Manage the risk of disclosure of confidential information

In this guide:

  • How the Freedom of Information Act affects businesses

    How the Freedom of Information Act may affect your business if you provide goods and services to public bodies.

    The Freedom of Information Act (FOI Act) mainly covers public authorities like government departments, councils and health bodies. However, it can affect private businesses that deal with them through grants, licences, tenders or contracts.

    Does the Freedom of Information Act apply to private companies?

    Not directly, but it can apply if:

    • you share information with a public body that is subject to an FOI request
    • the information you share is published under their publication scheme

    What is a Freedom of Information (FOI) request?

    Under the FOI Act, anyone can ask a public authority for recorded information they hold, including details from businesses carrying out public functions, such as utility providers. This right applies to all information held, including emails, reports and contracts, and not just official records. If you contract with a public body, your intellectual property and confidential data could be included under the FOI request, if this type of information is on their record.

    How can FOI disclosure affect your business?

    If the public body receives an FOI request for information that relates to your business, they may need to disclose certain details. This can affect your commercial interests- for example, by revealing pricing, strategies or customer data to competitors.

    A public body will normally consult you first in a 'third-party consultation' before they release your information. They will explain the requested information, why they plan to release it and what harm it might cause to your business. You can then respond with arguments against disclosure, such as commercial sensitivity. The body must consider your views before deciding.

    Exemptions to FOI disclosure

    Certain types of information are exempt under the law. For example, financial records or contract details may be exempt from disclosure if they prejudice someone's commercial interest. Exemptions may also apply to requests for third-party personal data, under the UK General Data Protection Regulation (UK GDPR). See more on FOI exemptions: absolute and qualified.

    When sharing information with regulators or public bodies, consider their Freedom of Information obligations and the possible risk of disclosure.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/how-freedom-information-act-affects-businesses

    Links

  • FOI exemptions: absolute and qualified

    Overview of the Freedom of Information exemptions and the right of public bodies to withhold information from disclosure.

    Public authorities may refuse Freedom of Information (FOI) Act requests under certain conditions. For example, if requests:

    • cost too much or take too long to process
    • are vexatious
    • repeat an earlier request from the same person

    They can also apply exemptions to withhold information or refuse to confirm it exists.

    Some exemptions relate to a certain type of information, eg information on government policies. Other exemptions can apply if harm would arise, or be likely to arise, from disclosure.

    Absolute exemption under the FOI Act

    These let public authorities withhold information without a public interest check. Examples include:

    • national security matters
    • information banned from disclosure by other laws
    • if disclosure would result in a breach of confidence that could lead to legal action

    Most FOI exemptions are not absolute. Many exemptions require public bodies to consider public interest before releasing information.

    Qualified exemption under the FOI Act

    Most exemptions are qualified. This means that public authorities must apply a public interest test and disclose information unless withholding it serves a greater public interest.

    Examples of qualified exemptions include that are relevant to business include:

    • commercial interests (section 43)
    • sensitive business information
    • trade secrets

    See a full list of FOI exemptions and read more about the FOI and commercially sensitive information.

    FOI and data protection

    Under the UK General Data Protection Regulation (UK GDPR), if someone's FOI request involves revealing third-party personal data, public bodies must check if disclosure is fair, lawful and necessary. If it's not, or if it's disproportionate, the information will be exempt.

    Read more about the data protection principles under the UK GDPR.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    Dealing with vexatious requests
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/foi-exemptions-absolute-and-qualified

    Links

  • FOI and commercially sensitive information

    How to protect your trade secrets and commercial interest from FOI requests if you share information with public bodies.

    The Freedom of Information (FOI) Act covers public authorities, but it can also affect private businesses that contract with the public sector, or provide goods and services to public bodies. 

    Your sensitive information shared under a contract may, in this case, be subject to an FOI request. Information that harms commercial interests is exempt from disclosure under section 43 of the FOI Act (a qualified exemption).

    What counts as a commercial interest?

    Any information affecting your ability to compete, such as pricing, strategies or supplier details, counts as a commercial interest. Before releasing such information, public bodies must check if disclosure would cause real or likely harm to commercial interests. They do this through a test of prejudice.

    Prejudice to commercial interests

    To claim exemption for prejudice to commercial interests, you must show:

    • a specific negative impact from disclosure
    • that impact is significant (real, actual or of substance)
    • a real possibility (or likelihood) that the harm will occur because of disclosure

    Businesses provide evidence during third-party consultation to support the case, but the public body decides if the criteria are met (specific harm, significant impact, real possibility).

    Trade secrets and the FOI

    Under the FOI Act, trade secrets could potentially be exempt from disclosure. The Act doesn't define the term 'trade secret'. The term can cover, for example, technical information (invention, processes, recipes) and business information (supplier lists, costs, pricing or product development plans, etc).

    To constitute a trade secret, information should require the highest level of secrecy and not be: 

    • generally known
    • widely disseminated
    • simply confidential, but confer a competitive advantage to the owner

    Section 43 is generally the primary exemption that specifically covers trade secrets, and any information that would prejudice the commercial interest. Section 43 is a 'qualified exemption', which means the public authority must balance the harm of disclosure against the public interest in releasing the information.

    Find out more about section 43 - trade secrets and prejudice to commercial interests.

    Section 41 can sometimes be used to protect information provided in confidence, including trade secrets, if they were provided to a public authority by a third party. Section 41 is an 'absolute exemption', meaning there is no requirement to perform a public interest test.


    Find more information on section 41 - confidentiality.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    ICO guide to FOI exemptions
    Also on this site
    Trade secrets and other IP protection
    UK General Data Protection Regulation (UK GDPR)
    Content category
    IT

    Source URL

    /content/foi-and-commercially-sensitive-information

    Links

  • Manage the risk of disclosure of confidential information

    How to protect your business' confidential information if you share it with public bodies subject to an FOI request.

    The Freedom of Information (FOI) Act applies to public sector bodies. If your business provides goods or services to them, any shared information could be at risk of disclosure through an FOI request.

    Information at risk of FOI disclosure

    Types of information at risk of disclosure under the FOI Act include, for example:

    • reports, annual returns and investigations you provide to public bodies
    • public tenders or contracts details
    • public consultations responses
    • information relating to planning or development

    Public authorities may also hold your financial records or other commercially sensitive data, which could qualify for exemption. See FOI and commercially sensitive information. 

    How to manage the risk of FOI disclosure

    You cannot remove all risks associated with sharing information with public bodies, but you can take the following steps to reduce them.

    Label information as 'confidential' or 'restricted'

    If the information is confidential or commercially sensitive, think carefully if it is necessary to disclose it. If it is, mark it clearly as 'confidential' or 'restricted'. Submit it separately from other data to avoid accidental disclosure. Keep in mind that simply labelling information 'confidential' does not guarantee exemption.

    Include consultation rights in contracts

    Agree consultation rights in your contracts with public bodies, ie the right to be informed before any disclosures, so you can object before information goes public. Avoid blanket confidentiality clauses and tailor terms and conditions to FOI risks to minimise any impacts.

    Train staff and set procedures

    Train staff on FOI requirements, data protection and the potential risk of information disclosure. Create policies and procedures for sharing data with public bodies. Track what you share with them, review it regularly, and assign FOI responsibility to a named person or team within the business.

    Understand exemptions

    If someone makes an FOI request about your business, a public authority may have to release the information unless an exemption applies. It is worth understanding how exemptions work to know how to object during consultation and argue against the release of sensitive business data.

    FOI brings both risks and opportunities for your business. While disclosure of sensitive details could put your business at risk, FOI lets you request useful information from public bodies, such as details of procurement criteria and tender process, decisions, previous contract awards and supplier details, and even competitor bids on business contracts. Find out how to use FOI to your business advantage.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    FOI Code of Practice
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/manage-risk-disclosure-confidential-information

    Links

  • Use FOI to your business advantage

    Use Freedom of Information requests to find and access information held by public bodies that could benefit your business.

    Public sector organisations may hold information that is relevant to your business or industry. For example, information on their procurement processes, previous bid proposals or existing public contracts, and even information on your competitors. You have the right to request this information under the Freedom of Information (FOI) Act.

    Exemptions may limit what you receive, if disclosure would result in someone's personal details or commercial secrets being revealed.

    Before making an FOI request

    Before you make a request, check if the information is already in the public domain (eg on the public body's website or publication scheme).

    You should not make requests for your own personal data under the FOI provisions. Instead, make a subject access request under the UK General Data Protection Regulation.

    How to make an FOI request

    Any request you make for information under the FOI Act must be made in writing and include:

    • your name
    • your contact details (postal or email address)
    • clear details of the information needed and preferred format

    See how to access information from a public body.

    What happens when you make an FOI request?

    Public authorities must reply within 20 working days. They may:

    • give you the information you asked for
    • tell you if they don't have the information
    • redirect your request to another authority, if needed
    • charge a fee if allowed (rules apply)
    • withhold information under an exemption and explain why
    • tell you they need longer to respond - up to 40 days for public interest cases

    Find ICO's guidance on time limits for compliance under the FOI Act.

    Requests are handled 'applicant blind' - your identity and purpose do not matter.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    FOI Code of Practice
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/use-foi-your-business-advantage

    Links

  • Responding to a Freedom of Information request

    What to do if a public authority asks your business to help with a Freedom of Information request.

    Private businesses are not directly subject to the Freedom of Information (FOI) Act. You are unlikely to receive requests unless you hold information on behalf of a public body, such as under a contract.

    If you receive an FOI request

    Forward it to the public authority you work with and discuss their expected response. They remain responsible for replying, normally within 20 working days.

    If you're asked to assist with an FOI request

    Provide any relevant information you have that the public authority may need for their reply. They will guide you on what they need, handling process and timelines, and any exemptions that may apply.

    If you're asked to assist with an FOI request, it may help to understand more about the public authority's duty to respond.

    Help
    ICO Helpline
    Actions
    ICO guide to Freedom of Information
    FOI Code of Practice
    FOI self-assessment toolkit
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/responding-freedom-information-request

    Links

Website layout and wireframing

In this guide:

  • Develop a project plan for your website

    Create a clear project plan to manage time, budget and risks when building your business website.

    Planning is an essential part of creating websites. It is often as important as website development itself. A good website project plan can help you:

    • reduce risks and possible problems during the development
    • manage your time and resources better
    • keep the focus on your project goals and objectives
    • carry out tasks with greater efficiency
    • stick to the agreed schedule and deadlines
    • improve communication with web designers and developers

    What to include in your website development project plan

    Before you start any work on the code of your website, define your website's:

    • purpose - what do you want your website to accomplish (eg find new customers, generate leads, advertise your business, sell online, etc)
    • users - who will use the website, how/when will they do it, what devices will they be using to access your site
    • structure - how you want to organise it, eg how users will navigate through the site and how different pages should be laid out
    • design - how it will look like and be used, eg elements such as logos, menu selection, etc
    • content - what information (text, image, media etc) do you want to publish on the site and who will develop, populate and maintain it
    • content management system - how you will add and edit the content on your website
    • domain name - what will be your domain name, ie your URL, and what you need to do to register it
    • web host - who will host your website and what website hosting options will best suit your needs
    • build method - will you choose an off-the-shelf template to build your site, use an online tool, or commission a web developer

    Key project elements

    A good website project plan should set out:

    • a task list - for every step of the website creation process
    • a schedule - the timeline for the completion of tasks, testing and launch
    • a budget - to cover all stages of the project (ie planning, design and development costs, any bespoke functionality you might need, as well as training, annual hosting and support costs, copywriting, etc)

    Aim to create clear and detailed specifications during the planning stage. You can break them down into planning, design and development sections in your plan. It may help to include charts to visualise your timeline and milestones.

    Useful project documents for website development

    You can search online for free or commercial website project plan templates, including task lists, project schedules and budget plans. Other documents that you might find helpful include:

    • work breakdown structure
    • feature descriptions
    • responsibility assignment matrix
    • risk register and response plan
    • project iteration and closure reviews

    See also project management templates and tools.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content management systems
    Content category
    IT

    Source URL

    /content/develop-project-plan-your-website

    Links

  • Choose and register a domain name

    How to choose the right type of domain name for your business, and how and where to register it.

    Your domain name (eg nibusinessinfo.co.uk) is your website's internet address. Choose wisely - it effectively supports your brand and business online.

    Different types of domain names for business

    There are many different types of domain names. They generally fall under one of two categories:

    • generic top-level domains (gTLDs) such as .net, .com, .org, .biz and .info
    • country code top-level domains such as .uk for the UK

    Most UK companies choose to have domain names that end in .com or .co.uk. Some Northern Ireland businesses also use .ie as another option.

    There are now hundreds of gTLDs available to register, eg .london, .company, .club, .eu. Think carefully about the geographical implications of your server and domain names, as they can affect local search results.

    Certain eligibility rules apply to ownership of .eu domain names - read about registering and renewing .eu domain names in the UK.

    What makes a good domain name

    When choosing a domain name, most businesses choose a name based on the name of their business or product. Your domain name should be:

    • short
    • easy to spell
    • easy to remember
    • relevant to your business or product

    You should avoid choosing a domain name that:

    • misuses a trade mark that belongs to another business
    • misleads users into thinking you are someone else
    • contains lots of dashes (eg my-new-website-business-and-shop.co.uk) - this looks unprofessional, is difficult to remember and some search engines may consider it to be spam

    How to register a domain name?

    You can check availability and register a domain name through an internet service provider (ISP) or a domain registration agent. See a list of ICANN accredited registrars, registrars accredited in the UK, or registrars accredited in the EU.

    You will need to pay a small fee to register your domain name. This will grant it protection for the duration of the registration period. Typical annual fees start from £10-20.

    Domains are not forever. You can't buy a domain name outright or permanently. You will have to renew your registration annually to keep ownership of your domain name. 

    It is important to understand that domain names are unique. They are allocated on a first come, first served basis, so it is possible that your preferred domain is already in use. You can check if the domain of your choice is available with registrars such as Nominet.

    Actions
    What is a domain name?
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Domain name and trade mark conflicts
    Registering and renewing .eu domain names in the UK
    Content category
    IT

    Source URL

    /content/choose-and-register-domain-name

    Links

  • Plan your website content and structure

    How to come up with content ideas, and plan, prioritise and organise information for your website.

    There are many ways to plan content and information architecture for a website. Depending on the size of your site, you may use one or more tools and techniques, such as:

    • sitemaps
    • content inventories
    • content mapping
    • card sorting
    • paper sketches

    What are sitemaps?

    Sitemap diagrams are graphic tools that can help you to:

    • visualise the relationships between pages on your website
    • ensure the right flow between pages
    • spot gaps in content
    • develop your website design around content, rather than the other way around
    • encourage team collaboration and allocation of content creation
    • identify potential issues that could affect content creation and project deadlines

    You can draw up a sitemap or a page hierarchy in a Word document, on a spreadsheet, or use one of many free tools available online. This will allow you to spot gaps, plan user journeys and assign content owners.

    See examples of sitemap documents or browse online to find more.

    Build a content inventory

    A content inventory can help you examine the scope and purpose of each page on the site. It can be time-consuming to create but useful if you are relaunching an existing site, as it will help you to:

    • record and analyse each item of content that you have
    • establish how well it performs
    • segment your content types and work out how best to present them

    Find out more about content inventory.

    Content mapping steps

    Content mapping is a visual technique that can help you plan your website content. It is a method that combines:

    • defining and analysing your business goals
    • profiling your audience and their needs
    • mapping content to goals and users
    • prioritising by hierarchy

    By carrying out these activities, you can produce content maps for your site and work out which content should feature. Content mapping can help you explore and visualise your content, and its effectiveness and root it in clearly defined business goals. You can also use simple card sorting and paper sketches to organise your content according to hierarchy. 

    When choosing your method of content planning, consider the size and type of your website. Simple brochure sites may just need sketches; complex sites benefit from full mapping.

    When to start planning content?

    Content creation takes time, a strategic approach and often many revisions. Plan it alongside design to prevent delays and cost overruns during development.

    Actions
    Content audit process
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content marketing
    Website hosting options
    Content category
    IT

    Source URL

    /content/plan-your-website-content-and-structure

    Links

  • Website layout and wireframing

    Understand what makes a good website layout and hierarchy – and how to achieve this with wireframing and good design practices.

    A good website layout and a clear hierarchy help guide users to content quickly. Poor design and layout will provide a bad user experience and prevent your customers from accessing your information, services or goods.

    As with content planning, certain techniques can help you with designing your website layout. The most common one is using wireframes.

    What are wireframes?

    Wireframes are a popular way of mapping out a website. They allow you to create a mock-up - ie a blueprint or a skeleton of the site that shows the basic elements you intend to include.

    These elements should include only the core layout, structure and organisation rather than the detailed visuals. A wireframe may comprise simply:

    • labelled boxes that illustrate the overall navigation placement
    • blocks of content that each webpage will contain
    • footer elements

    When developing your website structure, it's important to take account of web accessibility requirements, as well as your user's needs. Read about best practice in web design.

    Benefits of wireframing

    Wireframes are generally low-fidelity, basic and easy to understand. They are also quick and cheap to produce. You can draw a wireframe using Word, PowerPoint or Illustrator, or simply with a pencil and paper.

    They are also typically very easy to change, and handy to share for feedback or fine-tune with your project team or web designers. Designers tend to use wireframes to show the navigation flow between the different screens. Developers may use them to get a better understanding of the core functionalities of the site.

    From wireframe to a prototype

    Wireframes don't contain real content, so establishing the final layout of the screen may be difficult. However, wireframes often evolve into more functional prototypes.

    Prototypes offer greater fidelity with regard to the design of your website. They provide more visual detail and can include user interaction functionality. A prototype should represent the final product as closely as possible.

    You can use a prototype to test, demonstrate and validate the functionality of your website design before full development. See how to test and launch your website.

    Actions
    What is a website wireframe?
    Invest NI's ICT support for business
    Also on this site
    Content marketing
    Website hosting options
    Content category
    IT

    Source URL

    /content/website-layout-and-wireframing

    Links

  • Different options for building your website

    An overview of different web development options, including building the website yourself, using templates or hiring someone else to build it for you.

    There are many ways to build a website. Depending on your skills and budget restrictions, you can build it yourself, use templates or 'site builder' tools, or hire a web designer to build it for you.

    Build a website yourself

    Building a website from scratch is generally only an option if you have:

    • good technical knowledge, especially of HTML
    • a web-building application or software, such as Adobe Dreamweaver
    • staff in-house who have the skills and the expertise required

    HTML is the foundation of building websites. Even if you rely on web-building tools, some degree of HTML knowledge will likely be necessary to help you carry out the project. Be realistic about the skills of those involved and seek advice from IT professionals if you need it.

    Use templates or 'site builder' tools

    There are many great options for using templates or online tools for building websites. This method usually allows you to:

    • create a website quickly and easily (often via 'drag and drop' modules)
    • choose from thousands of themes and designs
    • customise different elements, such as navigation and page layout
    • use plugins for added functionality or features of the site

    All you need to do is choose your template and add your content, and your website is generally ready to go. Web design or web hosting companies typically offer different packages and template options at different prices. They are usually more affordable than commissioning a designer and can include a one-off charge or monthly/annual payments.

    Hire a web designer or an agency

    You don't have to have a huge budget to be able to work with a web designer or an agency.

    The expertise that they will bring to the project will likely be worth the extra cost, as they will be able to guide you through the whole process - from planning to launch.

    To make sure you're happy with the results, brief the designer carefully and agree in advance on the key issues around the project. See how to choose and work with a designer.

    Legal must-haves for business websites

    Whatever way you choose to build your website, make sure that you follow best practice in web design. From a legal standpoint, be aware of:

    Your website's privacy notices, terms and conditions, subscription forms, other opt-ins and data capture processes must all comply with the data protection rules.

    Once you decide what way you want to build your site, you will also need to:

    • develop key documentation for your site (eg terms and conditions, disclaimers, etc)
    • disclose certain information about your company on your website

    See business websites: legal requirements.

    You can also use our sample IT policies, disclaimers and notices to find free templates for your business, including our UK GDPR compliant sample privacy notice.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Content management systems
    Content category
    IT

    Source URL

    /content/different-options-building-your-website

    Links

  • Test and launch your website

    How to successfully test and launch a website, carry out staff training and what to do after the launch.

    Once you design and develop your website, you will have to carry out testing to make sure that it is ready to go live. These processes are known as 'implementation'. You will go through several phases during the implementation process.

    Provide staff training

    When you are getting your website ready for launch, you will need to train your staff on relevant procedures and maintenance tasks. You should encourage staff involvement and feedback, as staff buy-in can make or break a technology project.

    Before arranging training for your staff, you should carry out a training and learning needs analysis to ensure that your training is cost-effective and worthwhile.

    You should also consider setting up a cross-departmental task force to manage the implementation process. It will help with staff buy-in and help ensure the website is compatible with other business systems - for example, your accounts package or customer database.

    Carry out system testing

    Before putting the website live, you need to test it sufficiently. Poor testing or no testing is extremely risky. Errors that appear later can be expensive to correct - and may damage your business's reputation.

    The main purpose of testing is to assess your website's:

    • usability - can users complete the tasks easily
    • accessibility - screen readers, keyboard navigation
    • functionality - forms, payments, links
    • performance - load times, especially in periods of peak traffic
    • compatibility across different devices (mobile vs desktop) and browsers 

    See more on best practice in web design.

    Plan the launch of your website

    Choose between a soft launch (to existing customers) or a full public launch. Ahead of the launch, you will also need to consider:

    • How you will market the site - both offline and online?
    • Who will maintain the site - will you do it in-house or outsource?
    • Will your staff need any additional training to maintain the site?
    • Who will manage customer feedback and any online orders?

    Promote your website and engage with online customers

    When you launch the site, you need to encourage existing customers to use it. Ensure that you promote the web address in your marketing material and that the website is accessible through search engines. Use search marketing techniques like search engine optimisation and pay-per-click and paid search advertising to drive traffic and raise visibility of your site.

    See also how to develop a digital marketing plan.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Measure your online marketing
    IT skills and support for your staff
    Content category
    IT

    Source URL

    /content/test-and-launch-your-website

    Links

  • Website maintenance: options and requirements

    Businesses should keep their websites secure, accurate and up-to-date - here's why and how to do it.

    Maintaining your website is crucial. Regular maintenance protects customer data, maintains trust and supports search rankings. Neglect, on the other hand, leads to security breaches, errors and lost visitors. Schedule regular reviews and content updates, and allocate resources for ongoing maintenance to avoid issues.

    What to review regularly

    Reviewing your website regularly is the best way to ensure that your business website is up-to-date and error-free. You can schedule a review calendar or carry out ongoing checks to manage:

    • your content - including spelling and grammatical errors and out-of-date information
    • internal and external links - including irrelevant links, broken links or redirects
    • advertising or sponsorship banners - eg merchant's links in affiliate marketing
    • compliance with advertising rules, if applicable

    You can use many free and paid-for tools to help you maintain your website. These tools can identify broken links, missing images, spelling mistakes and other problems that can damage user confidence and adversely affect your search engine ranking.

    Content updates and website maintenance

    Keep your website content as up-to-date as possible. Archive any out-of-date content and make sure that you provide something new for your users to come back to. Fresh content will also help you secure better search engine ranking. 

    Four main options for carrying out website updates and maintenance are:

    • Do it yourself - use built-in editors, graphics software and various online validation services to maintain your site.
    • Pay for ad-hoc updates - eg to your internet service provider (ISP). This is viable if the changes are relatively infrequent. However, as your site grows it will become less cost-effective.
    • Use content management software (CMS) if your website content changes frequently. You can use such tools on their own or as part of a general maintenance contract. Some CMS tools are free, although there are many for which you may need to pay an annual fee or monthly cost.
    • Set up a maintenance agreement - with your ISP, a website developer or a digital agency. This may suit if you need to carry out regular and frequent updates to the content, monitor activities, or patch and maintain your content management software. Maintenance agreements involve a fee, usually on a monthly or quarterly basis.

