Build a reliable foundation
AI, marketing, finance and trade all depend on reliable systems and trustworthy data. IT must therefore be treated as an operating foundation rather than a support function.
A resilient IT plan should cover:
1. System architecture and integration;
2. Identity and access management;
3. Multi-factor authentication;
4. Secure backups and recovery testing;
5. Device, network and endpoint protection;
6. Data governance and retention;
7. Supplier and cloud risk;
8. Incident-response responsibilities; and
9. Business-continuity procedures.
The 2025/2026 Cyber Security Breaches Survey estimated that approximately 612,000 UK businesses had identified a breach or attack in the preceding year. It also found that only 47% of businesses used two-factor authentication and just 30% conducted a cyber-security risk assessment (Department for Science, Innovation and Technology and Home Office, 2026). These figures demonstrate why cyber resilience should be built into every transformation programme.
What to measure: system availability, recovery time, patching performance, security incidents, backup-test success and employee training completion.
