Topic

Cyber security, fraud, and the proof a customer asks for

The losses that reach a small Irish business mostly arrive by email, and the controls that stop them fit on one page.

Irish SMEs lost almost 19 million euro to email scams over 2024 and 2025, according to FraudSMART, the banks' fraud awareness programme. The majority of cases were invoice redirection: an email that did not come from the supplier says the supplier's bank details have changed.

The articles below cover the controls that stop that, the email settings that decide whether anybody can send mail in your name, and the questions a larger customer or an insurer asks to find out whether those controls exist.

Free checkEmail security checkReads your domain's SPF, DKIM and DMARC records from public DNS and says whether email forged in your name would be refused, junked or delivered.
Free checkCyber insurance readiness checkThe security questions on Chubb's Irish cyber insurance proposal forms, answered yes, no or not sure, with what each form asks for and guides to the gaps.

27 articles on this

Start here · Cyber security
Cyber security for a small Irish business: the six measures, and the proof
Ireland's National Cyber Security Centre asks small businesses for six things first. Each one is a setting or a habit, and each one is what an insurer or a larger customer will ask you to prove.4 minute read · 4 sources
Standards
What ISO 27001 certification costs in Ireland, from the certification bodies' own pages
None of the three bodies accredited in Ireland for ISO 27001 publishes a price list. One publishes a guide figure for a business with fewer than 10 staff, NSAI publishes the questions it asks before quoting, and NSAI's shop prices the standard itself. Everything else is quoted per organisation.6 minute read · 12 sources
Cyber security
A firewall for a small office: the router, the laptops, and what neither one stops
A small office can have a firewall in two places: the router between the office and the internet, and each laptop, where Windows and macOS have one built in. This is what each does, the settings that matter, and what a firewall leaves to other controls.8 minute read · 11 sources
Standards
SOC 2 or ISO 27001: a CPA's report or an accredited certificate
The one to get is the one your customer asks for. SOC 2 is a report on your controls, written by a licensed, independent CPA under the AICPA's standards. ISO 27001 is a standard for running information security as a management system, and a certificate to it comes from a certification body after its own audits.4 minute read · 9 sources
Cyber security
A ransomware attack: what to do in the first hour, and who to tell
Disconnect what is infected, do not pay or reply, and report it to the Gardaí. Then check whether a free decryption tool exists. If the systems held personal data, the GDPR asks you to notify the Data Protection Commission without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to put people at risk.6 minute read · 12 sources
Microsoft 365
Microsoft Intune for a small business: what it manages, what it costs, and what it leaves to you
Intune is Microsoft's cloud service for managing a business's laptops and phones, and the work apps on them. Microsoft 365 Business Premium includes it; Business Basic and Standard have a limited part of it. This is what each part does, what it cost on Microsoft's Irish pages in October 2026, and what it leaves to you.7 minute read · 13 sources
Standards
ISO 27001 in plain words: what it asks of a business, and what certification means
ISO 27001 is a standard for running information security as a managed system: decide what matters, assess what could go wrong, choose controls, and check they keep working. A business can follow it without certification. A certificate is what a customer usually asks to see.5 minute read · 6 sources
Microsoft 365
Two-step sign-in for every Microsoft 365 user: the admin screens, in order
Switching on two-step sign-in for a whole Microsoft 365 tenant is one setting. Doing it without stopping the office printer, and proving afterwards that every person is covered, takes three more screens.5 minute read · 4 sources
Research
Email security in five Irish sectors: 4,101 domains, read on 29 October 2026
On 29 October 2026 we read the public email records of 4,101 Irish business domains. Of the 3,555 that receive email, 345 publish a policy telling receiving servers to junk or refuse mail forged in their name.6 minute read · 6 sources
Microsoft 365
Microsoft Authenticator for a small team: set-up, sign-in and new phones
Microsoft Authenticator is free, and it is the method Microsoft 365's security defaults make every user register. Adding it takes one QR code per person. The part that goes wrong is the day somebody changes phone.5 minute read · 7 sources
Microsoft 365
Microsoft 365 Basic, Standard or Premium: what each adds for security, at Irish prices
All three Microsoft 365 business plans filter spam and malware and switch two-step sign-in on by default. Business Premium adds four things to that, and on 29 October 2026 Microsoft's Irish price for it was €27.73 a user a month, paid yearly, before VAT.5 minute read · 6 sources
Passwords
A password manager for a small business: what to look for, and how to run one
A password manager lets every account have its own long password without anybody remembering it. For a business, the part that matters is what happens to the shared logins when somebody leaves.5 minute read · 3 sources
Cyber security
Someone clicked a phishing link at work: what to do, in order