    If relevant, you can use user-generated content to help keep your website engaging and up-to-date. You can integrate your social media accounts for real-time updates - see more on social media best practice for business.

    Website maintenance budget

    No matter how you decide to maintain your website, make sure that you fully budget for it. Factor in backups, security scans, content updates, hosting/domain renewals, and keep in mind that complex sites and e-commerce sites will typically require a greater budget. You may also need to allocate resources for further upgrades or redesign of the site, depending on your plans.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content marketing
    Primary parent
    Create and manage a website
    Content category
    IT

    Source URL

    /content/website-maintenance-options-and-requirements

    Links

  • Measure and benchmark your website performance

    How to monitor and benchmark the performance of your website and use this data to improve your customers' experience.

    It is important to monitor how your website performs and the way visitors use it, so you can use this data to fix issues and boost conversions.

    Performance monitoring tools

    Many websites experience slow performance, outages, content errors, transaction failures, etc. To address these problems, consider using website performance monitoring tools.

    These tools can:

    • measure the response times of specific transactions
    • pinpoint the location of bottlenecks that slow down the website (eg an application server or a network router)
    • identify the causes for slow page loading speeds (eg loading too many banners, too many high-resolution graphics files, or disk space problems)

    Many of the main search engines - such as Google, Bing and Yahoo - provide tips, advice and tools to help you improve the performance of your website.

    Monitoring website traffic and visitor behaviour

    As part of website maintenance, you should track how users find your website and what they do once they get there. Web analytics tools can help you determine:

    • how many visitors click on your pages
    • the dates and times each visitor accessed your site
    • the individual IP (internet protocol) address of each visitor's computer
    • where (what online source) did your visitor come from - eg from search, another website or social media platform
    • how many pages do they visit
    • which pages they spend the most time on
    • the type of browser, operating system or mobile device used by each visitor

    This information can help shape your content strategy, offer valuable feedback on your marketing activities, or customise features to help address visitor needs.

    You can use free services - such as Google Analytics and Bing Webmaster tools to help you monitor your website traffic, or use paid-for tools offered by your web host or specialist analytics companies. These types of tools work by adding tracking codes to your website pages that collect different types of user data, including personal data such as IP addresses.

    Website tracking and data protection

    Data protection laws affect how you as a website owner may use tracking software to monitor your website visitors. They also affect your privacy policy and the manner in which you can obtain consent from your users for setting the cookies.

    To ensure that you comply with the data protection laws, you should:

    • control how you're transmitting personal data to third parties (eg from your page URLs to Google Analytics)
    • use your analytics tool features to anonymise any IP data you collect
    • use pseudonymous identifiers, such as User ID, hashed or encrypted data or transaction IDs
    • provide transparency about the data processing on your site in your privacy information
    • follow the rules on obtaining and managing consent

    Find out more about the UK General Data Protection Regulation (GDPR).

    What is website benchmarking?

    Website benchmarking compares your site's performance against competitors and industry standards. This reveals gaps in speed, usability or conversions, helping you prioritise improvements that strengthen your market position and competitive edge.

    You can benchmark, for example, your:

    • website performance
    • search performance
    • usability performance
    • marketing performance

    Learn more about benchmarking and see how to benchmark your business performance.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content management systems
    Content category
    IT

    Source URL

    /content/measure-and-benchmark-your-website-performance

    Links

  • Set up an e-commerce website (video tutorial)

    Watch Invest Northern Ireland's video series to learn how to build an e-commerce site, from research to legal compliance.

    In the past, selling online was traditionally associated with consumer-facing retail businesses. Now, a broader range of businesses is investing in e-commerce – particularly those trading with other businesses.

    Invest Northern Ireland has produced a suite of video tutorials to outline how e-commerce could work for your business, and what benefits you can expect from selling your products and services online.

    E-commerce introduction

    This video introduces e-commerce and outlines the topics that will be discussed throughout the tutorial including online marketplaces, building an e-commerce website, digital marketing, legal and security issues and effective market research.

    E-commerce research

    This video discusses the importance of laying a firm foundation for creating your e-commerce website by conducting thorough market research and looking at your competitors, your products, target market, human resources and internal processes.

    Online marketplaces

    This video looks at online marketplaces and outlines some common ways to get your product or service in front of your customer by using online selling platforms such as eBay and Amazon. It also outlines the first things you should consider when it comes to creating your own e-commerce website.

    Digital marketing and e-commerce

    This video explains the vital role of digital marketing when it comes to selling your product or service online and explores search engine optimisation, paid advertising and social media marketing, and the importance of analytics.

    Legal and security issues with e-commerce

    The final video highlights the legal and security measures that are required when selling online to protect your business, brand and your customers. It also covers the legislation that may be relevant to your e-commerce activity.

    Actions
    Invest NI's ICT support for business
    E-commerce: Research Checklist (PDF, 83K)
    E-commerce: Online Marketplace Checklist (PDF, 83K)
    E-commerce: Digital Marketplace Checklist (PDF, 95K)
    E-commerce: Financial and Security Checklist (PDF, 72K)
    Also on this site
    Create an online shop
    Accepting online payments
    Content category
    IT

    Source URL

    /content/set-e-commerce-website-video-tutorial

    Links

Plan your website content and structure

In this guide:

  • Develop a project plan for your website

    Create a clear project plan to manage time, budget and risks when building your business website.

    Planning is an essential part of creating websites. It is often as important as website development itself. A good website project plan can help you:

    • reduce risks and possible problems during the development
    • manage your time and resources better
    • keep the focus on your project goals and objectives
    • carry out tasks with greater efficiency
    • stick to the agreed schedule and deadlines
    • improve communication with web designers and developers

    What to include in your website development project plan

    Before you start any work on the code of your website, define your website's:

    • purpose - what do you want your website to accomplish (eg find new customers, generate leads, advertise your business, sell online, etc)
    • users - who will use the website, how/when will they do it, what devices will they be using to access your site
    • structure - how you want to organise it, eg how users will navigate through the site and how different pages should be laid out
    • design - how it will look like and be used, eg elements such as logos, menu selection, etc
    • content - what information (text, image, media etc) do you want to publish on the site and who will develop, populate and maintain it
    • content management system - how you will add and edit the content on your website
    • domain name - what will be your domain name, ie your URL, and what you need to do to register it
    • web host - who will host your website and what website hosting options will best suit your needs
    • build method - will you choose an off-the-shelf template to build your site, use an online tool, or commission a web developer

    Key project elements

    A good website project plan should set out:

    • a task list - for every step of the website creation process
    • a schedule - the timeline for the completion of tasks, testing and launch
    • a budget - to cover all stages of the project (ie planning, design and development costs, any bespoke functionality you might need, as well as training, annual hosting and support costs, copywriting, etc)

    Aim to create clear and detailed specifications during the planning stage. You can break them down into planning, design and development sections in your plan. It may help to include charts to visualise your timeline and milestones.

    Useful project documents for website development

    You can search online for free or commercial website project plan templates, including task lists, project schedules and budget plans. Other documents that you might find helpful include:

    • work breakdown structure
    • feature descriptions
    • responsibility assignment matrix
    • risk register and response plan
    • project iteration and closure reviews

    See also project management templates and tools.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content management systems
    Content category
    IT

    Source URL

    /content/develop-project-plan-your-website

    Links

  • Choose and register a domain name

    How to choose the right type of domain name for your business, and how and where to register it.

    Your domain name (eg nibusinessinfo.co.uk) is your website's internet address. Choose wisely - it effectively supports your brand and business online.

    Different types of domain names for business

    There are many different types of domain names. They generally fall under one of two categories:

    • generic top-level domains (gTLDs) such as .net, .com, .org, .biz and .info
    • country code top-level domains such as .uk for the UK

    Most UK companies choose to have domain names that end in .com or .co.uk. Some Northern Ireland businesses also use .ie as another option.

    There are now hundreds of gTLDs available to register, eg .london, .company, .club, .eu. Think carefully about the geographical implications of your server and domain names, as they can affect local search results.

    Certain eligibility rules apply to ownership of .eu domain names - read about registering and renewing .eu domain names in the UK.

    What makes a good domain name

    When choosing a domain name, most businesses choose a name based on the name of their business or product. Your domain name should be:

    • short
    • easy to spell
    • easy to remember
    • relevant to your business or product

    You should avoid choosing a domain name that:

    • misuses a trade mark that belongs to another business
    • misleads users into thinking you are someone else
    • contains lots of dashes (eg my-new-website-business-and-shop.co.uk) - this looks unprofessional, is difficult to remember and some search engines may consider it to be spam

    How to register a domain name?

    You can check availability and register a domain name through an internet service provider (ISP) or a domain registration agent. See a list of ICANN accredited registrars, registrars accredited in the UK, or registrars accredited in the EU.

    You will need to pay a small fee to register your domain name. This will grant it protection for the duration of the registration period. Typical annual fees start from £10-20.

    Domains are not forever. You can't buy a domain name outright or permanently. You will have to renew your registration annually to keep ownership of your domain name. 

    It is important to understand that domain names are unique. They are allocated on a first come, first served basis, so it is possible that your preferred domain is already in use. You can check if the domain of your choice is available with registrars such as Nominet.

    Actions
    What is a domain name?
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Domain name and trade mark conflicts
    Registering and renewing .eu domain names in the UK
    Content category
    IT

    Source URL

    /content/choose-and-register-domain-name

    Links

  • Plan your website content and structure

    How to come up with content ideas, and plan, prioritise and organise information for your website.

    There are many ways to plan content and information architecture for a website. Depending on the size of your site, you may use one or more tools and techniques, such as:

    • sitemaps
    • content inventories
    • content mapping
    • card sorting
    • paper sketches

    What are sitemaps?

    Sitemap diagrams are graphic tools that can help you to:

    • visualise the relationships between pages on your website
    • ensure the right flow between pages
    • spot gaps in content
    • develop your website design around content, rather than the other way around
    • encourage team collaboration and allocation of content creation
    • identify potential issues that could affect content creation and project deadlines

    You can draw up a sitemap or a page hierarchy in a Word document, on a spreadsheet, or use one of many free tools available online. This will allow you to spot gaps, plan user journeys and assign content owners.

    See examples of sitemap documents or browse online to find more.

    Build a content inventory

    A content inventory can help you examine the scope and purpose of each page on the site. It can be time-consuming to create but useful if you are relaunching an existing site, as it will help you to:

    • record and analyse each item of content that you have
    • establish how well it performs
    • segment your content types and work out how best to present them

    Find out more about content inventory.

    Content mapping steps

    Content mapping is a visual technique that can help you plan your website content. It is a method that combines:

    • defining and analysing your business goals
    • profiling your audience and their needs
    • mapping content to goals and users
    • prioritising by hierarchy

    By carrying out these activities, you can produce content maps for your site and work out which content should feature. Content mapping can help you explore and visualise your content, and its effectiveness and root it in clearly defined business goals. You can also use simple card sorting and paper sketches to organise your content according to hierarchy. 

    When choosing your method of content planning, consider the size and type of your website. Simple brochure sites may just need sketches; complex sites benefit from full mapping.

    When to start planning content?

    Content creation takes time, a strategic approach and often many revisions. Plan it alongside design to prevent delays and cost overruns during development.

    Actions
    Content audit process
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content marketing
    Website hosting options
    Content category
    IT

    Source URL

    /content/plan-your-website-content-and-structure

    Links

  • Website layout and wireframing

    Understand what makes a good website layout and hierarchy – and how to achieve this with wireframing and good design practices.

    A good website layout and a clear hierarchy help guide users to content quickly. Poor design and layout will provide a bad user experience and prevent your customers from accessing your information, services or goods.

    As with content planning, certain techniques can help you with designing your website layout. The most common one is using wireframes.

    What are wireframes?

    Wireframes are a popular way of mapping out a website. They allow you to create a mock-up - ie a blueprint or a skeleton of the site that shows the basic elements you intend to include.

    These elements should include only the core layout, structure and organisation rather than the detailed visuals. A wireframe may comprise simply:

    • labelled boxes that illustrate the overall navigation placement
    • blocks of content that each webpage will contain
    • footer elements

    When developing your website structure, it's important to take account of web accessibility requirements, as well as your user's needs. Read about best practice in web design.

    Benefits of wireframing

    Wireframes are generally low-fidelity, basic and easy to understand. They are also quick and cheap to produce. You can draw a wireframe using Word, PowerPoint or Illustrator, or simply with a pencil and paper.

    They are also typically very easy to change, and handy to share for feedback or fine-tune with your project team or web designers. Designers tend to use wireframes to show the navigation flow between the different screens. Developers may use them to get a better understanding of the core functionalities of the site.

    From wireframe to a prototype

    Wireframes don't contain real content, so establishing the final layout of the screen may be difficult. However, wireframes often evolve into more functional prototypes.

    Prototypes offer greater fidelity with regard to the design of your website. They provide more visual detail and can include user interaction functionality. A prototype should represent the final product as closely as possible.

    You can use a prototype to test, demonstrate and validate the functionality of your website design before full development. See how to test and launch your website.

    Actions
    What is a website wireframe?
    Invest NI's ICT support for business
    Also on this site
    Content marketing
    Website hosting options
    Content category
    IT

    Source URL

    /content/website-layout-and-wireframing

    Links

  • Different options for building your website

    An overview of different web development options, including building the website yourself, using templates or hiring someone else to build it for you.

    There are many ways to build a website. Depending on your skills and budget restrictions, you can build it yourself, use templates or 'site builder' tools, or hire a web designer to build it for you.

    Build a website yourself

    Building a website from scratch is generally only an option if you have:

    • good technical knowledge, especially of HTML
    • a web-building application or software, such as Adobe Dreamweaver
    • staff in-house who have the skills and the expertise required

    HTML is the foundation of building websites. Even if you rely on web-building tools, some degree of HTML knowledge will likely be necessary to help you carry out the project. Be realistic about the skills of those involved and seek advice from IT professionals if you need it.

    Use templates or 'site builder' tools

    There are many great options for using templates or online tools for building websites. This method usually allows you to:

    • create a website quickly and easily (often via 'drag and drop' modules)
    • choose from thousands of themes and designs
    • customise different elements, such as navigation and page layout
    • use plugins for added functionality or features of the site

    All you need to do is choose your template and add your content, and your website is generally ready to go. Web design or web hosting companies typically offer different packages and template options at different prices. They are usually more affordable than commissioning a designer and can include a one-off charge or monthly/annual payments.

    Hire a web designer or an agency

    You don't have to have a huge budget to be able to work with a web designer or an agency.

    The expertise that they will bring to the project will likely be worth the extra cost, as they will be able to guide you through the whole process - from planning to launch.

    To make sure you're happy with the results, brief the designer carefully and agree in advance on the key issues around the project. See how to choose and work with a designer.

    Legal must-haves for business websites

    Whatever way you choose to build your website, make sure that you follow best practice in web design. From a legal standpoint, be aware of:

    Your website's privacy notices, terms and conditions, subscription forms, other opt-ins and data capture processes must all comply with the data protection rules.

    Once you decide what way you want to build your site, you will also need to:

    • develop key documentation for your site (eg terms and conditions, disclaimers, etc)
    • disclose certain information about your company on your website

    See business websites: legal requirements.

    You can also use our sample IT policies, disclaimers and notices to find free templates for your business, including our UK GDPR compliant sample privacy notice.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Content management systems
    Content category
    IT

    Source URL

    /content/different-options-building-your-website

    Links

  • Test and launch your website

    How to successfully test and launch a website, carry out staff training and what to do after the launch.

    Once you design and develop your website, you will have to carry out testing to make sure that it is ready to go live. These processes are known as 'implementation'. You will go through several phases during the implementation process.

    Provide staff training

    When you are getting your website ready for launch, you will need to train your staff on relevant procedures and maintenance tasks. You should encourage staff involvement and feedback, as staff buy-in can make or break a technology project.

    Before arranging training for your staff, you should carry out a training and learning needs analysis to ensure that your training is cost-effective and worthwhile.

    You should also consider setting up a cross-departmental task force to manage the implementation process. It will help with staff buy-in and help ensure the website is compatible with other business systems - for example, your accounts package or customer database.

    Carry out system testing

    Before putting the website live, you need to test it sufficiently. Poor testing or no testing is extremely risky. Errors that appear later can be expensive to correct - and may damage your business's reputation.

    The main purpose of testing is to assess your website's:

    • usability - can users complete the tasks easily
    • accessibility - screen readers, keyboard navigation
    • functionality - forms, payments, links
    • performance - load times, especially in periods of peak traffic
    • compatibility across different devices (mobile vs desktop) and browsers 

    See more on best practice in web design.

    Plan the launch of your website

    Choose between a soft launch (to existing customers) or a full public launch. Ahead of the launch, you will also need to consider:

    • How you will market the site - both offline and online?
    • Who will maintain the site - will you do it in-house or outsource?
    • Will your staff need any additional training to maintain the site?
    • Who will manage customer feedback and any online orders?

    Promote your website and engage with online customers

    When you launch the site, you need to encourage existing customers to use it. Ensure that you promote the web address in your marketing material and that the website is accessible through search engines. Use search marketing techniques like search engine optimisation and pay-per-click and paid search advertising to drive traffic and raise visibility of your site.

    See also how to develop a digital marketing plan.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Website hosting options
    Measure your online marketing
    IT skills and support for your staff
    Content category
    IT

    Source URL

    /content/test-and-launch-your-website

    Links

  • Website maintenance: options and requirements

    Businesses should keep their websites secure, accurate and up-to-date - here's why and how to do it.

    Maintaining your website is crucial. Regular maintenance protects customer data, maintains trust and supports search rankings. Neglect, on the other hand, leads to security breaches, errors and lost visitors. Schedule regular reviews and content updates, and allocate resources for ongoing maintenance to avoid issues.

    What to review regularly

    Reviewing your website regularly is the best way to ensure that your business website is up-to-date and error-free. You can schedule a review calendar or carry out ongoing checks to manage:

    • your content - including spelling and grammatical errors and out-of-date information
    • internal and external links - including irrelevant links, broken links or redirects
    • advertising or sponsorship banners - eg merchant's links in affiliate marketing
    • compliance with advertising rules, if applicable

    You can use many free and paid-for tools to help you maintain your website. These tools can identify broken links, missing images, spelling mistakes and other problems that can damage user confidence and adversely affect your search engine ranking.

    Content updates and website maintenance

    Keep your website content as up-to-date as possible. Archive any out-of-date content and make sure that you provide something new for your users to come back to. Fresh content will also help you secure better search engine ranking. 

    Four main options for carrying out website updates and maintenance are:

    • Do it yourself - use built-in editors, graphics software and various online validation services to maintain your site.
    • Pay for ad-hoc updates - eg to your internet service provider (ISP). This is viable if the changes are relatively infrequent. However, as your site grows it will become less cost-effective.
    • Use content management software (CMS) if your website content changes frequently. You can use such tools on their own or as part of a general maintenance contract. Some CMS tools are free, although there are many for which you may need to pay an annual fee or monthly cost.
    • Set up a maintenance agreement - with your ISP, a website developer or a digital agency. This may suit if you need to carry out regular and frequent updates to the content, monitor activities, or patch and maintain your content management software. Maintenance agreements involve a fee, usually on a monthly or quarterly basis.

    If relevant, you can use user-generated content to help keep your website engaging and up-to-date. You can integrate your social media accounts for real-time updates - see more on social media best practice for business.

    Website maintenance budget

    No matter how you decide to maintain your website, make sure that you fully budget for it. Factor in backups, security scans, content updates, hosting/domain renewals, and keep in mind that complex sites and e-commerce sites will typically require a greater budget. You may also need to allocate resources for further upgrades or redesign of the site, depending on your plans.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content marketing
    Primary parent
    Create and manage a website
    Content category
    IT

    Source URL

    /content/website-maintenance-options-and-requirements

    Links

  • Measure and benchmark your website performance

    How to monitor and benchmark the performance of your website and use this data to improve your customers' experience.

    It is important to monitor how your website performs and the way visitors use it, so you can use this data to fix issues and boost conversions.

    Performance monitoring tools

    Many websites experience slow performance, outages, content errors, transaction failures, etc. To address these problems, consider using website performance monitoring tools.

    These tools can:

    • measure the response times of specific transactions
    • pinpoint the location of bottlenecks that slow down the website (eg an application server or a network router)
    • identify the causes for slow page loading speeds (eg loading too many banners, too many high-resolution graphics files, or disk space problems)

    Many of the main search engines - such as Google, Bing and Yahoo - provide tips, advice and tools to help you improve the performance of your website.

    Monitoring website traffic and visitor behaviour

    As part of website maintenance, you should track how users find your website and what they do once they get there. Web analytics tools can help you determine:

    • how many visitors click on your pages
    • the dates and times each visitor accessed your site
    • the individual IP (internet protocol) address of each visitor's computer
    • where (what online source) did your visitor come from - eg from search, another website or social media platform
    • how many pages do they visit
    • which pages they spend the most time on
    • the type of browser, operating system or mobile device used by each visitor

    This information can help shape your content strategy, offer valuable feedback on your marketing activities, or customise features to help address visitor needs.

    You can use free services - such as Google Analytics and Bing Webmaster tools to help you monitor your website traffic, or use paid-for tools offered by your web host or specialist analytics companies. These types of tools work by adding tracking codes to your website pages that collect different types of user data, including personal data such as IP addresses.

    Website tracking and data protection

    Data protection laws affect how you as a website owner may use tracking software to monitor your website visitors. They also affect your privacy policy and the manner in which you can obtain consent from your users for setting the cookies.

    To ensure that you comply with the data protection laws, you should:

    • control how you're transmitting personal data to third parties (eg from your page URLs to Google Analytics)
    • use your analytics tool features to anonymise any IP data you collect
    • use pseudonymous identifiers, such as User ID, hashed or encrypted data or transaction IDs
    • provide transparency about the data processing on your site in your privacy information
    • follow the rules on obtaining and managing consent

    Find out more about the UK General Data Protection Regulation (GDPR).

    What is website benchmarking?

    Website benchmarking compares your site's performance against competitors and industry standards. This reveals gaps in speed, usability or conversions, helping you prioritise improvements that strengthen your market position and competitive edge.

    You can benchmark, for example, your:

    • website performance
    • search performance
    • usability performance
    • marketing performance

    Learn more about benchmarking and see how to benchmark your business performance.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Best practice in web design
    Content management systems
    Content category
    IT

    Source URL

    /content/measure-and-benchmark-your-website-performance

    Links

  • Set up an e-commerce website (video tutorial)

    Watch Invest Northern Ireland's video series to learn how to build an e-commerce site, from research to legal compliance.

    In the past, selling online was traditionally associated with consumer-facing retail businesses. Now, a broader range of businesses is investing in e-commerce – particularly those trading with other businesses.

    Invest Northern Ireland has produced a suite of video tutorials to outline how e-commerce could work for your business, and what benefits you can expect from selling your products and services online.

    E-commerce introduction

    This video introduces e-commerce and outlines the topics that will be discussed throughout the tutorial including online marketplaces, building an e-commerce website, digital marketing, legal and security issues and effective market research.

    E-commerce research

    This video discusses the importance of laying a firm foundation for creating your e-commerce website by conducting thorough market research and looking at your competitors, your products, target market, human resources and internal processes.

    Online marketplaces

    This video looks at online marketplaces and outlines some common ways to get your product or service in front of your customer by using online selling platforms such as eBay and Amazon. It also outlines the first things you should consider when it comes to creating your own e-commerce website.

    Digital marketing and e-commerce

    This video explains the vital role of digital marketing when it comes to selling your product or service online and explores search engine optimisation, paid advertising and social media marketing, and the importance of analytics.

    Legal and security issues with e-commerce

    The final video highlights the legal and security measures that are required when selling online to protect your business, brand and your customers. It also covers the legislation that may be relevant to your e-commerce activity.

