Category: Cybersecurity & Compliance

A letter arrives from a lawyer. It names your company, describes a dispute, and tells you to preserve all documents and electronically stored information that might relate to it. If you have in-house counsel, they take it from there. If you do not, the letter usually lands with whoever runs operations, and the question becomes very practical very quickly: what, exactly, are we supposed to stop doing?

This is the IT side of that answer, written for a business that has received a preservation demand or a litigation hold instruction from its own attorney, not for a law firm. The aim is simple: nothing relevant disappears between now and the day counsel says you can stop.

It is practical guidance, not legal advice. Your attorney decides the scope. IT carries it out, and documents that it did.

What the Notice Is Actually Asking For

A litigation hold suspends your normal deletion for a defined set of information. Three things define it, and IT should not start until it has all three from counsel in writing:

Who. The custodians: the people whose email, files, chats and devices may hold relevant material. Usually named individuals, sometimes whole departments.

When. The date range. Often it runs back months or years before the dispute surfaced, and it always runs forward until the hold is released.

What. The kinds of information: email, shared files, chat, accounting records, a particular application, phone records, sometimes paper.

The duty to preserve does not wait for a lawsuit. It starts when litigation is reasonably anticipated, which is why a demand letter, a regulator’s inquiry or a threatening resignation email can be enough. The practical consequence for IT is speed: the gap between the letter arriving and the deletion stopping is where most of the risk sits.

Stop the Things That Delete Automatically

Most data in a modern business is not deleted by people. It is deleted by schedules nobody remembers setting. Those are what a hold has to interrupt first.

Backups deserve a specific conversation with your attorney rather than a reflex. Keeping every backup indefinitely is expensive and often unnecessary when the live data is properly held; letting the only copy of something relevant expire is the opposite problem. It is a scoping decision, and it belongs to counsel.

Where the Relevant Data Really Lives

The mailbox is the obvious place and rarely the only one. When you list systems for counsel, include:

Holds in Microsoft 365 and Google Workspace

Both platforms can preserve data in place, so nothing has to be copied out to a drive on day one. The details matter, and licensing is where businesses get caught.

Microsoft 365. A mailbox litigation hold keeps everything in that mailbox, including items the user deletes or purges, until the hold is removed. It needs an Exchange Online Plan 2 licence, or Plan 1 with the Exchange Online Archiving add-on, so many small-business subscriptions cannot apply one without a licence change. Microsoft notes it can take up to 240 minutes to take effect. The mailbox hold covers the mailbox; files in OneDrive and SharePoint and conversations in Teams channels need their own hold, set through Microsoft Purview.

Google Workspace. Holds are set in Google Vault, which is included in Business Plus and the Enterprise editions but not in Business Starter or Business Standard. Organisations on those plans need to upgrade or add Vault licences before they can place a hold.

When Someone on the Hold List Leaves

Normal offboarding and a litigation hold pull in opposite directions. Offboarding wants accounts closed, licences recovered and laptops back in circulation. A hold wants everything left exactly as it is.

For anyone in scope, the hold wins. Disable sign-in so the person cannot reach the data, but do not delete the account, the mailbox or the files, and do not reimage the laptop. Remove or change licences only after confirming the hold survives the change, because on some configurations removing the licence disables the mailbox the hold depends on. Our offboarding guide covers the normal sequence; under a hold, the deletion steps simply do not happen.

Preserve in Place, Collect Later

The well-meaning mistake is to start gathering: forwarding emails to a folder, copying files to a USB drive, asking people to send what they think is relevant. All of it changes metadata, mixes originals with copies, and creates questions about completeness that are hard to answer later.

Preservation and collection are separate steps. Preservation, which is IT’s job now, means freezing data where it lives. Collection, when it comes, is usually directed by counsel and sometimes performed by an e-discovery vendor using tools that record how and when each item was gathered. Do the first well and the second becomes routine.

What a Court Can Do When Data Goes Missing

In federal court, Rule 37(e) governs lost electronically stored information. If data that should have been preserved is lost because a party did not take reasonable steps, and it cannot be restored or replaced, the court can order measures to cure the harm to the other side. If it finds the party acted with intent to deprive the other side of the information, it can presume the information was unfavourable, instruct the jury accordingly, or dismiss the case or enter a default judgment.

