Cyber security for architects — First year plan and practical steps

Cyber security for architects means prioritising immediate containment and reporting to the ICO within 72 hours if personal data is exposed, then applying baseline controls such as MFA, secure patching and reliable off-site backups while you stabilise operations. ICO reporting guidance

First week

In the first week after you recognise a cyber risk — whether a phishing incident, ransomware alert or lost device — treat three things as non-negotiable: contain, assess, and communicate. Contain means isolating affected machines (disconnect them from the network) and freezing admin accounts where compromise is suspected. Assess means a short, documented triage: what system, what data, which users, which backups exist. Use a simple incident log (date, time, action, owner).

Who does what: nominate a single responder and a fallback person so actions aren’t duplicated.
Preserve evidence: don’t reboot compromised devices unless advised by a forensics team.
Short-term fixes: change exposed credentials, force MFA resets for high-risk accounts.

Keep communication clear: notify affected staff, pause external client file-sharing if necessary, and prepare to inform clients if personal data is involved. If the incident suggests personal data loss, follow the ICO link in the opener for the legal timeframe to report.

First month

The first month is about stabilising and shoring up basic defences so the same incident can’t recur. Focus on a small, urgent set of controls you can implement across the practice in days, not months. Prioritise MFA, patching and backups.

Enable multi-factor authentication (MFA) for all email and cloud accounts; start with admin and partner accounts.
Run a simple patch sweep on servers, desktops and network kit — prioritise internet-facing devices and any software handling client files.
Verify backups are working and stored off-site (cloud or offline) and test one restore of a typical client folder.

These moves cut the most common attack paths. If you need external help, consider engaging with aurora’s cyber-security services to speed deployment and hand the more technical tasks to a provider while you retain control of decisions.

First quarter

Over months two and three build repeatable processes and a low-cost risk register. The aim is to convert one-off fixes into routine business practice.

Key actions to complete in the quarter:

Document access rules: who can access which client files, and why; remove orphaned accounts.
Run phishing-aware exercises for staff and record participation — learning beats blame.
Configure and review logging and alerts so unusual activity triggers a named responder.

Make changes incremental: adopt a standard secure configuration template for new devices, schedule monthly patch windows, and assign a single person to review backup success reports weekly. Keep the language simple and the owner list short — a long roster dilutes accountability.

First year

By month 12 you should have a documented baseline of technical controls and basic policies that a prospective client or insurer can read and rely on. The year plan focuses on embedding security into practice habits rather than adding complex technology for its own sake. Measure what you can — number of successful restores, phishing click rates, and mean time to patch are useful metrics.

Recommended milestones to complete by the end of year one:

Policy pack: basic acceptable-use, incident response, data retention and remote-working rules documented and signed off.
Staff training: annual security briefing for everyone and role-based deeper training for administrators.
Third-party review: a short external audit, or Cyber Essentials certification if you choose to pursue it, to validate your baseline.

Keep a simple improvement log and budget for ongoing maintenance—security is a predictable operating cost, not a one-off project. Regularly revisit backups and test restores; a backup that never restores is only a cost.

What to watch for next

After the first year, move from stabilisation to resilience: plan for supplier risk reviews, consider cyber insurance, and look at periodic tabletop exercises with senior staff. Track three signals: repeat phishing failures in staff, unexplained account logins, and failed backup restores. If any of those appear, escalate to a full review and external specialist.

Finally, set a concrete next step: schedule a one-hour review with the person in charge of IT within the next 30 days to check MFA rollout and backup restore logs — that single meeting prevents a lot of drift.

FAQ

Is Cyber Essentials useful for an architecture practice with 10–200 staff?

Yes — Cyber Essentials provides a baseline set of technical controls that are appropriate for small and mid-sized practices and is commonly used as the first formal validation of basic security.

Who should I contact first if client personal data may have been exposed?

Contain the incident then review the ICO’s reporting guidance; if the breach is likely to risk individuals’ rights you must consider reporting to the ICO within the statutory timeframe referenced on their site.

What are immediate actions my office can take this week to reduce risk?

Disconnect suspected devices, reset exposed credentials, force MFA resets for high-risk users, and verify that recent backups exist and are restorable; assign a single person to own the incident log.