    Actions
    Invest NI's ICT support for business
    E-commerce: Research Checklist (PDF, 83K)
    E-commerce: Online Marketplace Checklist (PDF, 83K)
    E-commerce: Digital Marketplace Checklist (PDF, 95K)
    E-commerce: Financial and Security Checklist (PDF, 72K)
    Also on this site
    Create an online shop
    Accepting online payments
    Content category
    IT

    Source URL

    /content/set-e-commerce-website-video-tutorial

    Links

What is broadband?

In this guide:

  • What is broadband?

    An introduction to broadband internet technologies, and how they work to enable online connectivity.

    Broadband is a general term for a permanent, high-speed connection to the internet. It describes any telecommunications technology that allows for a transfer of large amounts of data using either:

    • fixed telephone lines, eg DSL (digital subscriber line), cable and fibre optic technologies
    • wireless access, eg Wi-Fi networks, Wi-Max, mobile and satellite technologies

    Is broadband Wi-Fi?

    No. Broadband is a term for a fast connection to the internet. Broadband can use wired or wireless technology.

    Wi-Fi is simply a means of getting broadband without having to connect through wires. It uses radio wave technology as an alternative to network cables to provide connectivity.

    How does broadband work?

    A broadband connection, like a telephone line, is 'always on'. This means that, once you have switched on your computer or mobile device, you are connected and you can access the internet at any time.

    Unlike the traditional 'dial-up' method, which has become largely redundant, broadband doesn't affect the phone line. This means that you are free to receive and make calls while online.

    Most commonly, broadband is provided over your phone line, via cable or via satellite. You can also have broadband access via mobile networks. Read about the different types of broadband connections.

    How much does broadband cost?

    Broadband packages vary greatly, depending on the provider, the location of your premises and the services you need.

    Normally, you pay a standard monthly fee to your provider for unlimited internet access, although certain broadband products may offer pay-as-you-go access.

    Actions
    What is broadband?
    What is Wi-Fi?
    Invest NI’s ICT support for business
    Also on this site
    Choose an internet service provider for your business
    Plan your business IT systems
    Computer networking
    Content category
    IT

    Source URL

    /content/what-broadband

    Links

  • Types of broadband connections

    An overview of the most common types of broadband connections, and the options available to your business.

    There are several types of broadband connections available. The location of your business may determine the type of connection you can access.

    ADSL (asymmetric digital subscriber line)

    ADSL is a common broadband technology available in the UK but, where available, it is being replaced with faster Fibre to the cabinet (FTTC) and Fibre to the premises (FTTP) internet connections. ADSL uses existing analogue telephone lines and can deliver download speeds from 0.5 Mbps up to 24 Mbps. Maximum upload speeds generally range from 0.25Mbps up to 1Mbps.

    The exact speed of ADSL connection will depend on:

    • length and quality of the phone line between your premises and the telephone exchange
    • if the exchange has been upgraded to offer newer, faster services

    If you are a small office or sole trader, a basic business ADSL line may be enough to meet your needs. Growing businesses or those relying on, for example, online sales or cloud storage, may want to consider faster connections such as fibre broadband for business.

    Cable broadband

    Broadband services are often available via cable TV operators using high-speed fibre optic networks. Most cable companies offer bundled packages that include telephone, broadband connection and TV channels.

    Wireless access

    In areas where broadband is not possible via telephone or cable, it may be available using wireless technology. Local Wi-Fi hotspots are common in airports, hotels, cafes, pubs and motorway service stations. Some operators also offer mobile phone style 'roaming' facilities.

    Worldwide interoperability for microwave access (Wi-max) is a fast-emerging alternative to Wi-Fi and makes it possible to provide broadband to areas where other technology is unsuitable.

    Satellite broadband

    Businesses in remote areas where ADSL, cable or wireless are not possible can access the internet by satellite. Download and upload speeds may vary, but faster speeds and more competitive deals are increasingly becoming available. There are also new satellite internet services using clusters of low earth orbiting satellites offering fast speeds and low latency.

    Mobile broadband

    Mobile broadband enables you to wirelessly connect a portable computer to the internet using the 3G, 4G or 5G mobile phone network. Mobile broadband can be useful for those working on the move. However, download speeds can be slow and coverage is not universal, especially in rural areas.

    Leased lines

    Larger businesses or those with specialist data needs may want to think about a dedicated 'point-to-point' leased line connection. This can provide higher bandwidths for both uploading and downloading, and better security and privacy over a line used exclusively by the purchasing business.

    Each type of connection has its advantages and disadvantages. You should consider your options carefully and think about:

    • your location, as not all broadband deals will be available in your area
    • your current and future usage needs, including bandwidth and speed
    • your budget, including setup fees, monthly line rental and contract terms and fees

    Read about the advantages of business broadband.

    Actions
    What is broadband?
    Fibre broadband
    Invest NI’s ICT support for business
    Also on this site
    Choose an internet service provider for your business
    Plan your business IT systems
    Computer networking
    Content category
    IT

    Source URL

    /content/types-broadband-connections

    Links

  • Advantages of business broadband

    What are the benefits of business broadband, and how can the right broadband package improve the running of your business.

    If you are running a small business or working from home, you may be using your home broadband connection to get on the internet. Business packages are often more reliable and may offer more security if internet access is critical to your business.

    Business broadband vs home broadband

    Business broadband often offers:

    • better data transfer capabilities - eg more generous or unlimited upload and download allowances, and higher upload speeds than home broadband
    • faster connection speeds - some packages offer priority to business users over the network at peak times
    • lower contention ratio - ie the number of other internet users sharing a server with you is generally lower allowing for greater connection speeds
    • greater efficiency - eg streamlining and automating online tasks, such as linking your online shop with the stock control system, transaction processing, order tracking and stock reordering
    • static IP addresses - needed for businesses looking to host their own servers, eg for emails, CCTV systems, website hosting or remote connections via the internet
    • tech support - eg service level agreements guaranteeing fix time and priority engineer support
    • additional services - tailored to specific needs of your business, eg email services, data management, upgrades, backup plans, recovery, cloud services, etc

    Other benefits of business broadband

    Business broadband usually costs more than home packages. However, it is worth weighing the cost against the advantages. A reliable, robust connection can:

    • get you closer to your customers and suppliers, with round-the-clock access to account information, order status and project details
    • enable you to respond to customers' email queries or website orders within minutes
    • ensure that communications channels, such as email and video conferencing systems, remain open between you and your staff

    A broadband connection that suits the particular needs of your business can help you become more flexible and more able to adapt to your staff, customer and supplier needs.

    If you're not sure which internet access technology would be best suited to your business, read about the different types of broadband connections.

    If you think you may not require a specialised business broadband connection, an alternative may be using home broadband for business.

    Actions
    What is broadband?
    Invest NI's ICT support for business
    Gigabit Broadband Voucher Scheme
    Also on this site
    Benefits of email and the internet
    Choose an internet service provider for your business
    Wireless technology
    Content category
    IT

    Source URL

    /content/advantages-business-broadband

    Links

  • Fibre broadband for business

    What is fibre optic broadband, and what types of fibre broadband connections are available to your business.

    Fibre broadband uses the latest fibre optic technology to provide faster speeds and more reliable internet service.

    Types of fibre broadband connections

    There are generally two types of fibre broadband connections:

    Fibre to the cabinet (FTTC) speed

    FTTC uses fibre optic cable to connect the telephone exchange or distribution point to your phone line in the street cabinet that serves your premises. From the cabinet, your signal travels to your premises via traditional copper lines.

    FTTC can typically achieve maximum 80Mbps download speeds, and 20Mbps upload speeds, although the actual maximum speed of your connection will depend on the length of your phone line to the street cabinet.

    Fibre to the premises (FTTP) speed

    FTTP connections provide end-to-end fibre optic connection from the exchange or the service provider's fibre network to your premises. They can deliver the fastest speeds, reaching download speeds of 1000Mbps and upload speeds of 300Mbps or more. They are usually limited to premises near the telephone exchange or fibre network. The main telecom operators in NI have plans to significantly increase availability of FTTP across NI so it is always worth checking availability.

    G.Fast

    At present, only a small number of providers offer packages using the hybrid G.Fast technology as it is only available to a limited number of FTTC subscribers around the UK.

    G.Fast uses fibre optic cables from the exchange to the street cabinets, where a device is fitted that increases the maximum broadband speed users can get via their existing copper cables to be greater speeds than standard FTTC technology.

    G.Fast can deliver speeds of up to 330Mbps download and 50Mbps upload, depending on the length and quality of the phone line between the premises at the street cabinet. It operates best over a short run of copper cable, ideally less than 350 meters from the cabinet. 

    Benefits of fibre broadband to business

    With faster speeds and increased reliability, fibre broadband connections can make your business run more efficiently and be more profitable. It can help you:

    • Get more done. Faster speeds mean you and your staff can do more bandwidth-heavy tasks simultaneously (eg send and receive large files, images and video) without experiencing slowdowns.
    • Reach new markets. Fast, reliable speeds make online marketing easier and enable you to instantly communicate with customers in your area and across the world using social media, email marketing or via an online shop hosted on your website.
    • Stay in touch with people who matter. Connect with customers and suppliers quicker and in new ways, eg through VoIP (voice over internet protocol) telephony and video conferencing. 
    • Make use of cloud computing. Take advantage of hosted applications, such as instant data backups, to reduce equipment, software and licensing costs. Pay only for what you use.
    • Work remotely. Work from home or on the go, with the same efficiency as if you were working from the office.
    • Cut costs. Online data storage can save you space and money on physical storage systems

    Find superfast fibre broadband providers in Northern Ireland.

    Gigabit Broadband Voucher Scheme

    The government is providing voucher funding to help eligible businesses experiencing slow broadband speeds in rural areas. The vouchers are worth up to £4,500 to help cover the costs of installing gigabit broadband. Read more about the Gigabit Broadband Voucher Scheme.

    Actions
    Fibre broadband
    Invest NI's ICT support for business
    Also on this site
    Wireless technology
    Mobile technology
    Plan your business IT systems
    Content category
    IT

    Source URL

    /content/fibre-broadband-business

    Links

  • Using home broadband for business

    Difference between business broadband and home broadband, and advantages of using home broadband for your business.

    Not every business requires a specialised business broadband connection. Some may be able to use their home broadband service, especially if their requirements are limited.

    Broadband products are generally similar for domestic and corporate users. They rely on the same technology and infrastructure, but commercial businesses typically have different needs to the average domestic user.

    It is important to consider your specific needs and the type and nature of your business when you're choosing a broadband package for your company.

    Do I need business broadband?

    If you're working from home temporarily or occasionally, in most cases your normal home broadband should be sufficient.

    However, keep in mind that a home broadband package is designed for personal use. It often comes with a number of restrictions that businesses may find disadvantageous.

    If you are a small business, a start-up or a sole trader, and you are working from home more permanently, a home broadband package would only be a suitable option if:

    • you don't use the internet frequently and at very specific times
    • internet access is not vital to your business operations
    • any 'downtime' or 'slowdown' would not significantly affect the survival or profitability of your business
    • you don't need large data transfers (eg uploading or downloading of large files) to conduct their business operations

    If you are a larger business, or a small business relying on a dependable, secure internet connection, then business broadband might be a better option for you.

    Key reasons for getting business broadband

    Business packages generally offer faster connection speeds, greater data transfer allowances, static IP addresses and usually more service reliability with better service level targets.

    These features may come at a greater price, but they may help you run your business more efficiently. Read more on the advantages of business broadband.

    Claiming business expenses if you're using home broadband

    If you use home broadband for your business, you may be able to reclaim some cost if:

    • you use it for business purposes
    • the broadband contract is undertaken in the name of your company
    • the service is provided at home but paid for directly by the company

    However, you are unlikely to be able to seek reimbursement if:

    • you already have a broadband account in your personal name
    • you are already paying for the connection
    • you cannot split the business and personal use each month

    Find out more about reimbursing broadband internet charges.

    Actions
    Invest NI’s ICT support for business
    Also on this site
    Use your home as a workplace
    Employees working from home
    Mobile technology
    Content category
    IT

    Source URL

    /content/using-home-broadband-business

    Links

  • Broadband security and your business

    An overview of the threats to your broadband, and the steps you can take to reduce the risks to your business.

    Broadband provides an 'always-on' connection. This increases the security risks that your business network or equipment could become exposed to, such as viruses or hackers.

    These risks could potentially be disastrous for your business. They could compromise your critical data, and lead to loss or theft of valuable information.

    Is business broadband more secure than home broadband?

    Business broadband packages most often come with better security options and more proactive measures than home broadband, to ensure that your data and network remain secure. Your internet service provider (ISP) can include, as an integral part of their offering, a range of security systems such as:

    • network-wide email screening service
    • anti-virus / anti-malware software and hardware firewall to intercept malicious attacks
    • off-site data backup solution

    Find out more about common network security issues.

    How to secure your broadband connection

    You can take some basic steps to reduce the risks to your broadband. For example, you can:

    • install additional security software or an enhanced hardware firewall to your system
    • keep your operating system, firewall, virus protection and other software up to date
    • draw up and enforce policies for employee email/internet use

    You should check which security options are available to you as part of your package, or at additional cost, from your ISP. Alternatively, you can consult an independent security expert.

    You can also read more about securing your wireless network and find out how to protect your business online.

    Actions
    Invest NI's ICT support for business
    GOV.UK's cyber security guidance
    NCSC's 10 steps to cyber security
    Also on this site
    Cyber security for business
    IT risk management
    Protect your business from ransomware
    Content category
    IT

    Source URL

    /content/broadband-security-and-your-business

    Links

Protect your business against phishing

In this guide:

  • Common cyber security measures

    Essential cyber security measures for small businesses to prevent, detect and respond to cyber attacks.

    Cyber security measures are simple steps and tools that protect your business data, systems and customers from online attacks. They help prevent problems stemming from:

    • Internet threats, such as spyware or malware
    • weak passwords or lost devices
    • software bugs and vulnerabilities
    • misuse of systems and features

    For small businesses, the National Cyber Security Centre (NCSC) suggests core measures such as firewalls, secure configuration, access control, malware protection and patch management. These block 80% of common attacks and make your business harder to target.

    Essential steps for cyber security

    These seven steps are easy to implement and provide basic protection for most businesses to defend against common threats.

    1. Maintain password security

    Strong passwords are vital to good online security. Create passwords that are:

    • at least 12 characters long
    • a mix of upper- and lower-case letters, numbers and symbols
    • free of personal information (like names and birthdays)

    Protect them further by:

    • changing passwords regularly
    • never using them for multiple accounts
    • always using two-factor authentication (2FA)

    Create a business password policy to make sure all staff follow these rules consistently. It prevents weak or reused passwords across your team, reduces the risk of accounts being hacked, and makes enforcement easier through tools like scheduled resets or password managers. A clear policy also helps during staff training and audits.

    For more advice, see the National Cyber Security Centre's (NCSC) password guidance.

    2. Control access to data and systems

    Give staff access to only the data and services they need for their role. This is called 'least privilege' and stops attackers moving through your systems if one account is compromised. Key actions include:

    • locking premises and restricting physical access to devices and servers
    • blocking unauthorised users with login controls
    • using application settings to limit access to sensitive data
    • restricting data copying to USB drives or email attachments
    • using modern operating systems with built-in access controls

    For more information, read NCSC's identity and access management guidance.

    3. Use firewalls

    Firewalls act as a barrier between your devices and the internet, blocking viruses and malware by filtering incoming and outgoing traffic. You should:

    • enable built-in firewalls on every device and server
    • configure rules to block risky ports and untrusted traffic
    • check settings and update firmware regularly
    • use hardware firewalls (in routers) for network-wide protection
    • test firewall logs for blocked threats

    Outdated firewalls are a common weak point, as many attacks exploit known firmware bugs. See server security guidance for more advice on advanced setups.

    4. Install security software

    Install anti-spyware, anti-malware and anti-virus tools on all devices to help detect and remove threats that get past other defences. You should:

    • choose reputable, business-grade security software
    • enable real-time scanning and automatic updates
    • run full system scans weekly
    • review quarantine logs regularly for blocked threats

    Keep any security software up-to-date with the latest patches. See guidance on detecting spam, malware and virus attacks.

    5. Keep software updated

    Install security updates promptly to fix known bugs and vulnerabilities. Outdated software is one of the most common ways criminals break into businesses. As basic precautions, you should:

    • enable automatic updates for operating systems, browsers and apps
    • check monthly for updates on all devices and servers
    • prioritise critical security patches
    • restart devices after updates to apply changes fully

    Enable automatic updates wherever possible – they close security gaps before criminals can exploit them.

    6. Monitor for intrusions

    Use intrusion detection systems or security information and event management tools to monitor systems for any unusual network activity. These generate alerts, often via email, when they detect a potential security breach. Early detection can limit damage so:

    • set up alerts for suspicious logins, data transfers or traffic spikes
    • review logs weekly and investigate any warnings
    • start with free tools like OS built-in logging if budget is tight

    See more on cyber security breach detection.

    7. Train your staff

    Train employees to recognise cyber risks and follow your security policies. Since people cause most breaches through simple mistakes, training reduces this risk significantly and your staff should understand their role in helping to keep your business secure. At a minimum, you should:

    • explain to staff their role in keeping business data safe
    • train them on any relevant policies and procedures
    • run regular awareness sessions (quarterly minimum)
    • test staff with simulated phishing emails
    • update training when new threats emerge

    See insider threats in cyber security for common staff-related risks and solutions.

    Test your defences

    Follow government best practices and free NCSC tools to check your security:

    These resources will help close common gaps fast and build confidence in your security.

    Actions
    Cyber security: small business guide
    NCSC: 10 steps to cyber security
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Securing your wireless network
    Content category
    IT

    Source URL

    /content/common-cyber-security-measures

    Links

  • Server security best practices

    How to use firewalls, data encryption and server hardening to secure your business servers and network from cyber attacks.

    Servers are powerful computers that host services like email, websites or file sharing. They process requests from other devices and deliver data to them, often running 24/7. Cyber criminals target them because they often hold sensitive business data.

    What is server security?

    Server security protects data and resources on your servers from intrusions, hacking and other malicious actions. Defences are often layered and cover:

    • the operating system and critical services
    • applications and content hosted on the server
    • network protection against online threats

    Insecure servers create significant business risks like data theft and network-wide attacks.

    How to secure your servers

    Securing large, complex servers may require specialist skills. However, any business using a server should be aware of the risks and - at the very least - use basic cyber security measures.

    Physical security 

    If you are not using a secure data centre to host your servers, you should:

    • keep them in locked rooms
    • restrict access to authorised staff only
    • monitor security logs regularly
    • check for environmental risks, eg overheating and fire
    • ensure stable power supply

    Like desktop PCs, servers need firewalls, regular backups and software updates, reliable anti-malware protection, and ongoing support and maintenance.

    Network firewall security

    Firewalls filter all incoming and outgoing traffic to your network. They block threats and can:

    • prevent malicious email relay
    • stop malware downloads
    • restrict access to risky websites or services

    Hardware firewall

    Hardware firewall is built into broadband routers. It protects your whole network from unauthorised external access and is usually effective even with minimal configuration.

    Software firewall

    Software firewall is installed on individual devices. It is often part of the operating system and usually needs greater configuration of settings and applications controls.

    Server hardening

    Default server settings are rarely secure. They can leave systems exposed to known threats with default passwords, open ports and unnecessary services running. Server hardening is a security process that addresses these risks. It strengthens servers by removing known vulnerabilities, including:

    • encrypting data transmissions
    • disabling unnecessary services - unused ports, protocols and software
    • applying security patches and updates regularly
    • enforcing complex passwords and access control
    • locking accounts after failed logins
    • using intrusion detection
    • backing up data and systems regularly

    The National Cyber Security Centre has detailed guidance to help you secure your server.

    Cloud servers as an alternative

    Cloud servers provide an alternative (often a cost-effective one) to on-premises setups by hosting services on remote infrastructure through Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS) models.

    In SaaS and PaaS, the cloud provider will typically be expected to configure and maintain servers for you, including patching, security hardening, and implementing security functions like logging and auditing.

    With IaaS, you will be responsible for server security, including server hardening, access controls and compliance with UK rules, just as you would with traditional, on-premise servers.

    Actions
    Cyber security: small business guide
    Cloud security principles
    Cyber Essentials scheme
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Securing your wireless network
    Content category
    IT

    Source URL

    /content/server-security-best-practices

    Links

  • Detect spam, malware and virus attacks

    How to detect virus, malware or spam attacks, and what to do if your business has been affected.

    Spam, viruses and other malware can seriously disrupt your business. The sooner you spot an attack, the faster you can limit the damage and recover your systems.

    How to detect spam

    Spam is unwanted email. It makes up a large share of email traffic, and many providers now filter it automatically.

    Spam filters can:

    • block suspicious messages before they reach inboxes
    • move likely spam into a separate folder or mailbox
    • reduce the risk of staff clicking on malicious link or attachment

    To securely manage your inbox, use good spam filtering and follow phishing advice to reduce risk.

    How to detect a virus or malware

    Common signs of a virus or malware infection include:

    • system slowing down
    • unexpected activity on your machine or pop-up messages
    • email server becoming overloaded or unreliable
    • data files becoming corrupt, going missing or changing
    • strange messages being sent from your accounts

    If you notice these signs, use your security software to investigate the issue. Your software provider may also be able to help. Read more about cyber security breach detection.

    How to recover from a virus or malware

    If a virus or malware infection has affected your business, follow these five steps:

    1. Tell everyone who needs to know

    If the virus is spread through email, tell everyone with an email account on the infected system as quickly as possible. If there is a specific file attachment that contains the malicious virus program, name it.

    2. Disconnect affected devices

    As soon as possible, disconnect infected computers from any internal or external networks to stop malware spreading further. Do not reconnect until after you remove the threats.

    3. Clean the system

    Run anti-virus or anti-malware scans across affected devices to detect and remove infections. If scans fail to remove the threat, restore files from a recent clean backup. In some cases, you may need to wipe the infected device completely, reinstall the operating systems, and recover data from confirmed pre-infection backups.. If necessary, contact your software supplier for specific advice.

    4. Prevent re-infections

    Carry out emergency security measures and inform users that clean-up is underway. Apply all available patches and updates to fix known security gaps and close vulnerabilities that could allow re-infection. Change all passwords, including for unused accounts, as malware may have stollen credentials. Enable firewalls and real-time protection tools, and scan removable media like USB drives before use.

    5. Control email traffic during the crisis

    Use whatever facilities you have to prevent the virus spreading further. Scan inbound and outbound traffic for malware, and disable auto-forwarding or previews. Consider temporarily pausing outgoing email until systems are clean, and direct staff to use secure alternatives like phone or encrypted chat for urgent needs.

    Prepare your business for a cyber attack

    Cyber attacks are almost inevitable, so the speed at which you react to an incident is critical. Find tips to help you plan, develop and test a cyber security incident response plan.

    You can also read the National Cyber Security Centre’s (NCSC) guidance on recovering an infected device and use their tools to strengthen your defences:

    Finally, stay informed via NCSC's cyber threat alerts or subscribe to their Early Warning Service for updates on potential cyber attacks that could affect your business network.

    Actions
    Cyber security: small business guide
    Mitigating malware & ransomware
    Cyber incident response & recovery
    Free Cyber Action Plan
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Protect your business from ransomware
    Content category
    IT

    Source URL

    /content/detect-spam-malware-and-virus-attacks

    Links

  • Protect your business against phishing

    Find out how phishing, spear phishing and related scams work and how to protect your business against them.

    Phishing is one of the most common types of cyber crime in the UK. It targets businesses regardless of their size or sector.

    What is phishing?