California state courts have their own tools under the Civil Discovery Act, and juries can be instructed that they may infer evidence a party suppressed would have been unfavourable to it. California also protects information lost through the routine, good-faith operation of a system, but that protection does not relieve anyone of the duty to preserve once it applies.

The standard throughout is reasonable steps, which is why the record of what IT did, and when, matters almost as much as the doing.

The Order to Work In

1. Get the scope in writing. Custodians, date range and categories of data, from counsel. Ask questions now rather than guess.
2. Stop automatic deletion. Retention policies, account cleanup and device recycling, for everyone in scope.
3. Apply platform holds. Mailboxes, OneDrive and SharePoint, Teams or Vault, after confirming each licence supports it.
4. Set devices aside. Label them, store them, and keep them out of the reimaging pile.
5. Contact the vendors. Ask line-of-business and SaaS providers in scope how they preserve data, and keep their replies.
6. Write it down. A dated log of every action, who took it and what it covered. If the steps are ever questioned, this is the answer.

Litigation Hold Questions, Answered

Related reading: Employee Offboarding: What IT Must Do · What Belongs in an AI Acceptable Use Policy · Does the CCPA Apply to You?

Antivirus asks one question about every file: have I seen this before? For a long time that was enough. Modern attacks increasingly avoid files altogether, using the tools already on your computers, and that is the gap endpoint detection and response was built to close.

EDR watches what happens on each device, keeps a record of it, and gives a responder the controls to investigate and stop an attack in progress. This guide explains how it differs from antivirus, what it catches that antivirus misses, and the part that decides whether it works at all.

What EDR Does That Antivirus Does Not

The Attacks That Walk Past Antivirus

Somebody Has to Answer the Alert

This is the part of the EDR conversation that software vendors tend to skip. EDR produces alerts. Some are serious, most are not, and the serious ones rarely arrive during business hours. A tool that detects an attack at 2 a.m. on a Saturday and waits until Monday for someone to read the alert has not stopped anything.

So the real decision is not which EDR product to buy but who watches it. A business with its own security team can run it in-house. Most small and mid-sized businesses cannot staff that around the clock, which is why EDR is usually paired with a monitoring service.

Our 24/7 monitoring service puts analysts behind the EDR so alerts are triaged and contained at any hour, and it is part of the Advanced Shield platform we run for clients.

What Insurers and Auditors Now Ask

EDR has moved from nice-to-have to expected. Cyber insurance applications commonly ask whether it is deployed on all endpoints and servers, alongside MFA and tested backups, and the answer affects both eligibility and premium. Our guide to cyber insurance IT requirements covers the full list.

Security frameworks and customer questionnaires ask the same thing in different words: can you detect malicious activity on your endpoints, and can you respond to it? EDR with defined response procedures is the most direct way to answer yes. If you already pay for Microsoft 365 Business Premium, check your Microsoft 365 security setup first, because the EDR capability may already be licensed and simply not configured.

Rolling It Out Without Breaking Things

1. Count every device. Laptops, desktops and servers, including the machines nobody remembers. EDR only protects what it is installed on.
2. Start in audit mode. Deploy in a detect-only setting first so you can see what it would block before it blocks anything.
3. Tune for your applications. Line-of-business software sometimes behaves in ways that look suspicious. Add specific, documented exclusions rather than broad ones.
4. Remove the old antivirus. Running two products causes conflicts and slowdowns. Replace, do not stack.
5. Write the isolation runbook. Decide in advance who can isolate a device, when, and how the user keeps working while it is investigated.

EDR Questions, Answered

Related reading: Dark Web Monitoring for Business · Penetration Testing Cost · Windows 10 After October 2026

Two penetration test quotes for what sounds like the same job can differ by a factor of five. Usually neither vendor is being unreasonable. They have priced different scopes, different depths of testing and different deliverables, and the quote rarely makes that obvious.

This guide sets out the ranges testing firms publish for 2026, explains what actually drives the number, and shows how to scope a test so you pay for what your customers, auditors or insurers are really asking for.

The figures below are market ranges from published rate cards, not a quote from us. Your scope decides your price.

