups tested? Who can open what? Are your IT policies written down?

We put those controls in place, keep the records that show they’re working, and help you answer each questionnaire accurately. For Cyber Essentials, start with our free readiness checklist.

Healthcare and care providers

Care homes, home care providers, GP surgeries, dental practices, pharmacies and other organisations that work with the NHS hold some of the most sensitive data there is. Patient and care records are health data, which UK GDPR treats as special category data that needs extra protection. If you have access to NHS patient data and systems, there’s a second set of rules: every organisation with that access must use the NHS Data Security and Protection Toolkit to show it handles that data securely.

From our work

We provided fully managed IT, including laptops, for a children’s residential care home providing round-the-clock care for young people with complex needs. Because the home works with the NHS, it needed Cyber Essentials and had to meet the NHS Data Security and Protection Toolkit, and we ran its IT with both in mind.

David Gilbey, Just Gilbey IT Solutions

Out-of-date systems are a compliance risk as well as a security one. Windows Server 2016, for example, reaches the end of Microsoft’s extended support in January 2027. After that, Microsoft stops releasing free security updates for it.

We keep your computers and servers supported and patched, look after Microsoft 365 and backups, and keep the records that show those controls are working, so the evidence is to hand when you complete the toolkit. An IT Assessment shows what’s out of date before it becomes a problem.

Estate and letting agents

Estate and letting agents handle identity documents, bank details and large payments. Estate agents are supervised for anti-money laundering, and so are letting agents who handle lettings at 10,000 euros a month or more.

• Registration: HMRC supervises estate agency businesses, and it’s a criminal offence to trade as one without being registered. Letting agency businesses must register when they handle lettings with a monthly rent of 10,000 euros or more.
• Records: HMRC’s guidance for estate and letting agency businesses (a document file) says the evidence from your customer due diligence checks must be kept for at least five years after the business relationship ends. That’s years of passports and bank statements on your systems, and UK GDPR expects you to keep them secure.
• Letting agents in England must also belong to a government-approved redress scheme, and those holding client money must belong to a client money protection scheme.
• Payments: deposits, rent and other payments are often arranged by email, which makes agents a target for payment diversion fraud. Our phishing guide shows how to spot the fake emails.

From our work

An estate agency came to us because Windows 10 was reaching end of life and their server was no longer supported. We upgraded all of their PCs. For the server, we started with a review and talked to the business about what they actually needed it for. It turned out to be little more than a place to keep their office files, which weren’t large and could easily move to SharePoint, as long as staff were trained on it, including how permissions work. They had only kept the server because they didn’t know any better: a previous break-fix IT company had set it up years earlier, and it hadn’t been maintained since. We moved their files to SharePoint, then decommissioned the server and disposed of it.

David Gilbey, Just Gilbey IT Solutions

An old server that nobody looks after still holds your files, and often the ID documents and records you’re required to keep. Before paying to replace one, it’s worth asking what it’s really for.

We set up Microsoft 365 so ID documents are only open to the people who need them, switch on multi-factor authentication, protect your email, train your staff to spot phishing and test your backups.