    Phishing is a cyber attack that often starts with email. Criminals send fake messages that try to get people to:

    • provide sensitive information, such as passwords and bank details
    • send money to individuals or organisations
    • download malware onto a device

    These emails often contain malicious attachments or link to fake websites designed to steal data.

    Phishing can also happen by:

    • phone, known as vishing
    • text message, known as smishing
    • social media

    Social media phishing usually involves:

    • fake social media accounts that impersonate known or trusted people
    • fake customer support accounts to impersonate brands
    • click-bait posts that include malicious links
    • fake surveys, promotions or contests to get personal information

    See Get Safe Online tips to help you avoid social media phishing.

    Targeted phishing attacks

    Phishing emails are not always random. Standard phishing uses mass emails sent to many people indiscriminately, often with generic content to catch a few victims. However, some phishing attacks - like spear phishing and whale phishing - can target specific people or organisations by creating convincing, personalised messages. 

    Spear phishing

    These emails pretend to come from a trusted or familiar source, like a colleague or a supplier. Attackers research their target to make messages look legitimate. This method is known as social engineering - it increases the chances of tricking the target into sharing sensitive information or clicking harmful links.

    Whale phishing (also known as whaling)

    These emails use the same personalised tricks but target high-profile individuals, such as celebrities, politicians or C-level executives. Attackers use highly personalised emails that mimic trusted contacts, often referencing private details gathered from social media or public records to build credibility.

    Evolving threats: AI and Deepfakes

    Attackers now use artificial intelligence (AI) to make phishing more convincing. AI tools create:

    • highly personalised emails or messages that mimic real colleagues or suppliers
    • deepfake videos or audio impersonating executives (eg a fake video call from your CEO requesting urgent payment)

    Deepfakes use AI to swap faces or voices, making scams harder to spot. Look for unnatural eye movements, inconsistent lighting, lip-sync issues, or robotic voice tones in video/audio calls. If in doubt, test with simple questions only the real person would know.

    While not yet common against small businesses, cheap AI tools mean these threats are likely to grow. It is important to train staff to verify unusual requests ( eg for payment or data sharing) using multiple channels - for example, using a known phone number or in-person check, instead of a reply-all or provided contacts.

    Read the National Cyber Security Centre’s (NCSC) blog to find out more about targeted forms of phishing.

    How to spot fake websites

    Fraudulent websites can be difficult to identify. They often copy real brands, banks, government services, email provides, IT service providers, online marketplaces, money transfer websites and social networks. Once you enter information into fake sites, criminals can steal it and use it to commit identity or financial fraud.

    Common warning signs that you are on a fake website include:

    • a different URL address from the one you expected or clicked on
    • urgent language or pressure to act quickly
    • requests for personal or financial information, such as account or social security numbers
    • spelling errors, unusual navigation or poor design
    • suspicious ads or pop-ups
    • a mix of legitimate links with fake links
    • incorrect company name
    • missing or fake contact details

    Keep in mind that an HTTPS site (where the padlock symbol next to the URL address claims a secure connection) can also be malicious.

    How to prevent phishing

    Treat all unexpected messages with caution. Especially watch out for:

    • Generic greetings like 'Dear Sir/Madam' or 'Dear customer'. Legitimate companies and individuals will generally call you by your name, eg 'Dear [FIRST NAME]'.
    • Mismatched sender addresses or links to web pages. Make sure that they match legitimate sources, including when you hover your cursor above them.
    • Unsolicited emails carrying attachments or directing you to download documents or files from unknown websites. A good email filter will block many of these types of messages.
    • Emails that appear to come from a bank or similar institution, and request sensitive information. If in doubt, contact your bank directly using trusted contact details and do not use the contact details or links provided in the email.
    • Emails demanding urgent action or making offers that are too good to be true.

    If in doubt, avoid clicking links in emails. Instead, contact the sender using known details from their official website or a trusted phone number - never use details from the email itself. Use email filters to block many threats automatically.

    Read the NCSC's guidance on phishing and how to defend against it.

    Report suspicious messages

    Train your staff to recognise scam and act appropriately. If they receive a suspicious email, they can report it to the NCSC Suspicious Email Reporting Service: report@phishing.gov.uk. If you need help training your staff, use the NCSC's Top Tips for Staff tool.

    Actions
    How to avoid phishing attacks
    Phishing: how to report to the NCSC
    Phishing advice from Report Fraud
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Protect your business from ransomware
    Content category
    IT

    Source URL

    /content/protect-your-business-against-phishing

    Links

  • Point-of-sale terminal security

    Best practice for point-of-sale environments and the different ways to protect your POS terminal security.

    Point-of-sale (PoS) systems are a common target for criminals, especially in retail and hospitality. Attacks can affect both the hardware and the software that processes card payments.

    Main risks to point-of-sale security

    PoS systems can be targeted in two main ways:

    • hardware attacks - when criminals attach a 'skimmer' device to a terminal to intercept and capture card data
    • software attacks - when malware is used to gain access to the PoS networks and steal payment data as it transmits through the network

    If you use point-of-sale networks to conduct business, you must follow security best practices and make every effort to protect your terminals and software.

    How to protect your point-of-sale station and network

    For best security, use multiple layers of protection. This means you should:

    • Use strong, unique passwords. Change default usernames and passwords after installation and update passwords on a regular basis.
    • Keep all software updated. Apply the latest security patches to your PoS system to keep it protected against known vulnerabilities.
    • Use firewall and anti-virus software to protect the terminal and network from malware - see common cyber security measures.
    • Use encryption for data transmission. Your POS service provider usually sets this up default. If you have any concerns, discuss safeguards with them to protect your system.
    • Control access. Only allow authorised staff to access customer data. This reduces breach risks from insiders, stolen credentials or errors.
    • Block PoS devices from accessing the internet, where possible. This can prevent exposure to online threats like drive-by download or remote exploits.
    • Segment your network. Isolate PoS systems from other business systems like office PCs - this can help malware spreading to your PoS within your local network.
    • Disable remote access, where possible. This stops criminals exploiting weak logins and reduces the number of ways they can get into your system.

    Even with these measures in place, no system is completely safe. Train staff to spot signs of tampering or suspicious activity, and monitor your systems for security breaches. It's also a good idea to test your cyber security incident response plan and keep your PoS supplier's contact details handy in case of an incident.

    Actions
    Point-of-sale malware
    Cyber security: small business guide
    NCSC: 10 steps to cyber security
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Securing your wireless network
    Content category
    IT

    Source URL

    /content/point-sale-terminal-security

    Links

  • Cloud security risks and solutions

    How to assess cloud security risks and protect your business data, applications and services in the cloud.

    Cloud security protects your data, apps and systems hosted on cloud platforms like Microsoft Azure or Amazon Web Services. It involves controls, policies and processes to prevent unauthorised access, data breaches and service disruptions.

    Cloud security risks

    Cloud services can be affected by risks such as:

    • hacking and unauthorised access
    • data loss or theft
    • server faults and service outages
    • poor configuration or weak access controls
    • legal and compliance failures

    Some risks are managed by the cloud provider, while others are your responsibility as the customer. The exact split depends on the type of cloud service you use:

    • Software as a Service and Platform as a Service models: the provider usually manages most of the underlying security and maintenance.
    • Infrastructure as a Service model: you are usually responsible for more of the security, including configuration, access and patching.

    Make sure you know who is responsible for what before you sign up.

    Cloud security controls

    Many common cyber security measures work in cloud environments too, including:

    • antivirus
    • firewalls and perimeter protection
    • traffic monitoring and reporting
    • spam filtering
    • real-time alerts and analytics

    The National Cyber Security Centre (NCSC) offers detailed guidance to help you configure, deploy and use cloud services securely.

    Cloud security and data protection

    If you process or store sensitive business or personal data in the cloud, check that your provider takes security seriously. Key checks include:

    Provider vulnerabilities

    Are they following best security practices, patching up regularly, and implementing proper security controls? Can they guarantee that your assets will be protected against physical tampering, loss, damage or seizure?

    Technology vulnerabilities

    Are there weaknesses in the host system or server configuration? Can you get assurances that the technology is secure? Will it be reliably accessible and available when you need it?

    Access policies

    Did you agree standards and responsibilities between yourself and the provider? Defining roles and responsibilities can help ensure secure coverage and prevent potential liabilities in case of cyber incidents.

    Access controls

    Will the provider limit access to the cloud service to only those who need it? How will they minimise the risk of accidental or malicious compromises of your data by their personnel?

    Service level agreements

    Can you establish a documented standard with your cloud provider, including their duties in relation to ongoing management, response times and support?

    Risk assessment and analysis

    Does your provider have an adequate incident plan in place to quickly deal with and mitigate any potential breach?

    Legal and regulatory implications

    If you're storing or processing personal data in the cloud, you will have to comply with the UK General Data Protection Regulation (UK GDPR).

    Read NCSC's guidance on cloud computing and data storage, and managing the risk of cloud-enabled products.

    Actions
    NCSC: 14 cloud security principles
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cloud computing
    IT risk management
    Content category
    IT

    Source URL

    /content/cloud-security-risks-and-solutions

    Links

  • Business data breach and theft

    Understand the impact of data breach and theft, and the steps you should take to prevent them.

    A data breach happens when unauthorised people access or disclose sensitive, confidential or otherwise protected data. This may include personal information, financial records, trade secrets or intellectual property.

    Data theft specifically involves stealing digital information to misuse, sell or publicly expose it. Both threaten your business reputation, finances and legal standing.

    Impact of data breach or theft

    Data breaches or theft affect businesses differently, but common consequences include:

    • financial loss
    • reputational damage
    • business disruption
    • fines or legal action if you fail to protect data property

    Read more about the impact of cyber attack on your business.

    Data can be lost or stolen through:

    • unauthorised access to IT systems and networks
    • theft of property or equipment from your premises
    • transporting data externally via unsecured devices
    • poor data protection processes and staff mistakes, with or without intent

    How to prevent data breach

    To protect your business data, you should think about:

    • where and how you store it
    • how you secure it (both physically and electronically)
    • who can access it
    • how that access is managed (eg individual devices)

    Back up your data

    You should back up your important data regularly and store it securely off-site. For added protection, you can use data loss prevention software to:

    • disable USB ports
    • monitor copying of files to storage media
    • prevent users from transferring the data altogether

    Read the National Cyber Security's (NCSC) detailed guidance on the importance of backing up your data.

    Create an asset register

    As part of your security measures, you should create an asset register taking into account all hardware and software, including your server equipment. Determine which assets are at risk from cyber attack and record all the relevant details. Audit the register regularly to ensure that equipment is accounted for, and that the information is safe and secure.

    If your data is stolen - how to deal with a data breach

    If you think data has been stolen, or your business has been exposed to fraud, act quickly to:

    • prevent the data breach from continuing
    • discover the extent of the damage
    • clean up the damage

    Your incident response will depend on the circumstances. You may need to take specific advice from the police or legal advisors, but generally speaking, you should:

    • report the incident to the relevant authority
    • inform your bank
    • check bank accounts for unexplained transactions
    • check for any unexpected account activity
    • review your credit position
    • get IT security support if needed to investigate the breach or help you recover from the breach

    Find out how to develop a cyber security incident response plan.

    The NCSC provides incident management guidance and an 'Exercise in a Box' online cyber exercising tool to help businesses detect, respond to and resolve cyber incidents. Further guidance is available in their small business guide to response and recovery..

    Reporting a data breach

    As part of managing the incident, you may need to let people or organisations know about the security breach. You may need to notify:

    • the regulators, if the breach is significant or if you've failed to comply with data protection legislation
    • individuals or groups whose personal data has been compromised
    • relevant industry bodies, eg in the financial or telecommunications sector

    Different agencies have different remits in terms of investigating and assisting with cases of online fraud, data breaches and cyber crime. Find out how to report a cyber crime.

    Under the UK General Data Protection Regulation (UK GDPR), you must report a serious personal data breach to the Information Commissioner's Office if the breach is likely to result in a risk to people's rights and freedoms.

    Actions
    Cyber Essentials Scheme
    Cyber Action Plan
    Check your cyber security service
    Mitigating malware and ransomware attacks
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    UK General Data Protection Regulation (UK GDPR)
    IT risk management
    Managing assets in business
    Content category
    IT

    Source URL

    /content/business-data-breach-and-theft

    Links

  • Remote access security issues

    Security implications of working remotely, common risks and concerns, and solutions to securing remote access.

    Remote access lets staff connect to business systems via the internet from remote locations, such as home or on the road. It offers flexibility for hybrid working but introduces cyber security risks if not configured securely.

    You can manage some of these risks by using strong authentication, encryption and monitoring. Without proper controls, attackers can exploit weak points to access your network and steal sensitive data.

    Remote access risks

    Remote working sends business data or services outside of the corporate infrastructure, typically over the internet, and often using devices outside your direct control, such as personal laptops or phones. Remote setup adds specific risks, such as:

    • lack of physical security, which increases chances of device loss or theft
    • eavesdropping, as data travels over the public networks
    • unauthorised access, such as someone overlooking the screen
    • data being monitored, copied or changes, if someone gains access to the device

    These risks are greater when staff use public Wi-Fi or personal devices. You can adapt most common cyber security measures to meet the unique challenges of remote access security.

    Managing remote access risk

    You should assess the risks associated with working remotely and set clear rules and policies covering:

    • who is allowed to work remotely
    • what devices they are allowed to use
    • what systems and data they can access or store on devices
    • what security controls they must follow

    Check risks to your network and systems and, if necessary,  increase monitoring on remote connections. If you do so, review and update your workplace monitoring policies first.

    Remote access security measures

    Some specific recommended actions for securing your remote access include:

    • encrypting all data to prevent interception and theft
    • using strong firewall and security software on all devices
    • using multi-factor authentication (eg password plus token or app)
    • restricting access to unauthorised users
    • allowing legitimate users minimum access needed for their role
    • reviewing server logs regularly for unusual activity
    • removing remote access privileges once staff leave or no longer need access
    • testing system regularly for vulnerabilities
    • keeping firewall and remote access software patched and up-to-date

    You can also use a virtual private network (VPN) to add an extra layer of protection for remote connection.

    If you're introducing or scaling up remote access, read the National Cyber Security Centre's (NCSC) guidance on home working and moving your business from the physical to the digital. If your staff is using personal, rather than work-issued devices, see NCSC's advice on secure home working on personal IT.

    Actions
    Home and mobile working security
    Cyber security: small business guide
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Securing your wireless network
    Computer networking
    IT risk management
    Content category
    IT

    Source URL

    /content/remote-access-security-issues

    Links

  • Insider threats in cyber security

    How to detect internal cyber security issues and risks, and develop processes to improve workplace cyber resilience.

    Insider threats come from people within your organisation, such as employees, contractors or partners, who misuse access to your systems or data. This misuse often happens by accident rather than deliberate action. It can compromise operations and cause major financial and reputational damage - read more about the impact on your business.

    Types of insider threats

    Most insider threats fall into three categories:

    • the malicious insider - deliberately misuse access to harm the business or steal data
    • negligent staff - make avoidable mistakes like clicking phishing links or losing devices
    • the third party contractors - lack the same training or oversight as employees

    Insider threats often arise from everyday activities that create cyber security vulnerabilities. Watch for these common risky behaviours in your team:

    • browsing unauthorised websites
    • visiting social networking sites
    • sharing confidential information in a social network environment
    • opening spam or suspicious links and email attachments
    • accidentally sending sensitive information to the wrong people
    • accidentally transferring viruses or malware
    • choosing weak passwords and never changing them
    • using the same password on multiple accounts
    • installing unauthorised programmes on the employee's machines
    • uploading files to an online file-sharing service, personal cloud or storage network
    • downloading unauthorised files (eg music, films or photographs)
    • misplacing or losing property (eg laptops, mobile phones, USB devices)
    • providing information to a third-party, eg suppliers or vendors
    • transporting company information via unsecured portable devices
    • sending sensitive work documents to personal email addresses
    • using unsecured mobile devices to share work data or access company information
    • accessing your business' virtual private network via public computers and public wireless hotspots

    You can prevent many risky behaviours with clear cyber security policies, training and controls.

    How to reduce insider risks

    Many unintentional employee mistakes are avoidable. Keep your workplace secure by taking these steps:

    • Screen new starters: check references, qualifications and identity before giving system access.
    • Set clear rules on acceptable use and data handling in written IT policies.
    • Enforce strong password practices.
    • Block unauthorised websites and devices.
    • Restrict software installs and data access permissions
    • Review email, internet use, remote working and bring your own device standards.
    • Train staff regularly on risks and incident reporting.
    • Monitor logs for unusual activity and audit access rights regularly.
    • Raise cyber security awareness across the business.
    • Use contracts and non-disclosure agreements for sensitive data access.
    • Build in security compliance and disciplinary measures into employment contracts.
    • Use cyber breach detection to spot risky user activity in real time and alert teams.

    Help employees understand their roles and responsibilities in keeping data safe. Use sample IT policies, disclaimers and notices to set expectations.

    Even with best practices, understand that incidents may still happen. Review your cyber security risk management processes and develop an incident response plan, to allow you to quickly and efficiently deal with cyber incidents.

    Actions
    Cyber security: small business guide
    Cyber security training for staff
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    Cyber security for business
    IT risk management
    Content category
    IT

    Source URL

    /content/insider-threats-cyber-security

    Links

  • 10 cyber security tips to protect your business online

    Follow simple steps to increase your business' cyber security and protect assets, resources and data from cyber attacks.

    Cyber attacks threaten all businesses. A recent government survey found that many organisations, including small businesses and charities, have experienced cyber incidents. Larger businesses face more frequent attacks, but any business without proper defences can be vulnerable.

    How to protect your business online

    The National Cyber Security Centre (NCSC) recommends these actions:

    • Back up your data regularly. Store copies of your data off-site and test that backups work.
    • Update software promptly. Apply security patches on all devices used in your businesses. Enable auto-updates where possible.
    • Use anti-virus and anti-malware software. Keep it up to date.
    • Choose strong, unique passwords. Change them regularly and use two-factor authentication.
    • Encrypt sensitive data. Never send passwords or sensitive details via unencrypted email.
    • Be cautious of phishing and ransomware. Avoid clicking on suspicious links in emails or social media.
    • Use firewalls and keep router firmware updated.
    • Secure Wi-Fi with encryption (e.g. WPA2). Change Wi-Fi passwords regularly.
    • Use a VPN when connecting over public or external networks.

    For detailed guidance, check the NCSC's cyber security advice for small and medium-sized businesses.

    Useful NCSC tools and services for businesses

    You can access a range of free resources from the NCSC to help protect your business. These include:

    You can also stay informed of any emerging threats by registering for the NCSC's Early Warning Service.

    If you experience a cyber attack, report it immediately to the NCSC's 24/7 Incident Management team at report.ncsc.gov.uk.

    Actions
    Cyber incident response & recovery
    Invest NI's ICT support for business
    Also on this site
    Business Crime Partnership
    IT risk management
    Cyber security for business
    Content category
    IT

    Source URL

    /content/10-cyber-security-tips-protect-your-business-online

    Links

IT incident response and recovery

In this guide:

  • What is IT risk?

    Introduction to information technology (IT) risk and its potential to damage or devalue your business.

    Information technology or IT risk is basically any threat to your business data, critical systems and business processes. It is the risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an organisation. IT risks have the potential to damage business value and often come from poor management of processes and events.

    Categories of IT risks

    IT risk spans a range of business-critical areas, such as:

    • security - eg compromised business data due to unauthorised access or use
    • availability - eg inability to access your IT systems needed for business operations
    • performance - eg reduced productivity due to slow or delayed access to IT systems
    • compliance - eg failure to follow laws and regulations (eg data protection)

    IT risks vary in range and nature. It's important to be aware of all the different types of IT risks potentially affecting your business.

    Potential impact of IT failure on business

    For businesses that rely on technology, events or incidents that compromise IT can cause many problems. For example, a security breach can lead to:

    • identity fraud and theft
    • financial fraud or theft
    • damage to reputation
    • damage to brand
    • damage to your business' physical assets

    Failure of IT systems due to downtime or outages can result in other damaging and diverse consequences, such as:

    • lost sales and customers
    • reduced staff or business productivity
    • reduced customer loyalty and satisfaction
    • a damaged relationship with partners and suppliers

    If IT failure affects your ability to comply with laws and regulations, then it could also lead to:

    • breach of legal duties
    • breach of client confidentiality
    • penalties, fines and litigation
    • reputational damage

    If technology is enabling your connection to customers, suppliers, partners and business information, managing IT risks in your business should always be a core concern.

    In its guidance, the National Cyber Security Centre (NCSC) provides a clear explanation of why IT risk management matters.

    IT risks should be carefully assessed and measured. This is where an IT risk assessment comes in - a process of identifying security risks and evaluating the threat they pose. Once risks are identified and assessed, you will manage them through a comprehensive IT risk management process.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/what-it-risk

    Links

  • Different types of IT risk

    Your IT systems and data face many risks, including physical damage, malicious attacks, technical faults and human error.

    Your IT systems and the information that you hold on them face a wide range of risks. If your business relies on technology for key operations and activities, you need to be aware of the range and nature of those threats.

    Types of risks in IT systems

    Threats to your IT systems can be external, internal, deliberate and unintentional. Most IT risks affect one or more of the following:

    • business or project goals
    • service continuity
    • bottom-line results
    • business reputation
    • security
    • infrastructure

    Examples of IT risks

    Looking at the nature of risks, it is possible to differentiate between:

    • Physical threats - resulting from physical access or damage to IT resources such as the servers. These could include theft, damage from fire or flood, or unauthorised access to confidential data by an employee or outsider.
    • Electronic threats - aiming to compromise your business information - eg a hacker could get access to your website, your IT system could become infected by a computer virus, or you could fall victim to a fraudulent email or website. These are often of a criminal nature.
    • Technical failures - such as software bugs, a computer crash or the complete failure of a computer component. A technical failure can be catastrophic if, for example, you cannot retrieve data on a failed hard drive and no backup copy is available.
    • Infrastructure failures - such as the loss of your internet connection can interrupt your business - eg you could miss an important purchase order.
    • Human error - is a major threat - eg someone might accidentally delete important data, or fail to follow security procedures properly.

    How to manage IT risks?

    Managing various types of IT risks begins with identifying exactly:

    • the type of threats affecting your business
    • the assets that may be at risks
    • the ways of securing your IT systems

    Find out how to carry out an IT risk assessment and learn more about the IT risk management process.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/different-types-it-risk

    Links

  • IT risk assessment methodology

    An effective IT risk assessment looks at risk based on the probability of it occurring and the cost of impact and recovery.

    IT risk assessment is a process of analysing potential threats and vulnerabilities to your IT systems to establish what loss you might expect to incur if certain events happen. Its objective is to help you achieve optimal security at a reasonable cost.

    There are two prevailing methodologies for assessing the different types of IT risk: quantitative and qualitative risk analysis.

    Quantitative IT risk assessment

    Quantitative assessment measures risk using monetary amounts. It uses mathematical formulas to give you the value of expected losses associated with a particular risk, based on:

    • the asset value
    • the frequency of risk occurrence
    • the probability of associated loss

    In an example of server failure, a quantitative assessment would involve looking at:

    • the cost of a server or the revenue it generates
    • how often does the server crash
    • the estimated loss incurred each time it crashed

    From these values, you can work out several key calculations:

    • single loss expectancy - costs you would incur if the incident occurs once
    • annual rate of occurrence - how many times a year you can expect this risk to occur
    • annual loss expectancy - the total risk value over the course of a year

    Find a formula to calculate annualised loss expectancy.

    These monetary results could help you avoid spending too much time and money on reducing negligible risks. For example, if a threat is unlikely to happen or costs little or nothing to remedy, it probably presents a low risk to your business.

    However, if a threat to your key IT systems is likely to happen, and could be expensive to fix or likely to affect your business adversely, you should consider it high risk.

    You may want to use this risk information to carry out a cost/benefit analysis to determine what level of investment would make risk treatment worthwhile.

