Since 26 April 2026, three Cyber Essentials questions fail you outright: MFA on every cloud service, and 14-day security updates for systems and applications.
Client data is leaving practices through a route nobody has written a policy for: a copy and paste into a free AI tool. What UK GDPR and professional confidentiality actually require, and the half-page fix.
Microsoft 365 retention is not a backup. What Microsoft actually keeps, for how long, and where 93 days of native retention collides with six years of record-keeping obligation.