The buck stops with us as senior leaders

Disconnect to Protect: Mark Fermor, Firevault

These words from CEO of The Co-op Group, Shirine Khoury-Haq, in the National Cyber Security Centre’s (NCSC) Annual Review 2025* should echo in every boardroom. When a cyber incident hits, responsibility for customers, colleagues and data sits with leadership. Cyber is not an IT task. It is a test of governance, control, and trust.

The NCSC is clear: resilience must be led from the top. Boards should own digital risk, align it with strategy, and embed it across the organisation. Yes, penalties scale with turnover – under UK GDPR, fines can reach £17.5 million or four percent of global revenue, but the sharper edge is personal. The Information Commissioner can fine directors up to £500,000 for oversight failures.

Therefore, insurers now ask for evidence of prevention before renewal. The impact is economy-wide and the message is consistent; the risk is pervasive and significant, with IBM findings that fewer than half of organisations ever fully recover after a major breach.

Only recently, we have seen the detrimental impact of cyber-attacks on PLCs such as Jaguar Land Rover and M&S, but don’t be fooled. This is not just about the big boys. The Federation of Small Businesses reports that one incident costs a typical small firm about £65,000. For businesses in the £1 to £5 million bracket, average incident costs exceed £120,000 before reputational loss and delays are counted.

Yet, too many still suffer from ostrich mode, hoping it will not happen while their most valuable information sits online and exposed.

Are your crown jewels exposed?

Every board should know where its crown-jewel data lives: contracts, IP, financial records, board papers, and compliance files. And if in doubt, then follow the NCSC’s 3-2-1 principle. Keep three copies on two types of media, with one copy kept completely offline. Connected backups are still open to ransomware. Offline copies create the clean recovery point you will need if the worst were to happen.

That is why we built Firevault. It is a secure offline data storage platform for the valuable, vulnerable, and sensitive five percent. If it is not online, it cannot be stolen, encrypted, or exploited. It is protection through disconnection, and it is a board decision, not a technical one.

Partnering to prevent and protect

Our partnership with Sona Insurance Solutions, based in Colchester and Borehamwood, brings prevention and protection together. As CEO, Rob Thacker says: “the real opportunity is to stop exposure before it becomes a claim.”

It’s also worth noting that directors can also use personal vaults for their own crown-jewel materials. In fact, doing so signals diligence and sets the right tone for the business.

So, we have to start changing the way we work and move critical files offline now before the worst happens. And remember, whether your turnover is one million or one hundred, the buck still stops with you.

* https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025