    Keep in mind that quantitative measures of risk are only meaningful when you have good data. You may not always have the necessary historical data to work out probability and cost estimates on IT-related risks, since they can change very quickly.

    Qualitative IT risk assessment

    Qualitative risk assessment is opinion-based. It relies on judgment to categorise risks based on probability and impact and uses a rating scale to describe the risks as:

    • low - unlikely to occur or impact your business
    • medium - possible to occur and impact
    • high - likely to occur and impact your business significantly

    For example, you might classify as 'high probability' something that you expect to happen several times a year. You do the same for cost/impact in whatever terms seem useful, for example:

    • low - would lose up to half an hour of production
    • medium - would cause complete shutdown for at least three days
    • high - would cause irrevocable loss to the business

    With your ratings determined, you can then create a risk assessment matrix to help you categorise the risk level for each risk event. This can, ultimately, help you decide which risks to mitigate using controls, and which to accept or transfer.

    Read more about the different ways to evaluate business risks.

    Use different types of information in IT risk assessments

    Often, it may be best to use a mixed approach to IT risk assessments, combining elements of both quantitative and qualitative analysis.

    You can use the quantitative data to assess the value of assets and loss expectancy, but also involve people in your business to gain their expert insight. This may take time and effort, but it can also result in a greater understanding of the risks and better data than each method would provide alone.

    The National Cyber Security Centre (NCSC) recommends using a variety of risk information in assessments. Drawing on a wider range of information sources may reveal risks that would otherwise be missed.

    Actions
    NCSC: Risk management guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/it-risk-assessment-methodology

    Links

  • IT risk management process

    How to identify risks and assets as part of the IT risk management process, and create risk management plans procedures.

    In business, IT risk management entails a process of identifying, monitoring and managing potential information security or technology risks with the goal of mitigating or minimising their negative impact.

    Examples of potential IT risks include security breaches, data loss or theft, cyber attacks, system failures and natural disasters. Anything that could affect the confidentiality, integrity and availability of your systems and assets could be considered an IT risk.

    Steps in the IT risk management process

    To manage IT risks effectively, follow these six steps in your risk management process:

    1. Identify risks

    Determine the nature of risks and how they relate to your business. Take a look at the different types of IT risk.

    2. Assess risks

    Determine how serious each risk is to your business and prioritise them. Carry out an IT risk assessment.

    3. Mitigate risks

    Put in place preventive measures to reduce the likelihood of the risk occurring and limit its impact. Find solutions in our IT risk management checklist.

    4. Develop an incident response

    Set out plans for managing a problem and recovering your operations. Devise and test your IT incident response and recovery strategy.

    5. Develop contingency plans

    Ensure that your business can continue to run after an incident or a crisis. Read about IT risk and business continuity.

    6. Review processes and procedures

    Continue to assess threats and manage new risks. Read more about the strategies to manage business risk.

    IT risk controls

    As part of your risk management, try to reduce the likelihood of risks affecting your business in the first place. Put in place measures to protect your systems and data from all known threats.

    For example, you should:

    • Review the information you hold and share. Make sure that you comply with data protection legislation, and think about what needs to be on public or shared systems. Where possible, remove sensitive information.
    • Install and maintain security controls, such as firewalls, anti-virus software and processes that help prevent intrusion and protect your business online.
    • Implement security policies and procedures such as internet and email usage policies, and train staff. 
    • Use a third-party IT provider if you lack in-house skills. Often, they can provide their own security expertise. See how to choose an IT supplier for your business.

    If you can't remove or reduce risks to an acceptable level, you may be able to take action to lessen the impact of potential incidents.

    Mitigate IT risks

    To mitigate IT risks, you should consider:

    You can also use the National Cyber Security Centre's (NCSC) free Check your cyber security service to perform a range of simple online checks to identify common vulnerabilities in your public-facing IT.

    The NCSC also offer a free Cyber Action Plan. By answering a few simple questions, you can get a free personalised action plan that lists what you or your organisation can do right now to protect against cyber attack.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    NCSC: 10 Steps to cyber security
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Cyber security for business
    UK General Data Protection Regulation (UK GDPR)
    Content category
    IT

    Source URL

    /content/it-risk-management-process

    Links

  • ISO 27001 IT security management standard

    An overview of the ISO 27001 information security standard, and how it can help you improve security for your business.

    ISO 27001 is an international standard that describes best practices for information security management systems. It belongs to a 27000 family of standards, all of which aim to help keep your business' information assets secure.

    ISO 27001 controls

    The standard specifies controls that are key to maintaining security. These cover (amongst other things):

    • security policy - what an information security policy is, what it should cover and why your business should have one
    • organisational security - how you should manage information security in a business.
    • asset classification and control - eg how to audit and manage information itself, computers, software and services
    • staff security - eg training, responsibilities, vetting procedures, and response to incidents
    • physical and environmental security - eg keeping key locations secure as well as physical control of access to information and equipment
    • communications and operations management - secure operation of information processing facilities during day-to-day activities, especially computer networks
    • access control - right to use information and systems based on business and security needs, specifically controlling who can do what with your information resources
    • system development and maintenance - if you develop your own software, you will need to consider its design and maintenance to keep it secure and maintain information integrity
    • business continuity management - ie the maintenance of essential business activities during adverse conditions, from coping with major disasters to minor local issues
    • compliance - with relevant national and international laws

    Like other ISO management system standards, you can certify your business to ISO/IEC 27001, but certification isn't mandatory.

    You may choose to implement the standard in order to benefit from the best practice it contains, or you may wish to certify to reassure customers and clients that you follow information security management best practices.

    See more on standards for best business practice.

    Actions
    ISO 27001 information and benefits
    NCSC: Risk management guide
    Invest NI's ICT support for business
    Also on this site
    Make best use of standards
    Quality management standards
    Best practice in business
    Content category
    IT

    Source URL

    /content/iso-27001-it-security-management-standard

    Links

  • IT risk management policy

    How you can use staff, IT and data security policies and procedures to improve security in your business.

    IT policies and procedures explain why it is important to manage IT risks in business. You can have them as part of your risk management plans or business continuity strategy.

    You should make them available to your staff and suppliers to help them understand:

    • the risks to your IT systems and data
    • procedures that are in place to mitigate them
    • processes for handling common tasks
    • managing changes to IT systems
    • ways to respond to IT or data security incidents
    • acceptable behaviours in relation to key IT issues, such as data protection and safe email use

    You should develop a clear policy that takes account of common risks to your data. If you have yet to establish what the risks to your business are, you should carry out an IT risk assessment.

    What should an IT risk management policy contain?

    It should, at the very least, specify security procedures and standards that will apply in your business, as well as any staff policies you wish to enforce.

    IT security procedures

    Technical controls, such as systems that limit access to sensitive data or the installation of software, are an important part of most IT security systems. You will need policies and procedures to ensure that these controls are effective. See more on common cyber security measures and read about cyber security for business.

    IT security standards

    Standards are important when developing a secure IT environment. For example, agreed standards for the procurement of PCs, servers and firewalls will help to provide consistency. Find out more about ISO 27001 IT security management standard.

    IT staff policies

    You will also need policies to manage activities that could pose security threats. Consider putting in place an internet usage policy and an email usage policy to protect your systems. Find sample IT policies, disclaimers and notices.

    Actions
    NCSC: Risk management guide
    NCSC: 10 steps to cyber security
    Cyber security: small business guide
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Cyber security for business
    Staff training
    Risk management
    Content category
    IT

    Source URL

    /content/it-risk-management-policy

    Links

  • IT incident response and recovery

    What is an IT incident response plan, how to respond to an IT security incident and recover your business operations.

    Incident response is a way in which you manage the aftermath of an IT security breach or failure. It is vital to have a response plan in place before an incident occurs so that you can limit the damage caused by the event and reduce recovery time and costs for your business.

    What is an IT incident response plan?

    An IT incident response plan is a set of written instructions that can help you respond to a number of potential scenarios, such as:

    • information data breaches
    • denial of service attacks
    • firewall intrusion
    • virus or malware infection
    • insider threats
    • damage to equipment or premises
    • loss of power or other technology failures

    Your incident response plan should identify key people who will act in case of an incident and describe their roles and responsibilities. It should also say who is responsible for testing the plan and putting it into action. Your business' incident response plans should be based on thorough and comprehensive IT risk assessments.

    See an example of a minimal Denial of Service attack response plan from the National Cyber Security Centre (NCSC).

    IT incident management process

    The process of managing an IT incident typically consists of six steps:

    • prepare staff and managers to handle potential incidents should they arise
    • determine if an event is an IT failure or a security incident
    • contain the incident and prevent further damage to systems and equipment
    • find the cause of the incident and remove the affected systems
    • recover those systems after removing the threats
    • document and analyse the situation to update, change or improve procedures

    An IT incident can be isolated to one or more IT components of your business or it can be a part of a wider crisis (eg fire, flood or natural disaster). If a wider emergency occurs such as fire, the safety of staff and the public is your first priority. You should include emergency response plans in your incident response strategy.

    Read more about business continuity and crisis management.

    IT incident recovery planning

    How you respond to IT incidents will determine how well your business recovers from them. Planning can help you shorten recovery times and minimise losses. A recovery plan could include your recovery time goals, as well as:

    • strategies to recover your business activities in the quickest possible time
    • a description of key resources, equipment and staff needed to recover your operations

    It's essential to plan thoroughly to protect yourself from the impact of potential business crises brought on by IT failure or security breaches.

    To help you prepare for and plan your response to a cyber incident, the NCSC has produced small business guidance on response and recovery. You can also test and practise your response to a cyber attack with the help of their 'Exercise in a Box' online training tool.

    Actions
    NCSC: Incident management guide
    NCSC: 10 steps to cyber security
    Free Cyber Action Plan
    Invest NI's ICT support for business
    Also on this site
    Insurance: business property and assets
    Cyber security for business
    Protect your business online
    Content category
    IT

    Source URL

    /content/it-incident-response-and-recovery

    Links

  • IT risk and business continuity

    How to create, test and carry out contingency plans for your business in case of IT systems failure.

    Business continuity planning is an essential part of managing IT risks. Planning can help you set out steps to minimise the potential impact of a business disaster - be it an equipment failure, a cyber attack or a simple power outage.

    You may also need a business continuity plan to:

    • reassure customers that you take risk and security issues seriously
    • show effective risk management to insurers, helping to lower premiums
    • meet regulatory requirements in certain industries, eg financial services

    How to write a business continuity plan?

    Your plan should take into account any disruptive events that could affect:

    • your people
    • premises
    • IT systems and networks
    • services such as power and telecommunications
    • critical business processes

    The plan should identify how you will know when to put the plan into action, what steps to take and what individuals' responsibilities are.

    Measures that you may need to include in your business continuity plan are:

    • a backup and data recovery strategy, including off-site storage
    • the development of a resilient IT infrastructure with spare capacity in case of failure - eg mirrored central server computers sited in different locations
    • the elimination of single points of failure, such as a single power supply
    • secondary manual systems to use until you are able to restore IT services
    • agreeing with another business to use each other's premises in the event of a disaster
    • arranging to use third-party IT services and accommodation until yours are restored

    Keep your plan clear and concise, so that people understand it. It is essential that everyone is aware of their responsibilities.

    Remember to test your business continuity plan periodically. Review and update the plan as necessary - eg when people leave the business or you start using new IT systems.

    Actions
    Business continuity planning
    NCSC: Risk management guide
    NCSC: 10 steps to cyber security
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Business continuity and crisis management
    Protect your business online
    Content category
    IT

    Source URL

    /content/it-risk-and-business-continuity

    Links

  • IT risk management checklist

    Use our practical IT risk management checklist to help you understand, manage and reduce IT risks to your business.

    Risk management can be relatively simple if you follow some basic principles. To manage the IT risks to your business effectively, make sure that you do the following:

    • Think about IT security from the start when you plan or update an IT system. Discuss your needs and potential problems with the system users.
    • Actively look for IT risks that could affect your business. Identify their likelihood, costs and impact. Carry out a comprehensive IT risk assessment.
    • Think about the opportunity, capability and motivation behind potential attacks. Understand the reasons for cyber attack.
    • Assess the seriousness of each IT risk and focus on those that are most significant.
    • Understand the relevant laws, legislations and industry guidelines, especially if you have to comply with the data protection legislation.
    • Configure your PCs, servers, firewalls and other technical elements of the system. Keep software and hardware equipment up-to-date. Put in place other common cyber security measures and secure your wireless network.
    • Don't rely on just one technical control (eg a password). Use two-factor authentication to guarantee user identity - eg something you have (such as an ID card) and something you know (a PIN or password).
    • Develop data recovery and backup processes and consider daily backups to offsite locations.
    • Support technical controls with appropriate policies, procedures and training. Understand the most common insider threats in cyber security.
    • Make sure that you have a business continuity plan. This should cover any serious IT risk that you cannot fully control. Regularly review and update your plan. Read about IT risk and business continuity.
    • Establish effective IT incident response and recovery measures, as well as a recording and management system. Simulate incidents to test and improve your incident planning, response and recovery.
    • Develop and follow specific IT policies and procedures, such as on email and internet use, and make sure your staff know what falls under acceptable use.
    • Consider certification to the IT security management standards for your business and your trading partners.

    The National Cyber Security Centre offers detailed guidance to help organisations make decisions about cyber security risk.

    If you want to look at risks beyond IT, see how to manage business risks.

    Actions
    Cyber incident response & recovery
    Business continuity planning
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Risk management
    Cyber security for business
    Content category
    IT

    Source URL

    /content/it-risk-management-checklist

    Links

What is IT risk?

In this guide:

  • What is IT risk?

    Introduction to information technology (IT) risk and its potential to damage or devalue your business.

    Information technology or IT risk is basically any threat to your business data, critical systems and business processes. It is the risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an organisation. IT risks have the potential to damage business value and often come from poor management of processes and events.

    Categories of IT risks

    IT risk spans a range of business-critical areas, such as:

    • security - eg compromised business data due to unauthorised access or use
    • availability - eg inability to access your IT systems needed for business operations
    • performance - eg reduced productivity due to slow or delayed access to IT systems
    • compliance - eg failure to follow laws and regulations (eg data protection)

    IT risks vary in range and nature. It's important to be aware of all the different types of IT risks potentially affecting your business.

    Potential impact of IT failure on business

    For businesses that rely on technology, events or incidents that compromise IT can cause many problems. For example, a security breach can lead to:

    • identity fraud and theft
    • financial fraud or theft
    • damage to reputation
    • damage to brand
    • damage to your business' physical assets

    Failure of IT systems due to downtime or outages can result in other damaging and diverse consequences, such as:

    • lost sales and customers
    • reduced staff or business productivity
    • reduced customer loyalty and satisfaction
    • a damaged relationship with partners and suppliers

    If IT failure affects your ability to comply with laws and regulations, then it could also lead to:

    • breach of legal duties
    • breach of client confidentiality
    • penalties, fines and litigation
    • reputational damage

    If technology is enabling your connection to customers, suppliers, partners and business information, managing IT risks in your business should always be a core concern.

    In its guidance, the National Cyber Security Centre (NCSC) provides a clear explanation of why IT risk management matters.

    IT risks should be carefully assessed and measured. This is where an IT risk assessment comes in - a process of identifying security risks and evaluating the threat they pose. Once risks are identified and assessed, you will manage them through a comprehensive IT risk management process.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/what-it-risk

    Links

  • Different types of IT risk

    Your IT systems and data face many risks, including physical damage, malicious attacks, technical faults and human error.

    Your IT systems and the information that you hold on them face a wide range of risks. If your business relies on technology for key operations and activities, you need to be aware of the range and nature of those threats.

    Types of risks in IT systems

    Threats to your IT systems can be external, internal, deliberate and unintentional. Most IT risks affect one or more of the following:

    • business or project goals
    • service continuity
    • bottom-line results
    • business reputation
    • security
    • infrastructure

    Examples of IT risks

    Looking at the nature of risks, it is possible to differentiate between:

    • Physical threats - resulting from physical access or damage to IT resources such as the servers. These could include theft, damage from fire or flood, or unauthorised access to confidential data by an employee or outsider.
    • Electronic threats - aiming to compromise your business information - eg a hacker could get access to your website, your IT system could become infected by a computer virus, or you could fall victim to a fraudulent email or website. These are often of a criminal nature.
    • Technical failures - such as software bugs, a computer crash or the complete failure of a computer component. A technical failure can be catastrophic if, for example, you cannot retrieve data on a failed hard drive and no backup copy is available.
    • Infrastructure failures - such as the loss of your internet connection can interrupt your business - eg you could miss an important purchase order.
    • Human error - is a major threat - eg someone might accidentally delete important data, or fail to follow security procedures properly.

    How to manage IT risks?

    Managing various types of IT risks begins with identifying exactly:

    • the type of threats affecting your business
    • the assets that may be at risks
    • the ways of securing your IT systems

    Find out how to carry out an IT risk assessment and learn more about the IT risk management process.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/different-types-it-risk

    Links

  • IT risk assessment methodology

    An effective IT risk assessment looks at risk based on the probability of it occurring and the cost of impact and recovery.

    IT risk assessment is a process of analysing potential threats and vulnerabilities to your IT systems to establish what loss you might expect to incur if certain events happen. Its objective is to help you achieve optimal security at a reasonable cost.

    There are two prevailing methodologies for assessing the different types of IT risk: quantitative and qualitative risk analysis.

    Quantitative IT risk assessment

    Quantitative assessment measures risk using monetary amounts. It uses mathematical formulas to give you the value of expected losses associated with a particular risk, based on:

    • the asset value
    • the frequency of risk occurrence
    • the probability of associated loss

    In an example of server failure, a quantitative assessment would involve looking at:

    • the cost of a server or the revenue it generates
    • how often does the server crash
    • the estimated loss incurred each time it crashed

    From these values, you can work out several key calculations:

    • single loss expectancy - costs you would incur if the incident occurs once
    • annual rate of occurrence - how many times a year you can expect this risk to occur
    • annual loss expectancy - the total risk value over the course of a year

    Find a formula to calculate annualised loss expectancy.

    These monetary results could help you avoid spending too much time and money on reducing negligible risks. For example, if a threat is unlikely to happen or costs little or nothing to remedy, it probably presents a low risk to your business.

    However, if a threat to your key IT systems is likely to happen, and could be expensive to fix or likely to affect your business adversely, you should consider it high risk.

    You may want to use this risk information to carry out a cost/benefit analysis to determine what level of investment would make risk treatment worthwhile.

    Keep in mind that quantitative measures of risk are only meaningful when you have good data. You may not always have the necessary historical data to work out probability and cost estimates on IT-related risks, since they can change very quickly.

    Qualitative IT risk assessment

    Qualitative risk assessment is opinion-based. It relies on judgment to categorise risks based on probability and impact and uses a rating scale to describe the risks as:

    • low - unlikely to occur or impact your business
    • medium - possible to occur and impact
    • high - likely to occur and impact your business significantly

    For example, you might classify as 'high probability' something that you expect to happen several times a year. You do the same for cost/impact in whatever terms seem useful, for example:

    • low - would lose up to half an hour of production
    • medium - would cause complete shutdown for at least three days
    • high - would cause irrevocable loss to the business

    With your ratings determined, you can then create a risk assessment matrix to help you categorise the risk level for each risk event. This can, ultimately, help you decide which risks to mitigate using controls, and which to accept or transfer.

    Read more about the different ways to evaluate business risks.

    Use different types of information in IT risk assessments

    Often, it may be best to use a mixed approach to IT risk assessments, combining elements of both quantitative and qualitative analysis.

    You can use the quantitative data to assess the value of assets and loss expectancy, but also involve people in your business to gain their expert insight. This may take time and effort, but it can also result in a greater understanding of the risks and better data than each method would provide alone.

    The National Cyber Security Centre (NCSC) recommends using a variety of risk information in assessments. Drawing on a wider range of information sources may reveal risks that would otherwise be missed.

    Actions
    NCSC: Risk management guide
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Protect your business online
    Cyber security for business
    Content category
    IT

    Source URL

    /content/it-risk-assessment-methodology

    Links

  • IT risk management process

    How to identify risks and assets as part of the IT risk management process, and create risk management plans procedures.

    In business, IT risk management entails a process of identifying, monitoring and managing potential information security or technology risks with the goal of mitigating or minimising their negative impact.

    Examples of potential IT risks include security breaches, data loss or theft, cyber attacks, system failures and natural disasters. Anything that could affect the confidentiality, integrity and availability of your systems and assets could be considered an IT risk.

    Steps in the IT risk management process

    To manage IT risks effectively, follow these six steps in your risk management process:

    1. Identify risks

    Determine the nature of risks and how they relate to your business. Take a look at the different types of IT risk.

    2. Assess risks

    Determine how serious each risk is to your business and prioritise them. Carry out an IT risk assessment.

    3. Mitigate risks

    Put in place preventive measures to reduce the likelihood of the risk occurring and limit its impact. Find solutions in our IT risk management checklist.

    4. Develop an incident response

    Set out plans for managing a problem and recovering your operations. Devise and test your IT incident response and recovery strategy.

    5. Develop contingency plans

    Ensure that your business can continue to run after an incident or a crisis. Read about IT risk and business continuity.

    6. Review processes and procedures

    Continue to assess threats and manage new risks. Read more about the strategies to manage business risk.

    IT risk controls

    As part of your risk management, try to reduce the likelihood of risks affecting your business in the first place. Put in place measures to protect your systems and data from all known threats.

    For example, you should:

    • Review the information you hold and share. Make sure that you comply with data protection legislation, and think about what needs to be on public or shared systems. Where possible, remove sensitive information.
    • Install and maintain security controls, such as firewalls, anti-virus software and processes that help prevent intrusion and protect your business online.
    • Implement security policies and procedures such as internet and email usage policies, and train staff. 
    • Use a third-party IT provider if you lack in-house skills. Often, they can provide their own security expertise. See how to choose an IT supplier for your business.

    If you can't remove or reduce risks to an acceptable level, you may be able to take action to lessen the impact of potential incidents.

    Mitigate IT risks

    To mitigate IT risks, you should consider:

    You can also use the National Cyber Security Centre's (NCSC) free Check your cyber security service to perform a range of simple online checks to identify common vulnerabilities in your public-facing IT.

    The NCSC also offer a free Cyber Action Plan. By answering a few simple questions, you can get a free personalised action plan that lists what you or your organisation can do right now to protect against cyber attack.

    Actions
    NCSC: Risk management guide
    Cyber security: small business guide
    NCSC: 10 Steps to cyber security
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Cyber security for business
    UK General Data Protection Regulation (UK GDPR)
    Content category
    IT

    Source URL

    /content/it-risk-management-process

    Links

  • ISO 27001 IT security management standard

    An overview of the ISO 27001 information security standard, and how it can help you improve security for your business.

    ISO 27001 is an international standard that describes best practices for information security management systems. It belongs to a 27000 family of standards, all of which aim to help keep your business' information assets secure.

    ISO 27001 controls

    The standard specifies controls that are key to maintaining security. These cover (amongst other things):

    • security policy - what an information security policy is, what it should cover and why your business should have one
    • organisational security - how you should manage information security in a business.
    • asset classification and control - eg how to audit and manage information itself, computers, software and services
    • staff security - eg training, responsibilities, vetting procedures, and response to incidents
    • physical and environmental security - eg keeping key locations secure as well as physical control of access to information and equipment
    • communications and operations management - secure operation of information processing facilities during day-to-day activities, especially computer networks
    • access control - right to use information and systems based on business and security needs, specifically controlling who can do what with your information resources
    • system development and maintenance - if you develop your own software, you will need to consider its design and maintenance to keep it secure and maintain information integrity
    • business continuity management - ie the maintenance of essential business activities during adverse conditions, from coping with major disasters to minor local issues
    • compliance - with relevant national and international laws

    Like other ISO management system standards, you can certify your business to ISO/IEC 27001, but certification isn't mandatory.