A click on its own may have done nothing. A password typed into the page that opened is a different matter, and the order you work in decides whether the attacker keeps a way back in.3 minute read · 4 sources
Email security
SPF, DKIM and DMARC on Google Workspace: the records and the order
Gmail delivers your mail from the day you sign up, but refusing forgeries of it takes three records: SPF, a DKIM key you generate in the Admin console, and a DMARC policy. Google's own pages give the order and the waits.3 minute read · 3 sources
Email security
SPF, DKIM and DMARC on Microsoft 365: the records and the order
A new Microsoft 365 tenant sends your email with an SPF record you were told to add and a DKIM signature in Microsoft's name, not yours. Two CNAME records and one TXT record fix that, and Microsoft publishes the order to add them in.4 minute read · 3 sources
Email security
SPF "too many DNS lookups": what it means and how to fix it
SPF allows ten DNS lookups. A record that needs more returns an error instead of a pass, so the protection it was meant to give stops, often without anybody noticing until invoices start bouncing.4 minute read · 3 sources
Cyber insurance
What does it cost to meet cyber insurance requirements in Ireland?
Switching the controls on costs little: two-step sign-in comes with Microsoft 365 and Google Workspace, and a DMARC record is one line of DNS. The cost is the work of setting them up without locking anybody out, and the dated proof an insurer asks to see. Published Irish prices for that work run from €1,197 + VAT for the email and website settings alone to €17,000 a year for a consultancy subscription. Ours is €2,950 for up to 10 staff, once.6 minute read · 8 sources
Email security
What does DMARC set-up cost?
Publishing a DMARC record costs nothing: it is one line in your domain's DNS. What you pay for is the work around it: finding every service that sends email in your name, fixing SPF and DKIM for each, and moving the policy from p=none to quarantine or reject without blocking your own invoices. Published prices for that run from report software you use yourself to €1,197 + VAT for an Irish firm to do it.5 minute read · 6 sources
Choosing help
FourWinds Protect or a managed IT provider: which do you need?
They do different jobs. A managed IT provider looks after your devices and supports your staff every month. Protect closes the compliance gaps an insurer or customer asks about, once, and proves it with a second scan and an evidence pack. If you have an IT provider, the programme adds the proof. If you have none, your devices still need one.5 minute read · 4 sources
Backups
Your backup shows green. What the GDPR and an insurer expect you to show
Article 32 of the GDPR asks, as appropriate to the risk, for two things: the ability to restore personal data in a timely manner, and a process for regularly testing the security measures. The plainest evidence of both is a dated record of restoring real files, repeated at a set interval, from a copy that an attack on the original could not reach.16 minute read · 23 sources
Cyber security
Two-step sign-in on every mailbox: turning it on, and proving it
In four inquiries into break-ins to staff mailboxes, the Data Protection Commission treated the lack of two-step sign-in as a failing in the organisation's security. Allowing it is one setting. A regulator, an insurer or a customer asks whether it is enforced on every account that can sign in, info@ included, and for the report that shows it.15 minute read · 40 sources
Payment fraud
A supplier emails new bank details. What should happen next
Ring the supplier on a number you held before the email arrived and have a second person approve the change; if money has already gone to a new account, ring your bank's fraud team before anything else.18 minute read · 18 sources
Email security
Can someone send email as your business? What SPF, DKIM and DMARC decide
If your domain has no DMARC record, or one set to p=none, anybody can send email that shows your address as the sender. Receiving mail servers have nothing from you telling them to stop it.23 minute read · 23 sources
NIS2
Your customer is under NIS2. What they will ask you, the supplier
NIS2 does not cover a small supplier, unless it is a type of business the Directive covers at any size or an EU country has identified it. Ireland has not yet made the Directive part of Irish law (transposed it). The questions arrive anyway, because the Directive makes your customer take account of the security of each direct supplier.23 minute read · 18 sources
Cyber insurance
What a cyber insurer asks an Irish small business, and how to answer it truthfully
If your business turned over €3 million or less in its last financial year, and is not a company in a group that turned over more, Irish law puts you under no duty to volunteer information to the insurer. You must answer its questions honestly and with reasonable care. A dated screenshot, taken before you sign, is how you show you did.18 minute read · 19 sources
Cyber security
A customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?
None of the three is required by Irish law for an ordinary small business. Which one you need depends on who is asking, and whether they want a certificate or will accept your own assessment.17 minute read · 28 sources
NIS2
NIS2 is not Irish law yet. Here is when it still reaches you.
NIS2 is an EU cyber security law that Ireland has not yet made Irish law. Until it does, there is no Irish NIS2 regulator, no duty to register and no NIS2 fine. Some businesses are affected today anyway, through a customer's contract, the GDPR or the Cyber Resilience Act.22 minute read · 29 sources