Price Ranges by Type of Test

Most small and mid-sized businesses need the first two, and a web application test only if they build or host an application that handles customer data. Red team exercises are for mature security programmes and are rarely the right first purchase.

What Actually Moves the Quote

The Quote That Is Too Low to Be Real

The cheapest “penetration tests” are often an automated scan with a new cover page. The output looks thorough, pages of findings sorted by severity, but no person has tried to exploit anything, chain weaknesses together or rule out false positives.

There are three quick ways to tell the difference before you sign. Ask for a redacted sample report and look for evidence of manual work: screenshots, step-by-step attack paths, findings that could only come from a human. Ask how many tester hours or days the price includes. And ask who will do the work and what hands-on credentials they hold.

If what you actually need is a prioritised list of weaknesses rather than proof of exploitation, that is a different service and a cheaper one. Our vulnerability assessments are built for exactly that, and many businesses do one before their first penetration test.

Who Is Asking You for One

Knowing why you need a test is the fastest way to scope it correctly, because each requester cares about different systems.

Card payments. PCI DSS requires penetration testing at least once every twelve months and after significant changes, covering the systems in its scope.

SOC 2 and customer security reviews. Not strictly mandated by the framework, but auditors and enterprise customers commonly expect an annual third-party test. Our SOC 2 work scopes it to the systems in the audit boundary.

Cyber insurance. Some carriers ask about recent testing on applications and renewals. It is one of several controls they weigh, alongside those covered in our guide to cyber insurance IT requirements.

How to Scope One Without Overpaying

1. Start from the requester. Get the exact wording of what the customer, auditor or insurer asked for, and let that set the scope.
2. List the targets precisely. External IPs and domains, internal networks, applications and user roles. Vague scope produces padded quotes.
3. Choose grey box by default. Provide a standard user account and basic documentation so testing time goes on testing.
4. Get retesting in writing. Confirm one round of retest is included, and the window for completing fixes.
5. Compare like with like. Line up quotes by scope, tester days, retest and deliverables, not by the total at the bottom.

Penetration Testing Questions, Answered

Related reading: What Is EDR? · CCPA Compliance in 2026 · Dark Web Monitoring for Business

The California Consumer Privacy Act is usually treated as a legal project: a privacy policy, a cookie banner, a web form. Those matter. But most of the real work, and most of the real exposure, sits in IT, in knowing where personal data lives, being able to find and delete it on request, and keeping it secure enough that a breach does not become a lawsuit.

That split became sharper on 1 January 2026, when new regulations from the California Privacy Protection Agency took effect adding cybersecurity audits and risk assessments for higher-risk businesses. This guide covers who the law applies to, what changed, and the IT work in a sensible order.

It is a practical summary, not legal advice. Confirm your own obligations with counsel.

Who the Law Actually Covers

The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds:

Revenue. Annual gross revenue above $26,625,000. This was $25 million until the Consumer Price Index adjustment that took effect on 1 January 2025.

Volume. Buying, selling or sharing the personal information of 100,000 or more California consumers or households each year.

Business model. Deriving half or more of annual revenue from selling or sharing personal information.

Two points catch people out. First, the revenue test counts total revenue, not California revenue, so a mid-sized company headquartered elsewhere with a handful of California customers can still be covered. Second, since January 2023 the law has applied in full to employee, applicant and business-contact data, so an HR file is personal information in exactly the same way a customer record is.

What Changed in January 2026

The Office of Administrative Law approved the CPPA’s new regulations on 23 September 2025, and they took effect on 1 January 2026. Three additions matter for IT.

Cybersecurity audits. Businesses whose processing presents a significant risk to consumers’ security must complete an annual, independent cybersecurity audit and certify it to the agency. The trigger is broadly half of revenue from selling or sharing personal information, or meeting the revenue threshold while processing the personal information of 250,000 or more consumers, or the sensitive personal information of 50,000 or more.

Risk assessments. Businesses carrying out higher-risk processing, such as selling or sharing personal information or processing sensitive data, must document a risk assessment. Assessments for processing already underway are due by 31 December 2027 and submitted by 1 April 2028.

Automated decision-making. Rules for automated decision-making technology used in significant decisions apply from 1 January 2027.

After the first certification, audits are annual. The regulations spell out what the audit must examine, and most of it is ordinary security hygiene: authentication, encryption, access controls, logging, patching, backups and incident response.