    You may choose to implement the standard in order to benefit from the best practice it contains, or you may wish to certify to reassure customers and clients that you follow information security management best practices.

    See more on standards for best business practice.

    Actions
    ISO 27001 information and benefits
    NCSC: Risk management guide
    Invest NI's ICT support for business
    Also on this site
    Make best use of standards
    Quality management standards
    Best practice in business
    Content category
    IT

    Source URL

    /content/iso-27001-it-security-management-standard

    Links

  • IT risk management policy

    How you can use staff, IT and data security policies and procedures to improve security in your business.

    IT policies and procedures explain why it is important to manage IT risks in business. You can have them as part of your risk management plans or business continuity strategy.

    You should make them available to your staff and suppliers to help them understand:

    • the risks to your IT systems and data
    • procedures that are in place to mitigate them
    • processes for handling common tasks
    • managing changes to IT systems
    • ways to respond to IT or data security incidents
    • acceptable behaviours in relation to key IT issues, such as data protection and safe email use

    You should develop a clear policy that takes account of common risks to your data. If you have yet to establish what the risks to your business are, you should carry out an IT risk assessment.

    What should an IT risk management policy contain?

    It should, at the very least, specify security procedures and standards that will apply in your business, as well as any staff policies you wish to enforce.

    IT security procedures

    Technical controls, such as systems that limit access to sensitive data or the installation of software, are an important part of most IT security systems. You will need policies and procedures to ensure that these controls are effective. See more on common cyber security measures and read about cyber security for business.

    IT security standards

    Standards are important when developing a secure IT environment. For example, agreed standards for the procurement of PCs, servers and firewalls will help to provide consistency. Find out more about ISO 27001 IT security management standard.

    IT staff policies

    You will also need policies to manage activities that could pose security threats. Consider putting in place an internet usage policy and an email usage policy to protect your systems. Find sample IT policies, disclaimers and notices.

    Actions
    NCSC: Risk management guide
    NCSC: 10 steps to cyber security
    Cyber security: small business guide
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Cyber security for business
    Staff training
    Risk management
    Content category
    IT

    Source URL

    /content/it-risk-management-policy

    Links

  • IT incident response and recovery

    What is an IT incident response plan, how to respond to an IT security incident and recover your business operations.

    Incident response is a way in which you manage the aftermath of an IT security breach or failure. It is vital to have a response plan in place before an incident occurs so that you can limit the damage caused by the event and reduce recovery time and costs for your business.

    What is an IT incident response plan?

    An IT incident response plan is a set of written instructions that can help you respond to a number of potential scenarios, such as:

    • information data breaches
    • denial of service attacks
    • firewall intrusion
    • virus or malware infection
    • insider threats
    • damage to equipment or premises
    • loss of power or other technology failures

    Your incident response plan should identify key people who will act in case of an incident and describe their roles and responsibilities. It should also say who is responsible for testing the plan and putting it into action. Your business' incident response plans should be based on thorough and comprehensive IT risk assessments.

    See an example of a minimal Denial of Service attack response plan from the National Cyber Security Centre (NCSC).

    IT incident management process

    The process of managing an IT incident typically consists of six steps:

    • prepare staff and managers to handle potential incidents should they arise
    • determine if an event is an IT failure or a security incident
    • contain the incident and prevent further damage to systems and equipment
    • find the cause of the incident and remove the affected systems
    • recover those systems after removing the threats
    • document and analyse the situation to update, change or improve procedures

    An IT incident can be isolated to one or more IT components of your business or it can be a part of a wider crisis (eg fire, flood or natural disaster). If a wider emergency occurs such as fire, the safety of staff and the public is your first priority. You should include emergency response plans in your incident response strategy.

    Read more about business continuity and crisis management.

    IT incident recovery planning

    How you respond to IT incidents will determine how well your business recovers from them. Planning can help you shorten recovery times and minimise losses. A recovery plan could include your recovery time goals, as well as:

    • strategies to recover your business activities in the quickest possible time
    • a description of key resources, equipment and staff needed to recover your operations

    It's essential to plan thoroughly to protect yourself from the impact of potential business crises brought on by IT failure or security breaches.

    To help you prepare for and plan your response to a cyber incident, the NCSC has produced small business guidance on response and recovery. You can also test and practise your response to a cyber attack with the help of their 'Exercise in a Box' online training tool.

    Actions
    NCSC: Incident management guide
    NCSC: 10 steps to cyber security
    Free Cyber Action Plan
    Invest NI's ICT support for business
    Also on this site
    Insurance: business property and assets
    Cyber security for business
    Protect your business online
    Content category
    IT

    Source URL

    /content/it-incident-response-and-recovery

    Links

  • IT risk and business continuity

    How to create, test and carry out contingency plans for your business in case of IT systems failure.

    Business continuity planning is an essential part of managing IT risks. Planning can help you set out steps to minimise the potential impact of a business disaster - be it an equipment failure, a cyber attack or a simple power outage.

    You may also need a business continuity plan to:

    • reassure customers that you take risk and security issues seriously
    • show effective risk management to insurers, helping to lower premiums
    • meet regulatory requirements in certain industries, eg financial services

    How to write a business continuity plan?

    Your plan should take into account any disruptive events that could affect:

    • your people
    • premises
    • IT systems and networks
    • services such as power and telecommunications
    • critical business processes

    The plan should identify how you will know when to put the plan into action, what steps to take and what individuals' responsibilities are.

    Measures that you may need to include in your business continuity plan are:

    • a backup and data recovery strategy, including off-site storage
    • the development of a resilient IT infrastructure with spare capacity in case of failure - eg mirrored central server computers sited in different locations
    • the elimination of single points of failure, such as a single power supply
    • secondary manual systems to use until you are able to restore IT services
    • agreeing with another business to use each other's premises in the event of a disaster
    • arranging to use third-party IT services and accommodation until yours are restored

    Keep your plan clear and concise, so that people understand it. It is essential that everyone is aware of their responsibilities.

    Remember to test your business continuity plan periodically. Review and update the plan as necessary - eg when people leave the business or you start using new IT systems.

    Actions
    Business continuity planning
    NCSC: Risk management guide
    NCSC: 10 steps to cyber security
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    Risk management
    Business continuity and crisis management
    Protect your business online
    Content category
    IT

    Source URL

    /content/it-risk-and-business-continuity

    Links

  • IT risk management checklist

    Use our practical IT risk management checklist to help you understand, manage and reduce IT risks to your business.

    Risk management can be relatively simple if you follow some basic principles. To manage the IT risks to your business effectively, make sure that you do the following:

    • Think about IT security from the start when you plan or update an IT system. Discuss your needs and potential problems with the system users.
    • Actively look for IT risks that could affect your business. Identify their likelihood, costs and impact. Carry out a comprehensive IT risk assessment.
    • Think about the opportunity, capability and motivation behind potential attacks. Understand the reasons for cyber attack.
    • Assess the seriousness of each IT risk and focus on those that are most significant.
    • Understand the relevant laws, legislations and industry guidelines, especially if you have to comply with the data protection legislation.
    • Configure your PCs, servers, firewalls and other technical elements of the system. Keep software and hardware equipment up-to-date. Put in place other common cyber security measures and secure your wireless network.
    • Don't rely on just one technical control (eg a password). Use two-factor authentication to guarantee user identity - eg something you have (such as an ID card) and something you know (a PIN or password).
    • Develop data recovery and backup processes and consider daily backups to offsite locations.
    • Support technical controls with appropriate policies, procedures and training. Understand the most common insider threats in cyber security.
    • Make sure that you have a business continuity plan. This should cover any serious IT risk that you cannot fully control. Regularly review and update your plan. Read about IT risk and business continuity.
    • Establish effective IT incident response and recovery measures, as well as a recording and management system. Simulate incidents to test and improve your incident planning, response and recovery.
    • Develop and follow specific IT policies and procedures, such as on email and internet use, and make sure your staff know what falls under acceptable use.
    • Consider certification to the IT security management standards for your business and your trading partners.

    The National Cyber Security Centre offers detailed guidance to help organisations make decisions about cyber security risk.

    If you want to look at risks beyond IT, see how to manage business risks.

    Actions
    Cyber incident response & recovery
    Business continuity planning
    Risk management for practitioners
    Invest NI's ICT support for business
    Also on this site
    UK General Data Protection Regulation (UK GDPR)
    Risk management
    Cyber security for business
    Content category
    IT

    Source URL

    /content/it-risk-management-checklist

    Links

Best practices for accessible websites

In this guide:

  • Planning your website

    How to set clear objectives for your website, plan its purpose and work out its structure, design and content.

    Planning is essential when it comes to designing a website. Lack of planning can lead to money lost, poor user experience and a website that reflects negatively on your business.

    Set your website objectives

    Website planning begins by first identifying your website's purpose. Typical reasons why businesses develop websites include:

    • building brand awareness
    • finding new customers
    • saving money through online processes
    • selling products or services
    • improving customer support

    The key to effective planning is realising that you are not building a website for yourself. You're creating it for your prospective audience, which can include your current customers, new prospects, stakeholders, suppliers and partners.

    Plan your website content

    Decide on the type of content you will need to support the objectives of your site and how to present this online. Think about balancing the amount of text, images and interactive content that you wish to publish on your site. Look at what your competitors are doing and try to understand what the business opportunities are for your website.

    Learn as much as you can about the audience you are trying to reach. Think about:

    • what will make them visit your website
    • what they will want when they get there
    • what will encourage them to return

    If you are creating an e-commerce website, provide unique descriptions for your products or services. This will help with search engine optimisation and ensure that you stand apart from your competitors.

    Thorough market research will help you lay a firm foundation for your website. You will want to research your competitors, your products, your target markets and consider internal resources and processes to inform your project.

    See how to set up an e-commerce website (video tutorial).

    When you are planning content for your site, don't forget you are legally required to publish certain company information - see business websites: legal requirements.

    Plan your website structure

    When it comes to planning your website, it may help to sketch your site structure using a site map, wireframes or simple tools like Word or PowerPoint, or use free online tools that serve a similar purpose. 

    Create a flowchart showing:

    • main pages (eg homepage, about, contact us)
    • sub-pages and key sections
    • logical user flow from entry points to key actions (eg buy now' or 'contact form')

    Use bulleted lists or indentations if software is unavailable. Label each page with its purpose, priority (high/medium/low) and key content. 

    You may want to share your draft site map with a few target users or colleagues. Ask if they can find key information (eg products, contact details) in three clicks or fewer, and refine the structure based on feedback.

    Aim to make your customer journey as simple as possible - the principles of user-centred design can help with this.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    Planning for e-commerce
    Content management systems
    Content category
    IT

    Source URL

    /content/planning-your-website

    Links

  • Business websites: legal requirements

    Check what information you must publish on your business website to meet UK legal requirements and avoid fines or reputational damage.

    As a UK-registered business, you must display key details about your company on your website. Failure to do so can lead to fines, regulatory action, customer complaints, and damaged reputation.

    Publish registered business details

    You must display on your website the registered information relating to your business's identity. This includes:

    • your company name
    • registered number
    • place of registration
    • registered office address
    • contact details, including an email address
    • how to contact the business by non-electronic means (eg phone or post)
    • VAT number of business, if applicable
    • details of any trade body or regulator registration

    For sole traders and partnerships, you must display the address of the primary place of business. If the company is in liquidation, you must also display this information on your website.

    This information doesn't have to be on every page of your website, but it must be easily found. For example, you might want to put it on the 'contact us' or 'about us' page. Some websites have this information in the footer section of each page.

    Privacy and cookie information

    As well as registered information, you must also publish on your site:

    • a privacy notice - to explain what personal data you collect and how you use it
    • a cookie statement - to explain how you use cookies on your site (see more below)
    • a website disclaimer - to outline liability for the use of your website and its information

    Read about privacy information under the UK General Data Protection Regulation.

    Cookie information and consent

    Under privacy laws, you must tell users if you set cookies on your website, unless those cookies are strictly necessary to provide an online service they have requested (for example, to remember items in a shopping basket or ensure security in online banking).

    For non-essential cookies (such as those used for analytics and marketing), you must get consent via a banner or pop-up. Consent must be clear, granular, and include an option to 'accept all' or 'reject all' cookies. Pre-ticked boxes are not allowed.

    You must also explain in a clear statement what these cookies do and why. Your cookie statement can appear as a standalone page on your website or in your privacy policy.

    The Information Commissioner's Office provides more information about cookies and similar technologies. See our sample privacy notice and sample website disclaimer if you need these documents for your business.

    Selling online to consumers

    If you sell online, you must also include on your website:

    These are all required as part of the consumer protection regulations. As a website operator, you will also have a legal duty to address any web accessibility issues on your website.

    Actions
    Invest NI’s ICT support for business
    Also on this site
    Set up a small business website
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/business-websites-legal-requirements

    Links

  • Main technical issues in web design

    Find out how browsers, screen resolutions, download speeds and technologies affect website design and user experience.

    Before you create a website, you should consider technical issues relating to web design that impact how users view and interact with your site across devices. Specifically, you should consider:

    • browser compatibility
    • screen resolutions
    • web technologies
    • internet speed

    Browser issues and web design

    Web pages should be able to display correctly across different browsers - popular options include Firefox, Chrome, Edge, Safari and Opera. Test for compatibility issues in as many browsers and operating systems as you can, on most recent browser versions, as well as the older ones - not all of your visitors may be using up-to-date software.

    If you are updating an existing site, use web analytics tools to see what browsers your customers use most to access your website. This helps you prioritise testing.

    Design your website for common screen sizes

    In 2026, typical screen sizes include:

    • 1366x768 pixels for desktops
    • 375x667 pixels for mobile screens
    • 768x1024 pixels for tablets

    Higher resolutions, such as 1920x1080 pixels for desktops and 414x896 for mobiles, are gaining in popularity. It's important to consider these sizes carefully. If you design your website for higher resolutions, some low-resolution screens and older devices may not be able to display all of your content. Design responsively to avoid cutting off content on smaller screens, and read more about mobile web design best practices.

    Download speeds and design

    Not all internet users have high-speed access, so connection speed should also influence your webpage design. Research suggests that:

    • nearly half of web users expect a webpage to load in 2 seconds or less
    • 40 per cent of people abandon a website that takes more than 3 seconds to load

    To minimise risks of slow response times, reduce image sizes, avoid heavy animations or video on key pages, and use modern formats like WebP. Average webpage size is now around 2MB - aim lower for better performance and SEO. Slow sites can hurt both user retention and search rankings. 

    Avoid problematic technology

    Some older web technologies can prevent users from viewing your site or break accessibility, usability or search indexing. These include:

    • HTML frames
    • heavy Javascript that blocks content
    • Flash (now obsolete)
    • complex AJAX without fallback

    Whenever possible, choose modern, accessible alternatives. See more on web accessibility issues and learn how to design a user-friendly website.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Content management systems
    User-centred design
    Set up a small business website
    Content category
    IT

    Source URL

    /content/main-technical-issues-web-design

    Links

  • Web accessibility issues

    If your business has a website, it should be accessible to disabled users for ethical, commercial and legal reasons.

    In Northern Ireland, the Disability Discrimination Act 1995 (DDA) makes it unlawful to discriminate against disabled people through your website. This applies to websites offering goods, services or facilities to the public.

    In practice, this means that your website must be designed in a way that allows disabled people to access it, eg by using auxiliary aids or services such as screen readers.

    Elsewhere in the UK, the Equality Act 2010 replaced the DDA, but similar duties apply. 

    Why web accessibility matters

    Accessibility means designing websites that people with visual, hearing, mobility or cognitive impairments can use. Almost 1 in 5 people in Northern Ireland have a disability (2025 data). Good accessibility improves your site's usability for everyone, boosts SEO and widens your customer base. 

    Follow Web Accessibility Standards

    The World Wide Web Consortium (W3C) has produced accepted accessibility guidelines for websites. These set out three levels of conformance:

    •  A (priority 1) – the minimum level of access has been met
    • AA (priority 2) – an acceptable level of access has been met
    • AAA (priority 3) – a completely accessible website

    The UK government recommends that websites must satisfy priority 1 and should satisfy priority 2 of the guidelines.

    Check if your website is accessible

    You can use a range of free online tools and services to check if your site is accessible. Examples of these tools include WAVE and Lighthouse (in Chrome DevTools) for automatic testing. Test manually with a screen reader like NVDA (free) or VoiceOver (Mac).

    Make reasonable adjustments for disabled website users

    If your website isn't accessible, it may put a disabled person at a substantial disadvantage compared to people who are not disabled. You may be required under the DDA to make 'reasonable adjustments'.

    This means that, by law, you must:

    • change a practice, policy or procedure that makes it impossible or unreasonably difficult for disabled people to use your service - eg using very small text that puts vision-impaired people at a disadvantage
    • provide an auxiliary aid or service if it would enable (or make it easier for) disabled people to use the service - eg offering an alternative point and click interface for visitors that can't use a keyboard

    The Equality Commission for Northern Ireland (ECNI) has published a range of resources that deal with the rights of access to goods, facilities, services (including online services) and premises. These resources include:

    • advisory guides for employers and service providers
    • good practice videos
    • publications and relevant codes of practice
    • customisable templates, checklists and policies
    • links to further help and advice from other organisations

    Browse ECNI's resources on accessible goods and services and see suggestions of our best practices for accessible websites.

    The WC3 website provides detailed guidance and resources on getting started with web accessibility.

    Actions
    Diverse abilities and barriers
    W3C Web Accessibility Initiative
    Invest NI's ICT support for business
    Code of Practice: Rights of access to goods, facilities, services and premises …
    Also on this site
    Set up a small business website
    Disabled access and facilities in business premises
    User-centred design
    Content category
    IT

    Source URL

    /content/web-accessibility-issues

    Links

  • Best practices for accessible websites

    Find out how to comply with accessibility legislation and make your website accessible to users with a wide range of abilities.

    Accessibility is essential for good web design. For public authorities and commercial websites in Northern Ireland, it is also a legal requirement under the Disability Discrimination Act 1995.

    Why is web accessibility important for businesses?

    People with disabilities use a wide range of tools and techniques to help them navigate the web. For example, some may configure standard software such as browsers to their specific needs. Other users may prefer to use specialised tools, eg screen or text readers, assistive scanning keyboards, etc.

    For these tools to work, you must build websites and applications in a way that supports the use of assistive technologies.

    How to improve web accessibility

    If you are building a website from scratch or redesigning it, make sure that you develop HTML-compliant and accessible pages from the outset. Use cascading style sheets where possible to separate content from visual design presentation. This can give you more flexibility and improve the accessibility of your content.

    You should also test on real devices and assistive tools throughout development for the following basic accessibility considerations:

    Keyboard navigation

    Users should be able to tab around the screen to access each area of the site, including close any potential pop-up windows without using the mouse. Visually impaired users may not be able to see a cursor and may rely on text-to-speech software to tell them where the focus is on the page.

    High colour contrast

    Contrast ratio between text and background needs to meet minimum standards (WCAG 2.1 AA minimum 4.5:1 ratio) to ensure those with visual impairments or reading disability can still access the site. Colour is a strong design element, but avoid using it to convey information. It will be inaccessible to colour-blind people, as well as screen readers.

    Clear site structure

    Use proper headings (H1, H2, H3...) and semantic HTML for lists, tables and other structural elements to give meaning to a web page or order of information. Make sure that all functionality is available from a keyboard or via screen reader and that you provide headings in an appropriate hierarchical order to aid navigation and understanding.

    If you are using tabular data, introduce table headers so that screen readers can understand them.

    Image alt text 

    Text alternatives convey the purpose of an image or function to provide an equivalent user experience. They are commonly added to graphic content, such as pictures, icons, button, illustrations and charts. They help people who have visual impairments and may rely on screen readers to navigate a site. Decorative images should get empty alt text (alt="").

    Video and audio

    Add captions, narrations or transcripts for media, both archived and live. 

    Form labels consistency

    Every form element, such as text field, checkbox or dropdown list, should be marked using the 'label' element. Users should be able to navigate, understand and input form data without being able to see the page (eg using a screen reader). This includes recovery from any errors, such as the failure to fill in all required fields.

    Meaningful links

    Screen reader users may choose to read only the links on a web page, so link text should make sense even if read out of context. Avoid ambiguous phrases like 'clink here' or 'more'.

    File format

    Distinguish between different types of content, including PDF files, Word documents, PowerPoint presentations and flash content. If you can't make them accessible, consider using HTML or alternative. Users should be able to navigate and read any downloadable material by using assistive technology.

    Skip repetitive elements

    Provide a 'skip to main content' or 'skip navigation' link to help a user with impaired mobility or relying on a screen reader to access content more quickly.

    Clear and easy-to-read content

    Content should be accessible to people with diverse cognitive abilities as well. Write it in plain English and make it as simple, and as easy to read as possible.

    Please note this is not a complete list of all accessibility requirements. These are only some of the main considerations of accessible design. You can implement most of these easily without any effect on your site's look and feel.

    For more recommendations, see W3C's detailed guidance on accessibility principles.

    Actions
    W3C Web Accessibility Initiative
    Disability Discrimination Act 1995
    Code of Practice: Rights of access to goods, facilities, services and premises …
    Also on this site
    Set up a small business website
    Disabled access and facilities in business premises
    User-centred design
    Content category
    IT

    Source URL

    /content/best-practices-accessible-websites

    Links

  • Characteristics of a user-friendly website

    Understand why usability matters in web design and how to design your website to meet user requirements.

    User-friendly design - or usability - is crucial to the success of any website. It helps visitors find information fast, reduces frustration and increases user satisfaction.

    What makes a website user friendly?

    User-friendly is a term that describes features and functions that make using a device, system or website easier. There are many ways to define 'user-friendly' and many more ways to put this concept into practice across your website or application.

    Examples of user-friendly elements may include:

    • intuitive graphical user interfaces (GUIs)
    • descriptive and clear navigations
    • helpful visual cues
    • online help systems
    • customisation

    Tips for building a user-friendly website

    Here are some essential characteristics you should include in your website to make sure your visitors find the information they need quickly and easily.

    User interaction

    While you are planning your website, think about:

    • who your users are
    • what they will want to do when they come to your site
    • how they will want to interact with your website
    • how you can use links to help the user navigate around your site

    Use linked text and short descriptions, and organise links into related topics. When using internal links, make sure that the user always knows where they are and what they need to do to return to the higher levels of the site. Remember also to follow best practices for accessible websites.

    Hierarchy of information

    Don't make users navigate through too many layers of the site to find the information they want. Provide clear navigation aids so the user can quickly find the information they need. A standard navigation bar that is in the same place on every page enables the user to move quickly through the site. Follow accepted conventions for website navigation - this will help make your website more intuitive for the user.

    Balanced content and layout

    Consider how much content you should put on a webpage. Avoid putting too much, as it may prevent the user from locating the information they need. Use links to divide content between pages. Use elements like headings and subheadings to help users scan the page before reading it in more detail.

    Also, think about where you place elements on the page. For example, marketing messages or 'calls to action' may be more effective if placed 'above the fold'. This refers to the area of the page that is immediately visible once the page has loaded and before the user has scrolled down the page in the browser window. Find out how to plan your website content and structure.

    Mobile compatibility

    People are increasingly using mobile phones and tablets to access the internet, so optimising your website for mobile is a necessity. Create a responsive design that adapts to all screen sizes. Test touch targets (minimum 44x44 pixels) and fast mobile loading. See more on mobile website design best practices.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    User-centred design
    Design support for your business
    Set up a small business website
    Content category
    IT

    Source URL

    /content/characteristics-user-friendly-website

    Links

  • Consistency in web design

    Understand how visual elements of website design, including branding and design continuity, can affect the success of your website.