What we do about this

What the law asks of youCompliance assessmentOne assessment of the rules that apply to you: GDPR, the EU AI Act and accessibility.
Compliance auditISO 27001 readinessWe prepare you for ISO 27001 certification.
We run itSupportWe keep what we built or secured for you working.
Cardinal, the platformClient portalProgress on your work, reports, invoices and support in one account, beside the automation, reporting and compliance work we run for you.

Talk to us

Cyber security, fraud, and the proof a customer asks for

27 articles on this

Cyber security for a small Irish business: the six measures, and the proof

What ISO 27001 certification costs in Ireland, from the certification bodies' own pages

A firewall for a small office: the router, the laptops, and what neither one stops

SOC 2 or ISO 27001: a CPA's report or an accredited certificate

A ransomware attack: what to do in the first hour, and who to tell

Microsoft Intune for a small business: what it manages, what it costs, and what it leaves to you

ISO 27001 in plain words: what it asks of a business, and what certification means

Two-step sign-in for every Microsoft 365 user: the admin screens, in order

Email security in five Irish sectors: 4,101 domains, read on 29 October 2026

Microsoft Authenticator for a small team: set-up, sign-in and new phones

Microsoft 365 Basic, Standard or Premium: what each adds for security, at Irish prices

A password manager for a small business: what to look for, and how to run one

Someone clicked a phishing link at work: what to do, in order

SPF, DKIM and DMARC on Google Workspace: the records and the order

SPF, DKIM and DMARC on Microsoft 365: the records and the order

SPF "too many DNS lookups": what it means and how to fix it

What does it cost to meet cyber insurance requirements in Ireland?

What does DMARC set-up cost?

FourWinds Protect or a managed IT provider: which do you need?

Your backup shows green. What the GDPR and an insurer expect you to show

Two-step sign-in on every mailbox: turning it on, and proving it

A supplier emails new bank details. What should happen next

Can someone send email as your business? What SPF, DKIM and DMARC decide

Your customer is under NIS2. What they will ask you, the supplier

What a cyber insurer asks an Irish small business, and how to answer it truthfully

A customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?

NIS2 is not Irish law yet. Here is when it still reaches you.

What we do about this

Other topics