Where the Obligations Land on IT

The Penalties, in Plain Numbers

The per-consumer figure is the one that scales. A breach touching 20,000 California records multiplies quickly, which is why the private right of action, not the regulator, is the real financial risk for most mid-sized businesses. The amounts are adjusted for inflation every two years.

A Sensible Order of Work

1. Settle coverage. Check the three thresholds, and separately whether the cybersecurity audit and risk assessment triggers could apply to you.
2. Build the data map. List every system and vendor that holds personal information, what categories it holds and who can access it.
3. Close the obvious security gaps. MFA everywhere, encryption for laptops and sensitive stores, patching, and logging you can actually retrieve. A security risk assessment gives you the prioritised list.
4. Make requests repeatable. A written process for verifying and answering access and deletion requests, with a named owner and a way to search every mapped system.
5. Tie it to a programme. If you already work toward another framework, fold the CCPA work into it rather than running it separately. Our compliance services are built around exactly that.

CCPA Questions, Answered

Related reading: Penetration Testing Cost · Dark Web Monitoring for Business · Employee Offboarding: What IT Must Do

Dark web monitoring does one narrow job: it tells you when a password, session or piece of personal data tied to your company shows up where criminals trade it. That is genuinely useful. It is also the point where most businesses stop, and an alert nobody acts on protects nothing.

Stolen credentials remain one of the most common ways attackers get into a business, a finding Verizon’s Data Breach Investigations Report has repeated year after year. Most of those credentials did not come from a dramatic hack of your systems. They came from somebody else’s breach, a reused password, or malware on a laptop your team uses to check email from home.

This guide covers what monitoring actually watches, how to sort the alerts it produces, and what a business should do in the first hour after one lands.

Where the Stolen Data Actually Lives

“The dark web” makes it sound like one place. In practice monitoring services collect from several different sources, and they are not equally dangerous.

Breach compilations. Large dumps of usernames and passwords from breached websites, merged and resold. These are the bulk of what any monitoring service finds. Most entries are old, and many passwords were changed long ago.

Infostealer logs. Malware on an individual computer quietly copies everything the browser has saved and uploads it. A single log can hold dozens of passwords, autofill data and live session cookies. These are recent by nature and far more dangerous than an old breach entry.

Forums, markets and chat channels. Where access is bought and sold, including “initial access” to specific companies. A mention here is rare and serious.

Paste sites. Public text dumps, often used to prove a leak is real. Useful as an early signal, and sometimes the first place a breach becomes visible.

Sorting Alerts by How Urgent They Are

Not every hit deserves the same reaction. A sensible triage looks like this.

Monitoring Is a Smoke Alarm, Not a Sprinkler

The weakness of dark web monitoring is that it detects rather than prevents. Its value depends entirely on what happens after the alert, and on the controls already in place.

The control that matters most is strong authentication. With multi-factor authentication enforced everywhere, a leaked password on its own gets an attacker very little. The exception is the stolen session cookie, which is why infostealer findings sit at the top of the triage list and why short session lifetimes and sign-in risk policies in Microsoft 365 are worth the configuration effort.

The second control is visibility. Knowing that a password leaked is only half the question. The other half is whether anyone used it, and that needs sign-in logs someone actually reads.

What the Common Options Cover

When an Alert Lands: The Response Order

1. Confirm the account and the source. Is this a current employee, a live password, a recent infostealer log or an old breach? The triage above decides everything that follows.
2. Kill the access, not just the password. Reset the password and revoke all active sessions and tokens for the account. A password reset alone leaves stolen session cookies working.
3. Read the sign-in history. Look for logins from unfamiliar locations, new devices or impossible travel since the data was collected. Check the mailbox for new rules, forwarding and OAuth app grants.
4. Find the machine. For an infostealer finding, identify the infected device and clean or rebuild it, because the malware may still be running. If there are signs the account was used, treat it as an incident rather than a password problem.
5. Close the gap it came through. Reused password, missing MFA, a personal device used for work? Fix the cause so the next alert is less likely.

Dark Web Monitoring Questions, Answered

Related reading: What Is EDR? · Employee Offboarding: What IT Must Do · Writing an AI Acceptable Use Policy