    Consistency is a key factor in web design for both visual elements and functionality. It ensures that your website looks coherent and works harmoniously across all its different elements, such as headers, footers, sidebars and navigation bars. It also:

    • gives your users a more positive experience
    • enables users to carry out tasks more quickly and efficiently
    • improves usability and learnability of your website
    • eliminates pain points and difficult navigation
    • saves money and time on design

    Consistent navigation

    Navigation elements offer users a road map to all the different areas and information within the site. In order to work effectively, navigation should be clear and consistent across your website. Place navigation menus in the same position on every page (usually top or left sidebar). Use the same labels and order throughout.

    Visitors to your website should be able to move from page-to-page easily and always know where they are. Difficult website navigation can tempt them to leave your site.

    Page layouts and menu structure

    It is a good idea to use templates to create a common page layout across your site. Create smooth transitions between pages by having consistent elements on each page. For example:

    • have same fonts and colours throughout the site
    • have a clear, visual hierarchy to the elements on your page
    • ensure that your business logo appears on each page
    • make sure that your logo links back to the homepage
    • include a search box on each page in the same location

    You should also consider the placement of any marketing messages and 'calls to action', such as newsletter sign-up, special offers or discounted products or services. Place these prominently as positioning can improve customer response rates.

    Fonts and typography

    Designing for a website restricts your font choices. If you specify a font that a user does not have on their computer or mobile device, their browser will substitute a default font, changing the look of the page.

    It is best practice to choose standard fonts for pages and specify a font family (typically about two or three) - this will help reduce the possibility of the page being displayed using system fonts. The web page will also look clearer if you choose fewer fonts and type sizes.

    Remember to test your web pages on multiple browsers to see what effect these have on the overall appearance.

    Branding in web design

    If you already have a recognisable brand, logo, colours or tone, make sure to incorporate them into your design. Your website should:

    • reinforce your corporate brand
    • use your logo and visual image consistently throughout the site
    • be part of your wider marketing strategy in an attempt to reach your target audience

    While you are making sure that your website is consistent and true to your brand, don't forget it also needs to be accessible and usable. Read about web accessibility issues.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Designing a successful brand
    Set up a small business website
    User-centred design
    Content category
    IT

    Source URL

    /content/consistency-web-design

    Links

  • Website navigation best practice

    How to develop a simple and consistent navigation scheme to help visitors quickly find the information they require.

    When it comes to websites, the navigation acts like a compass guiding users to different areas around the site. Keeping it simple, organised and consistent throughout the website helps with the overall user experience.

    Navigation bars and buttons

    Navigation menus are most often placed horizontally at the top of a website, or vertically on the left. It is important to be:

    • consistent with the placement of navigation - this can increase the visual appeal of your design and make it easier for the users to find their way around your site
    • clear and concise when assigning categories in your navigation - this can help users to quickly and easily access information about your company or products

    Remember also that every graphic you add to your website for navigational purposes increases the download time for the user, so keep navigation buttons simple and reuse the same ones throughout your site.

    Ease of finding information

    The success of your website will largely depend on how easy it is for users to find the information that they require. In addition to providing good navigation, you can help your users find information by including:

    • a site map
    • a search facility
    • well-organised content
    • content planned and tested with users in mind

    You can also use links within your site to relate different ideas or content. Try to anticipate what information users are likely to want next, but at the same time leave them free to make their own navigational choices.

    Follow the 'three click rule'

    The 'three click rule' is an unofficial design rule that suggests that users should reach any information in no more than three clicks from the homepage. For complex sites, use breadcrumb trails (eg Home > Services > Web design) to show their location and aid backtracking.

    On mobile phones and tablets, use hamburger menus (three-line icon) or bottom navigation tabs. Ensure touch targets are large enough (minimum 44x44 pixels) and spacing prevents accidental taps.

    Mobile responsiveness may also help with optimising your website for search engines. For more, see search engine optimisation.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    User-centred design
    Content management systems
    Set up a small business website
    Content category
    IT

    Source URL

    /content/website-navigation-best-practice

    Links

  • Mobile web design best practice

    Find out how to create a mobile-friendly website, and choose between mobile-dedicated, responsive or adaptive design.

    Most users now access websites on smartphones. A mobile-optimised site prevents lost sales and improves your search rankings.

    If your company relies on a desktop website, at the very least you should check how compatible it is with mobile devices. If your customers can't access your website on the go, you may well be missing out on potential sales and business.

    How to create a mobile-friendly website?

    You can take different approaches to create a mobile-friendly website. The three most common strategies are:

    • responsive design
    • adaptive design
    • designing a separate mobile version of your website

    There are pros and cons to each. What is best for your business will depend on your circumstances, your existing website and the experience you wish to provide to your customers.

    What is responsive design?

    Responsive web design involves using HTML and CSS to create grids, layouts and other website elements that automatically respond and adapt to the user's device based on screen size, platform and orientation.

    Such design provides an optimal viewing experience across a wide range of devices. It also removes the need to have two separate versions of the website and duplicate content. This makes responsive sites easier to maintain and configure for search engines. Learn more about responsive web design.

    Responsive vs adaptive design

    Adaptive design involves creating several distinct layouts for specific screen sizes, including mobile phones, tablets and desktop computers. The website detects the type of device a user is accessing from and delivers the pre-set layout for that particular device.

    This can work well and preserve resources if you wish to retrofit an existing desktop site. However, the results don't always display optimally on a wide variety of screen sizes. Most new websites now use responsive as it takes less work to build and maintain.

    Separate website for mobile and desktop

    Some businesses choose to take the 'separate websites' approach. They create mobile-dedicated websites designed specifically for mobile devices.

    This strategy uses server-side logic to send a different version of the site to a user depending on the device they are using. There are typically higher costs associated with maintenance of, what is effectively, two different versions of the site, and greater potential for issues around search engine indexation.

    Tips for mobile web design

    When designing a mobile website, regardless of the approach you take, basic web design principles still apply. Keep the website as simple as possible and consider:

    • Using CSS layouts (cascading style sheets) - to support cross platform compatibility.
    • Page layout and information hierarchy given the limited screen space - divide content into smaller segments across pages to minimise download time and make them easier to read.
    • The types of content that you use - eg the use of rich media (including animations and video). These will increase download times and may not be supported across all devices.
    • The placement of navigation and its ease of use on mobile devices - consider visual cues to provide a better user experience. Use spacing between buttons to extend the clickable area.
    • Use mobile-appropriate technology - such as drop-down lists or radio buttons for information input, rather than entering free text (which can be difficult on a keypad).
    • Optimising e-commerce functionality for mobile, eg the shopping cart - reduce the steps customers have to take to complete a purchase to improve conversion rates.
    • If you have a separate mobile version of your website, as opposed to a responsive site, always give users the option to visit your main website and vice versa.

    Remember to test your designs - use Google's Mobile-Friendly Test tool and Chrome DevTools device simulation, and always test on actual phones, since emulators can miss touch accuracy and network speed issues. See also mobile marketing and m-commerce.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    User-centred design
    Mobile technology
    Content category
    IT

    Source URL

    /content/mobile-web-design-best-practice

    Links

Business websites: legal requirements

In this guide:

  • Planning your website

    How to set clear objectives for your website, plan its purpose and work out its structure, design and content.

    Planning is essential when it comes to designing a website. Lack of planning can lead to money lost, poor user experience and a website that reflects negatively on your business.

    Set your website objectives

    Website planning begins by first identifying your website's purpose. Typical reasons why businesses develop websites include:

    • building brand awareness
    • finding new customers
    • saving money through online processes
    • selling products or services
    • improving customer support

    The key to effective planning is realising that you are not building a website for yourself. You're creating it for your prospective audience, which can include your current customers, new prospects, stakeholders, suppliers and partners.

    Plan your website content

    Decide on the type of content you will need to support the objectives of your site and how to present this online. Think about balancing the amount of text, images and interactive content that you wish to publish on your site. Look at what your competitors are doing and try to understand what the business opportunities are for your website.

    Learn as much as you can about the audience you are trying to reach. Think about:

    • what will make them visit your website
    • what they will want when they get there
    • what will encourage them to return

    If you are creating an e-commerce website, provide unique descriptions for your products or services. This will help with search engine optimisation and ensure that you stand apart from your competitors.

    Thorough market research will help you lay a firm foundation for your website. You will want to research your competitors, your products, your target markets and consider internal resources and processes to inform your project.

    See how to set up an e-commerce website (video tutorial).

    When you are planning content for your site, don't forget you are legally required to publish certain company information - see business websites: legal requirements.

    Plan your website structure

    When it comes to planning your website, it may help to sketch your site structure using a site map, wireframes or simple tools like Word or PowerPoint, or use free online tools that serve a similar purpose. 

    Create a flowchart showing:

    • main pages (eg homepage, about, contact us)
    • sub-pages and key sections
    • logical user flow from entry points to key actions (eg buy now' or 'contact form')

    Use bulleted lists or indentations if software is unavailable. Label each page with its purpose, priority (high/medium/low) and key content. 

    You may want to share your draft site map with a few target users or colleagues. Ask if they can find key information (eg products, contact details) in three clicks or fewer, and refine the structure based on feedback.

    Aim to make your customer journey as simple as possible - the principles of user-centred design can help with this.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    Planning for e-commerce
    Content management systems
    Content category
    IT

    Source URL

    /content/planning-your-website

    Links

  • Business websites: legal requirements

    Check what information you must publish on your business website to meet UK legal requirements and avoid fines or reputational damage.

    As a UK-registered business, you must display key details about your company on your website. Failure to do so can lead to fines, regulatory action, customer complaints, and damaged reputation.

    Publish registered business details

    You must display on your website the registered information relating to your business's identity. This includes:

    • your company name
    • registered number
    • place of registration
    • registered office address
    • contact details, including an email address
    • how to contact the business by non-electronic means (eg phone or post)
    • VAT number of business, if applicable
    • details of any trade body or regulator registration

    For sole traders and partnerships, you must display the address of the primary place of business. If the company is in liquidation, you must also display this information on your website.

    This information doesn't have to be on every page of your website, but it must be easily found. For example, you might want to put it on the 'contact us' or 'about us' page. Some websites have this information in the footer section of each page.

    Privacy and cookie information

    As well as registered information, you must also publish on your site:

    • a privacy notice - to explain what personal data you collect and how you use it
    • a cookie statement - to explain how you use cookies on your site (see more below)
    • a website disclaimer - to outline liability for the use of your website and its information

    Read about privacy information under the UK General Data Protection Regulation.

    Cookie information and consent

    Under privacy laws, you must tell users if you set cookies on your website, unless those cookies are strictly necessary to provide an online service they have requested (for example, to remember items in a shopping basket or ensure security in online banking).

    For non-essential cookies (such as those used for analytics and marketing), you must get consent via a banner or pop-up. Consent must be clear, granular, and include an option to 'accept all' or 'reject all' cookies. Pre-ticked boxes are not allowed.

    You must also explain in a clear statement what these cookies do and why. Your cookie statement can appear as a standalone page on your website or in your privacy policy.

    The Information Commissioner's Office provides more information about cookies and similar technologies. See our sample privacy notice and sample website disclaimer if you need these documents for your business.

    Selling online to consumers

    If you sell online, you must also include on your website:

    These are all required as part of the consumer protection regulations. As a website operator, you will also have a legal duty to address any web accessibility issues on your website.

    Actions
    Invest NI’s ICT support for business
    Also on this site
    Set up a small business website
    UK General Data Protection Regulation (UK GDPR)
    Privacy and data protection in direct marketing
    Content category
    IT

    Source URL

    /content/business-websites-legal-requirements

    Links

  • Main technical issues in web design

    Find out how browsers, screen resolutions, download speeds and technologies affect website design and user experience.

    Before you create a website, you should consider technical issues relating to web design that impact how users view and interact with your site across devices. Specifically, you should consider:

    • browser compatibility
    • screen resolutions
    • web technologies
    • internet speed

    Browser issues and web design

    Web pages should be able to display correctly across different browsers - popular options include Firefox, Chrome, Edge, Safari and Opera. Test for compatibility issues in as many browsers and operating systems as you can, on most recent browser versions, as well as the older ones - not all of your visitors may be using up-to-date software.

    If you are updating an existing site, use web analytics tools to see what browsers your customers use most to access your website. This helps you prioritise testing.

    Design your website for common screen sizes

    In 2026, typical screen sizes include:

    • 1366x768 pixels for desktops
    • 375x667 pixels for mobile screens
    • 768x1024 pixels for tablets

    Higher resolutions, such as 1920x1080 pixels for desktops and 414x896 for mobiles, are gaining in popularity. It's important to consider these sizes carefully. If you design your website for higher resolutions, some low-resolution screens and older devices may not be able to display all of your content. Design responsively to avoid cutting off content on smaller screens, and read more about mobile web design best practices.

    Download speeds and design

    Not all internet users have high-speed access, so connection speed should also influence your webpage design. Research suggests that:

    • nearly half of web users expect a webpage to load in 2 seconds or less
    • 40 per cent of people abandon a website that takes more than 3 seconds to load

    To minimise risks of slow response times, reduce image sizes, avoid heavy animations or video on key pages, and use modern formats like WebP. Average webpage size is now around 2MB - aim lower for better performance and SEO. Slow sites can hurt both user retention and search rankings. 

    Avoid problematic technology

    Some older web technologies can prevent users from viewing your site or break accessibility, usability or search indexing. These include:

    • HTML frames
    • heavy Javascript that blocks content
    • Flash (now obsolete)
    • complex AJAX without fallback

    Whenever possible, choose modern, accessible alternatives. See more on web accessibility issues and learn how to design a user-friendly website.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Content management systems
    User-centred design
    Set up a small business website
    Content category
    IT

    Source URL

    /content/main-technical-issues-web-design

    Links

  • Web accessibility issues

    If your business has a website, it should be accessible to disabled users for ethical, commercial and legal reasons.

    In Northern Ireland, the Disability Discrimination Act 1995 (DDA) makes it unlawful to discriminate against disabled people through your website. This applies to websites offering goods, services or facilities to the public.

    In practice, this means that your website must be designed in a way that allows disabled people to access it, eg by using auxiliary aids or services such as screen readers.

    Elsewhere in the UK, the Equality Act 2010 replaced the DDA, but similar duties apply. 

    Why web accessibility matters

    Accessibility means designing websites that people with visual, hearing, mobility or cognitive impairments can use. Almost 1 in 5 people in Northern Ireland have a disability (2025 data). Good accessibility improves your site's usability for everyone, boosts SEO and widens your customer base. 

    Follow Web Accessibility Standards

    The World Wide Web Consortium (W3C) has produced accepted accessibility guidelines for websites. These set out three levels of conformance:

    •  A (priority 1) – the minimum level of access has been met
    • AA (priority 2) – an acceptable level of access has been met
    • AAA (priority 3) – a completely accessible website

    The UK government recommends that websites must satisfy priority 1 and should satisfy priority 2 of the guidelines.

    Check if your website is accessible

    You can use a range of free online tools and services to check if your site is accessible. Examples of these tools include WAVE and Lighthouse (in Chrome DevTools) for automatic testing. Test manually with a screen reader like NVDA (free) or VoiceOver (Mac).

    Make reasonable adjustments for disabled website users

    If your website isn't accessible, it may put a disabled person at a substantial disadvantage compared to people who are not disabled. You may be required under the DDA to make 'reasonable adjustments'.

    This means that, by law, you must:

    • change a practice, policy or procedure that makes it impossible or unreasonably difficult for disabled people to use your service - eg using very small text that puts vision-impaired people at a disadvantage
    • provide an auxiliary aid or service if it would enable (or make it easier for) disabled people to use the service - eg offering an alternative point and click interface for visitors that can't use a keyboard

    The Equality Commission for Northern Ireland (ECNI) has published a range of resources that deal with the rights of access to goods, facilities, services (including online services) and premises. These resources include:

    • advisory guides for employers and service providers
    • good practice videos
    • publications and relevant codes of practice
    • customisable templates, checklists and policies
    • links to further help and advice from other organisations

    Browse ECNI's resources on accessible goods and services and see suggestions of our best practices for accessible websites.

    The WC3 website provides detailed guidance and resources on getting started with web accessibility.

    Actions
    Diverse abilities and barriers
    W3C Web Accessibility Initiative
    Invest NI's ICT support for business
    Code of Practice: Rights of access to goods, facilities, services and premises …
    Also on this site
    Set up a small business website
    Disabled access and facilities in business premises
    User-centred design
    Content category
    IT

    Source URL

    /content/web-accessibility-issues

    Links

  • Best practices for accessible websites

    Find out how to comply with accessibility legislation and make your website accessible to users with a wide range of abilities.

    Accessibility is essential for good web design. For public authorities and commercial websites in Northern Ireland, it is also a legal requirement under the Disability Discrimination Act 1995.

    Why is web accessibility important for businesses?

    People with disabilities use a wide range of tools and techniques to help them navigate the web. For example, some may configure standard software such as browsers to their specific needs. Other users may prefer to use specialised tools, eg screen or text readers, assistive scanning keyboards, etc.

    For these tools to work, you must build websites and applications in a way that supports the use of assistive technologies.

    How to improve web accessibility

    If you are building a website from scratch or redesigning it, make sure that you develop HTML-compliant and accessible pages from the outset. Use cascading style sheets where possible to separate content from visual design presentation. This can give you more flexibility and improve the accessibility of your content.

    You should also test on real devices and assistive tools throughout development for the following basic accessibility considerations:

    Keyboard navigation

    Users should be able to tab around the screen to access each area of the site, including close any potential pop-up windows without using the mouse. Visually impaired users may not be able to see a cursor and may rely on text-to-speech software to tell them where the focus is on the page.

    High colour contrast

    Contrast ratio between text and background needs to meet minimum standards (WCAG 2.1 AA minimum 4.5:1 ratio) to ensure those with visual impairments or reading disability can still access the site. Colour is a strong design element, but avoid using it to convey information. It will be inaccessible to colour-blind people, as well as screen readers.

    Clear site structure

    Use proper headings (H1, H2, H3...) and semantic HTML for lists, tables and other structural elements to give meaning to a web page or order of information. Make sure that all functionality is available from a keyboard or via screen reader and that you provide headings in an appropriate hierarchical order to aid navigation and understanding.

    If you are using tabular data, introduce table headers so that screen readers can understand them.

    Image alt text 

    Text alternatives convey the purpose of an image or function to provide an equivalent user experience. They are commonly added to graphic content, such as pictures, icons, button, illustrations and charts. They help people who have visual impairments and may rely on screen readers to navigate a site. Decorative images should get empty alt text (alt="").

    Video and audio

    Add captions, narrations or transcripts for media, both archived and live. 

    Form labels consistency

    Every form element, such as text field, checkbox or dropdown list, should be marked using the 'label' element. Users should be able to navigate, understand and input form data without being able to see the page (eg using a screen reader). This includes recovery from any errors, such as the failure to fill in all required fields.

    Meaningful links

    Screen reader users may choose to read only the links on a web page, so link text should make sense even if read out of context. Avoid ambiguous phrases like 'clink here' or 'more'.

    File format

    Distinguish between different types of content, including PDF files, Word documents, PowerPoint presentations and flash content. If you can't make them accessible, consider using HTML or alternative. Users should be able to navigate and read any downloadable material by using assistive technology.

    Skip repetitive elements

    Provide a 'skip to main content' or 'skip navigation' link to help a user with impaired mobility or relying on a screen reader to access content more quickly.

    Clear and easy-to-read content

    Content should be accessible to people with diverse cognitive abilities as well. Write it in plain English and make it as simple, and as easy to read as possible.

    Please note this is not a complete list of all accessibility requirements. These are only some of the main considerations of accessible design. You can implement most of these easily without any effect on your site's look and feel.

    For more recommendations, see W3C's detailed guidance on accessibility principles.

    Actions
    W3C Web Accessibility Initiative
    Disability Discrimination Act 1995
    Code of Practice: Rights of access to goods, facilities, services and premises …
    Also on this site
    Set up a small business website
    Disabled access and facilities in business premises
    User-centred design
    Content category
    IT

    Source URL

    /content/best-practices-accessible-websites

    Links

  • Characteristics of a user-friendly website

    Understand why usability matters in web design and how to design your website to meet user requirements.

    User-friendly design - or usability - is crucial to the success of any website. It helps visitors find information fast, reduces frustration and increases user satisfaction.

    What makes a website user friendly?

    User-friendly is a term that describes features and functions that make using a device, system or website easier. There are many ways to define 'user-friendly' and many more ways to put this concept into practice across your website or application.

    Examples of user-friendly elements may include:

    • intuitive graphical user interfaces (GUIs)
    • descriptive and clear navigations
    • helpful visual cues
    • online help systems
    • customisation

    Tips for building a user-friendly website

    Here are some essential characteristics you should include in your website to make sure your visitors find the information they need quickly and easily.

    User interaction

    While you are planning your website, think about:

    • who your users are
    • what they will want to do when they come to your site
    • how they will want to interact with your website
    • how you can use links to help the user navigate around your site

    Use linked text and short descriptions, and organise links into related topics. When using internal links, make sure that the user always knows where they are and what they need to do to return to the higher levels of the site. Remember also to follow best practices for accessible websites.

    Hierarchy of information

    Don't make users navigate through too many layers of the site to find the information they want. Provide clear navigation aids so the user can quickly find the information they need. A standard navigation bar that is in the same place on every page enables the user to move quickly through the site. Follow accepted conventions for website navigation - this will help make your website more intuitive for the user.

    Balanced content and layout

    Consider how much content you should put on a webpage. Avoid putting too much, as it may prevent the user from locating the information they need. Use links to divide content between pages. Use elements like headings and subheadings to help users scan the page before reading it in more detail.

    Also, think about where you place elements on the page. For example, marketing messages or 'calls to action' may be more effective if placed 'above the fold'. This refers to the area of the page that is immediately visible once the page has loaded and before the user has scrolled down the page in the browser window. Find out how to plan your website content and structure.

    Mobile compatibility

    People are increasingly using mobile phones and tablets to access the internet, so optimising your website for mobile is a necessity. Create a responsive design that adapts to all screen sizes. Test touch targets (minimum 44x44 pixels) and fast mobile loading. See more on mobile website design best practices.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    User-centred design
    Design support for your business
    Set up a small business website
    Content category
    IT

    Source URL

    /content/characteristics-user-friendly-website

    Links

  • Consistency in web design

    Understand how visual elements of website design, including branding and design continuity, can affect the success of your website.

    Consistency is a key factor in web design for both visual elements and functionality. It ensures that your website looks coherent and works harmoniously across all its different elements, such as headers, footers, sidebars and navigation bars. It also:

    • gives your users a more positive experience
    • enables users to carry out tasks more quickly and efficiently
    • improves usability and learnability of your website
    • eliminates pain points and difficult navigation
    • saves money and time on design

    Consistent navigation

    Navigation elements offer users a road map to all the different areas and information within the site. In order to work effectively, navigation should be clear and consistent across your website. Place navigation menus in the same position on every page (usually top or left sidebar). Use the same labels and order throughout.

    Visitors to your website should be able to move from page-to-page easily and always know where they are. Difficult website navigation can tempt them to leave your site.

    Page layouts and menu structure

    It is a good idea to use templates to create a common page layout across your site. Create smooth transitions between pages by having consistent elements on each page. For example:

    • have same fonts and colours throughout the site
    • have a clear, visual hierarchy to the elements on your page
    • ensure that your business logo appears on each page
    • make sure that your logo links back to the homepage
    • include a search box on each page in the same location

    You should also consider the placement of any marketing messages and 'calls to action', such as newsletter sign-up, special offers or discounted products or services. Place these prominently as positioning can improve customer response rates.

    Fonts and typography

    Designing for a website restricts your font choices. If you specify a font that a user does not have on their computer or mobile device, their browser will substitute a default font, changing the look of the page.

    It is best practice to choose standard fonts for pages and specify a font family (typically about two or three) - this will help reduce the possibility of the page being displayed using system fonts. The web page will also look clearer if you choose fewer fonts and type sizes.

    Remember to test your web pages on multiple browsers to see what effect these have on the overall appearance.

    Branding in web design

    If you already have a recognisable brand, logo, colours or tone, make sure to incorporate them into your design. Your website should:

    • reinforce your corporate brand
    • use your logo and visual image consistently throughout the site
    • be part of your wider marketing strategy in an attempt to reach your target audience

    While you are making sure that your website is consistent and true to your brand, don't forget it also needs to be accessible and usable. Read about web accessibility issues.

    Actions
    Invest NI's ICT support for business
    Also on this site
    Designing a successful brand
    Set up a small business website
    User-centred design
    Content category
    IT

    Source URL

    /content/consistency-web-design

    Links

  • Website navigation best practice

    How to develop a simple and consistent navigation scheme to help visitors quickly find the information they require.

    When it comes to websites, the navigation acts like a compass guiding users to different areas around the site. Keeping it simple, organised and consistent throughout the website helps with the overall user experience.

    Navigation bars and buttons

    Navigation menus are most often placed horizontally at the top of a website, or vertically on the left. It is important to be:

    • consistent with the placement of navigation - this can increase the visual appeal of your design and make it easier for the users to find their way around your site
    • clear and concise when assigning categories in your navigation - this can help users to quickly and easily access information about your company or products

    Remember also that every graphic you add to your website for navigational purposes increases the download time for the user, so keep navigation buttons simple and reuse the same ones throughout your site.

    Ease of finding information

    The success of your website will largely depend on how easy it is for users to find the information that they require. In addition to providing good navigation, you can help your users find information by including:

    • a site map
    • a search facility
    • well-organised content
    • content planned and tested with users in mind

    You can also use links within your site to relate different ideas or content. Try to anticipate what information users are likely to want next, but at the same time leave them free to make their own navigational choices.

    Follow the 'three click rule'

    The 'three click rule' is an unofficial design rule that suggests that users should reach any information in no more than three clicks from the homepage. For complex sites, use breadcrumb trails (eg Home > Services > Web design) to show their location and aid backtracking.

    On mobile phones and tablets, use hamburger menus (three-line icon) or bottom navigation tabs. Ensure touch targets are large enough (minimum 44x44 pixels) and spacing prevents accidental taps.

    Mobile responsiveness may also help with optimising your website for search engines. For more, see search engine optimisation.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    User-centred design
    Content management systems
    Set up a small business website
    Content category
    IT

    Source URL

    /content/website-navigation-best-practice

    Links

  • Mobile web design best practice

    Find out how to create a mobile-friendly website, and choose between mobile-dedicated, responsive or adaptive design.

    Most users now access websites on smartphones. A mobile-optimised site prevents lost sales and improves your search rankings.

    If your company relies on a desktop website, at the very least you should check how compatible it is with mobile devices. If your customers can't access your website on the go, you may well be missing out on potential sales and business.

    How to create a mobile-friendly website?

    You can take different approaches to create a mobile-friendly website. The three most common strategies are:

    • responsive design
    • adaptive design
    • designing a separate mobile version of your website

    There are pros and cons to each. What is best for your business will depend on your circumstances, your existing website and the experience you wish to provide to your customers.

    What is responsive design?

    Responsive web design involves using HTML and CSS to create grids, layouts and other website elements that automatically respond and adapt to the user's device based on screen size, platform and orientation.

    Such design provides an optimal viewing experience across a wide range of devices. It also removes the need to have two separate versions of the website and duplicate content. This makes responsive sites easier to maintain and configure for search engines. Learn more about responsive web design.

    Responsive vs adaptive design

    Adaptive design involves creating several distinct layouts for specific screen sizes, including mobile phones, tablets and desktop computers. The website detects the type of device a user is accessing from and delivers the pre-set layout for that particular device.

    This can work well and preserve resources if you wish to retrofit an existing desktop site. However, the results don't always display optimally on a wide variety of screen sizes. Most new websites now use responsive as it takes less work to build and maintain.

    Separate website for mobile and desktop

    Some businesses choose to take the 'separate websites' approach. They create mobile-dedicated websites designed specifically for mobile devices.

    This strategy uses server-side logic to send a different version of the site to a user depending on the device they are using. There are typically higher costs associated with maintenance of, what is effectively, two different versions of the site, and greater potential for issues around search engine indexation.

    Tips for mobile web design

    When designing a mobile website, regardless of the approach you take, basic web design principles still apply. Keep the website as simple as possible and consider:

    • Using CSS layouts (cascading style sheets) - to support cross platform compatibility.
    • Page layout and information hierarchy given the limited screen space - divide content into smaller segments across pages to minimise download time and make them easier to read.
    • The types of content that you use - eg the use of rich media (including animations and video). These will increase download times and may not be supported across all devices.
    • The placement of navigation and its ease of use on mobile devices - consider visual cues to provide a better user experience. Use spacing between buttons to extend the clickable area.
    • Use mobile-appropriate technology - such as drop-down lists or radio buttons for information input, rather than entering free text (which can be difficult on a keypad).
    • Optimising e-commerce functionality for mobile, eg the shopping cart - reduce the steps customers have to take to complete a purchase to improve conversion rates.
    • If you have a separate mobile version of your website, as opposed to a responsive site, always give users the option to visit your main website and vice versa.

    Remember to test your designs - use Google's Mobile-Friendly Test tool and Chrome DevTools device simulation, and always test on actual phones, since emulators can miss touch accuracy and network speed issues. See also mobile marketing and m-commerce.

    Actions
    Web content accessibility guidance
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    User-centred design
    Mobile technology
    Content category
    IT

    Source URL

    /content/mobile-web-design-best-practice

    Links

What is website hosting?

In this guide:

  • What is website hosting?

    How web hosting works and what you need to get your small business website online.

    The term 'web hosting' usually refers to companies renting out space on their web servers to businesses or individuals who wish to make their websites available on the internet.

    What does it mean to host a site?

    Hosting means storing all the files that make up your website - such as HTML pages, images, audio and video - on a web server. When someone visits your site, the server sends these files to their browser so they can see and interact with your website. Each hosted website is assigned a unique internet protocol (IP) address. This lets visitors use your website's address (ie the domain name) to find and access the site via an internet browser. 

    Read about the difference between a domain and web hosting to understand how these two elements work together.

    Types of web hosting

    There are three main ways a business can host a website. You can:

    • host it on your own server in-house
    • outsource it to an external hosting provider
    • host it on a server owned and operated by an internet service provider (ISP)

    Hosting your own web server in-house can be expensive and requires technical skills, hardware, and a reliable, high‑speed internet connection. It also means you are responsible for maintenance, security and 24‑hour support. As an alternative, you can buy hosting services from an external provider, such as an internet service provider.

    Types of web hosting services

    If you choose external hosting, you will usually have a choice between three types of web servers:

    • shared hosting - where your website shares a server with other websites
    • dedicated hosting - where your website is the only one on a server
    • virtual hosting - including cloud hosting, where your website runs on a virtual server that can scale up or down as needed

    As well as the server space, many hosting providers offer value-added services, such as:

    • easy-to-use website building tools
    • site statistics
    • search engine optimisation features
    • shopping carts
    • one-click app installers
    • unlimited number of email addresses
    • customer support
    • other control, maintenance and safety features

    How much does it cost to host a website?

    If you are a sole trader or small business, you can host a basic website on a free web host. However, free hosts often have more downtime, limited features and less reliable support. You may also be restricted in how you present your brand or use your own domain name.

    If your website is important to your business – for example, if you sell online or rely on it for customer enquiries – a commercial web host is usually a better choice. Commercial hosting plans vary in price depending on:

    • hosting provider
    • the service they provide as part of the package
    • the size of your website
    • the expected traffic to your website
    • whether you need email addresses
    • whether you need e-commerce functionality or advanced features

    On average, small business shared hosting can start from a low monthly fee, while dedicated or scalable cloud hosting is more expensive but offers better performance and security. With many hosting options available, it can be difficult to know what to look for. There are many factors to consider when choosing a web hosting provider.

    Actions
    What is a web hosting service?
    Invest NI’s ICT support for business
    Also on this site
    Set up a small business website
    Best practice in web design
    Content management systems
    Content category
    IT

    Source URL

    /content/what-website-hosting

    Links

  • Factors to consider when choosing a web hosting provider

    Key considerations when choosing a web hosting plan include your website's functionality, performance and reliability.

    There are many different factors to consider when choosing a web host. The most important ones relate to your website's functionality, performance, reliability and security. Each of these can significantly affect how well your site works for your customers and whether it meets your business needs.

    Website functionality

    The functionality of your website depends on the software and tools it uses. This can affect:

    • the range of features your site offers, such as forms, blogs, or e-commerce
    • how you update or edit your content
    • how complex or interactive your website is

    When choosing a hosting provider, make sure they support the applications, scripts or software your website needs - for example, content management systems such as WordPress or Drupal. If you do not have in‑house technical expertise, ask your web designer or internet service provider for advice. You should also follow best practice in web design to keep your site simple, secure and easy to maintain.

    Website performance

    To perform well, your website needs a fast, stable connection to the internet. The speed and capacity of your host's network (often called the 'backbone') affects how quickly visitors can load your pages. If your connection is too slow or your server is overloaded, pages may take a long time to load or may fail to load at all, especially during busy periods. 

    Type of web server

    Your choice of web server also affects the performance of your site. You can either go for:

    • a dedicated server - where only your site is hosted on the machine
    • a shared hosting service - where you share the machine with other sites

    Shared hosting can reduce costs, but may slow down your site if other customers use a lot of resources. The server specification - such as processor speed, memory and disk space - is important for how well your site runs. 

    Website reliability and uptime

    Your website should be available 24/7, especially if it is central to your business. Even with good hosting, some downtime is possible, but many providers offer service level agreements (SLAs) that promise a high level of uptime. When you choose a host, check:

    • their typical uptime percentage
    • how they respond to outages
    • what compensation they offer if the service falls below claimed uptime

    If your business relies heavily on your website, you should also plan for contingencies - for example, clear communication channels if your site goes offline.

    Website hosting security

    Security is an ongoing concern for any device open to the internet. Your hosting provider should take steps to protect your website and data from hackers, fraudsters and other attacks.

    Your web host should, at the very least, offer:

    • backups and restore points - stored securely away from the main server
    • disaster recovery plans - to help you recover your website in case of system failures
    • network monitoring - to spot unusual activity and mitigate risks
    • firewalls - including other basic intrusion prevention methods
    • antivirus and malware scanning and removal
    • SSL (secure sockets layer) certificates, if you need to transfer sensitive data such as online payments to and from the server
    • some level of management support - most crucially with file management, access and user permissions, logins, applications, software updates, etc

    You should also follow wider cyber security best practices to protect your business online.

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    Content management systems
    Content category
    IT

    Source URL

    /content/factors-consider-when-choosing-web-hosting-provider

    Links

  • Difference between a domain and web hosting

    Understand the difference between a domain name and web hosting, and how they make your website accessible to your customers.

    To put a website online, you need both a domain name and web hosting. These are closely linked but different things. You will need both in order for your website to be visible and accessible on the internet.

    What is a domain name?

    Your domain name is the address people type into the browser to visit your website - for example, www(dot)mynewbusiness(dot)com. It is your website's name on the web and helps customers find you online.

    You can buy a domain name through a domain name registrar. This gives you the right to use that specific web address, but it does not provide space to host your website files. A domain name on its own won't make your website 'live' and available on the internet.

    How hosting and domains work together

    To make your website visible, the files that make it up (eg text and images) must be stored on a web host, which is a computer server connected to the internet 24 hours a day. The server gives your hosted website a unique internet protocol (IP) address - a string of numbers that computers use to locate it. A domain name is a human-friendly version of this address, so visitors do not have to remember long numbers.

    What is an IP address used for?

    When someone types your domain name into a browser, the system translates the domain name into the correct IP address and sends a request to the web host. The host then sends your website files back to the visitor's screen. This is essentially how your customers are able to view your website. So, for your website to be available online, you need both a domain name, as well as a hosted website.

    If you have yet to choose your business domain name, there is a lot to think through - from the different types of domain names to trade marking considerations.

    If you have a domain name but are looking for hosting, see factors to consider when choosing a web hosting provider.

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    .UK domain name registry
    Also on this site
    Set up a small business website
    Domain name and trade mark conflicts
    Content category
    IT

    Source URL

    /content/difference-between-domain-and-web-hosting

    Links

  • Pros and cons of using ISP for hosting

    How to use an internet service provider to host your website, and assess the benefits of shared vs dedicated hosting.

    Using an internet service provider (ISP) for web hosting means outsourcing your website to an external company that keeps your site connected to the internet 24 hours a day. The ISP is responsible for maintaining the server, the network connection and the hosting environment.

    ISPs can provide different types of web hosting services, including:

    • shared server hosting
    • dedicated hosting
    • co-location hosting

    Shared server hosting

    With this type of hosting, the ISP owns the server and hosts your site alongside other websites. This is usually the cheapest option and can be suitable for small or simple websites. 
    However, shared hosting may not be ideal if you need:

    • complex technologies such as databases
    • secure certificates (SSL)
    • tools that let you customise pages for different users

    If other websites on the same server use a lot of resources, your site's performance can suffer.

    Dedicated hosting

    With dedicated hosting, your website is the only one hosted on a particular server. This option suits large or high-traffic websites, or those requiring special software or particularly high levels of security. While this approach offers the most powerful and secure solution, it is usually more expensive and may require more technical support or management.

    Co-location hosting

    With co-location, you host your own server (which you own or rent) in the ISP's data centre. You benefit from the ISP's high‑speed internet connection, power backup and secure environment, but you remain responsible for the server hardware, software and website content. This option can suit businesses that want more control over their hardware, but still want to use a professional hosting environment.

    See other factors to consider when choosing a web hosting provider.

    Advantages of using an ISP for hosting

    • You do not need to buy or manage your own server hardware.
    • Most ISPs offer fast, reliable internet connections and high availability (uptime).
    • ISPs usually maintain a secure environment, with virus protection and regular software updates.
    • Support and monitoring are often included as part of the service.

    Disadvantages of using an ISP for hosting

    • You must trust the ISP to keep your website available and secure.
    • If the ISP hosts too many sites on a shared server, performance may be affected.
    • If the ISP is blacklisted (eg because of hosting adult content sites or spam sites), this can directly affect you. For example, you may find that your IP address is on various spam blacklists. This can cause your emails to be filtered out and junked or you may not be able to register with certain services, websites, forums, etc.
    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    Choose an internet service provider for your business
    Website maintenance: options and requirements
    Content category
    IT

    Source URL

    /content/pros-and-cons-using-isp-hosting

    Links

  • Pros and cons of in-house hosting

    Understand the advantages and disadvantages of hosting your business website in‑house, and the skills and resources you will need.

    If you are setting up a corporate or business website, you will need to choose between outsourcing your hosting or hosting your website internally. Both options have benefits and risks. You should weigh these carefully to find the right fit for your business.

    In-house hosting vs outsourcing

    Outsourcing to an external web host may be an attractive proposition if you need an 'off the shelf' solution, or lack the skills and infrastructure to manage a server yourself.

    Many small and medium-sized businesses choose to contract out their hosting to a specialist provider or an internet service provider (ISP). See pros and cons of using ISP for hosting.

    In-house hosting can work well for larger businesses and organisations that have the expertise and the budget to run their own servers. As well as a web server, you will need a high‑speed, reliable internet connection and the ability to provide 24‑hour monitoring and support. You must also factor in the cost of maintenance, power, space and software licences. 

    If you are considering in‑house hosting, you should read how to host your own business website.

    Advantages of the in-house web hosting

    • You have full control over access to the website.
    • The choice of hardware, including the ease and expandability of upgrades, is yours.
    • You also have control over the operating environment - the software and systems that run on the web server.
    • You can manage web storage space and performance more effectively.
    • You are not contractually or legally bound to use a specific provider.

    Disadvantages of the in-house web hosting

    • The cost of buying your own web server hardware, associated software and high-speed internet connectivity (typically using a dedicated connection).
    • The technical skills you or your staff will require in order to develop, maintain and upgrade the website, and to keep up to date with the latest technical developments.
    • The resources needed to provide round-the-clock support for the website in order to ensure its availability for users.
    • The need for specialist security expertise in employing tools and techniques to maintain the security of your website.

    Before deciding to host your website internally, consider whether you can:

    • provide 24-hour support internally on an ongoing basis
    • build an in-house IT team with the right set of specialist skills to maintain the system
    • implement appropriate monitoring systems and procedures
    • take immediate and effective action when problems occur

    If you cannot confidently meet these requirements, an external hosting option will often be cheaper, more reliable and less risky for your business. See factors to consider when choosing a web hosting provider to help you compare options.

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Choosing a business broadband connection
    Website maintenance: options and requirements
    Choose an internet service provider for your business
    Content category
    IT

    Source URL

    /content/pros-and-cons-house-hosting

    Links

  • How to host your own business website

    Understand the hardware, software and other resources you may need if you decide to host your website in‑house.

    Using an internet service provider (ISP) or an external hosting company lets most small businesses run a website without worrying about the underlying technology. However, if you want to host your website on your own server, you need to understand what is involved and what operating systems, software and skills you will need.

    Server operating systems

    Web servers typically run on one of three main types of operating systems:

    • Windows Servers - commonly used in business environments, often with Microsoft-based tools and databases
    • Unix - a family of operating systems used in some enterprise environments, often requiring specialist knowledge
    • Linux - widely used for web hosting; often stable, secure and cost-effective

    Email

    Email can be hosted on‑site alongside your website, but many businesses choose to outsource this to a dedicated email provider such as Microsoft 365 or Google Workspace. External email services often offer better spam filtering, reliability and support, and can reduce the technical burden on your in‑house IT team.

    Web server software

    Web server software runs on top of the operating system and handles requests from visitors# browsers. Common web server software includes:

    • Apache - widely used, open source and compatible with many hosting environments
    • Microsoft Internet Information Services (IIS) - commonly used with Windows Server and Microsoft-based websites

    Web Authoring languages

    These are the software languages used to develop applications on the website. Examples include:

    • HTML (HyperText Markup Language) - a programming language used in the creation of simple web pages
    • scripting and programming languages such as PHP, ASP.NET, Python, Ruby or JavaScript, used to create dynamic and interactive features
    • web authoring tools such as editors or design applications that help you create pages, add graphics and build user‑friendly interfaces

    Your in‑house hosting solution must support the languages and tools your website uses.

    Databases

    If your website uses a lot of data - for example, product information, customer records or bookings - you may need a database system. Examples include:

    • Microsoft SQL Server
    • Oracle
    • PostgreSQL
    • MySQL

    The best choice depends on the volume of data, expected traffic and the technical skills available in your team.

    E-commerce

    If your website sells goods or services online, you will need to support an e‑commerce package or platform. This can involve hosting shopping‑cart software, secure payment processing and additional security measures. See how to set up an online shop with an e-commerce package.

    Planning for upgrades

    As your business expands and your website grows, you may need to upgrade your server hardware, software or hosting model. Consider if: 

    • your current hosting can handle higher traffic or more complex features
    • you need extra storage, memory or processing power
    • it may be more cost‑effective or secure to move some services to an external or cloud host

    Planning an upgrade path in advance helps avoid unexpected downtime and performance problems later.
     

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Planning for e-commerce
    Computer software for business
    Content category
    IT

    Source URL

    /content/how-host-your-own-business-website

    Links

  • Cloud hosting

    Understand what cloud hosting is, its benefits for small and medium‑sized businesses, and the risks you should manage.

    With traditional web hosting, you buy or rent a physical machine - a server - that gives you resources like memory and processing power. With cloud hosting, you effectively rent virtual server resources from a provider, and you can scale them up or down as your needs change. This can make it easier and more cost‑effective for growing businesses to manage their websites.

    How does cloud hosting work?

    Cloud hosting spreads your website across multiple virtual servers instead of a single physical machine. The cloud provider allocates resources such as processing power, memory and storage when your website needs them. You typically pay only for what you use, so you do not need to buy extra hardware in advance. 

    Cloud hosting is often delivered as a service over the internet, using models such as:

    • Infrastructure as a Service (IaaS) - where you manage most of the software and configuration yourself
    • Platform as a Service (PaaS) - where the provider manages the underlying platform, and you focus on your website and applications
    • Software as a Service (SaaS) - where you use fully hosted applications, such as email and content management systems, without managing the server at all

    Is the cloud a server?

    The cloud itself is not a single physical server. A server is physical hardware, dedicated entirely to your business or shared with others. A cloud server is a virtual server created and managed by a cloud provider within a shared environment. It behaves like a traditional server but can be created, resized or removed quickly as your business needs change.

    You can choose from several types of cloud services for full or partial hosting. Cloud hosting is increasingly popular with small and medium‑sized businesses because it can reduce the need to buy and maintain physical hardware, and can be easier to scale up during busy periods.

    Cloud web hosting risks and considerations

    When considering cloud hosting, think about the following.

    Connectivity

    You will need a reliable, high-speed internet connection at your business premises. If your connection fails, you may lose access to your website and data until it is restored.

    Cost of ownership

    Cloud services are often billed monthly, which can be good for cash flow, but you should compare the total cost over a longer period with more traditional software or hardware options.

    Service level agreement

    Check the conditions of your service level agreement - what uptime is promised, what happens if something goes wrong, who is responsible, and how quickly issues are meant to be fixed.

    Data security and compliance

    Make sure you understand where your data is stored, how it is protected and whether it is encrypted. You should also ensure your cloud provider helps you meet your legal responsibilities, including those under the UK General Data Protection Regulation (UK GDPR).

    If you are unsure whether cloud hosting is right for your business, read about the advantages of cloud computing and find tips for moving your business to the cloud.

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Set up a small business website
    Cloud computing
    Content category
    IT

    Source URL

    /content/cloud-hosting

    Links

  • Website hosting and management

    Understand the support, maintenance, security and management features you should look for in a web hosting provider.

    Finding the best servers to host your website on can be daunting. There are many things to consider, not least:

    • the type of site you wish to build
    • how to manage it
    • who will maintain it
    • whether to host it in-house or externally

    As well as this, you should also think about server upgrades, monitoring and security, content management, and customer service. Read more on choosing a web hosting provider.

    Server security

    Websites can come under threat from hackers, viruses and other cyber attacks. If you host your website in-house, you must put your own security measures in place.

    If you use third-party hosting services, server security will generally be their responsibility. Look for assurances that they are running firewalls and malware detection, and monitor their servers for unusual activity. See more on cyber security for business.

    Server upgrades and monitoring

    To keep your website running smoothly, someone must monitor the server's performance and apply upgrades when needed. This includes watching its central processing unit, memory and disk usage, network performance and backup utilities. From time to time, you will also need to install new versions of the server software or upgrade hardware components.

    If updates require downtime, try to schedule them at quiet times, such as overnight, to minimise disruption to your customers. With external hosting, the provider usually handles upgrades and monitoring, but you should check their service level agreements (SLAs) to confirm what is included.

    Content management

    Content management systems (CMS) allow authorised users across your business to easily add or update web content without needing extensive technical skills. When choosing a hosting provider, make sure they support the CMS you plan to use - for example, WordPress, Drupal or a hosted site builder. Read more about  content management systems.

    Techical support

    Customer and technical support are important when choosing a web host. No provider can guarantee 100% uptime, so you should know what help is available if a problem occurs. Ask:

    • what support channels are offered, eg live chat, phone, email
    • when support is available, eg 24/7 or during business hours
    • is there a limit to the support you can get as part of the package

    See how to choose an IT supplier for your business.

    Actions
    What is a web hosting service?
    Invest NI's ICT support for business
    Also on this site
    Protect your business online
    IT risk management
    Securing your wireless network
    Content category
    IT

    Source URL

    /content/website-hosting-and-management

    Links

Subscribe to IT