What good IT looks like for a 50-person business

Fifty is an important number in UK business statistics. Below it you're a small business; from 50 to 249 staff, you're a medium one. In the government's Cyber Security Breaches Survey 2025/2026, 46% of small businesses identified a breach or attack in the previous twelve months. For medium businesses it was 65%. Phishing alone hit 60% of medium businesses, against 38% of businesses overall.

That isn't because bigger businesses are careless. It's because fifty people means fifty inboxes, more devices, more suppliers and more ways in. It's also roughly the point where IT stops fitting in one person's head. Up to about thirty staff, there's usually someone, often the office manager or a director, who knows where everything is, who has which password, and which laptop is the slow one. Somewhere between thirty and fifty, that stops working, and nobody notices until that person goes on holiday.

I wrote about what good IT looks like in general back in March. This is the more specific version: what we'd expect to see in place at a well-run fifty-person business, and the government figures that show how many medium businesses don't have it yet.

What changes at fifty people

A few things shift at once, and they're worth naming because they explain the rest of this piece.

Staff changes become routine. At normal turnover, a fifty-person business has a starter or a leaver most months. Each one is a set of accounts to create or close, a laptop to set up or recover, and access to grant or take away. Done by memory, something gets missed.

Other people start asking questions. Larger customers send security questionnaires before they'll sign. Insurers ask detailed questions at renewal. Tenders ask for Cyber Essentials. Questions that a twenty-person business can answer from memory need written answers at fifty.

The board becomes accountable. The NCSC's Cyber Governance Code of Practice is written for medium and large organisations, and sets out what the government expects directors to oversee. It's voluntary, but it's increasingly what insurers and larger customers measure you against.

Eight things good looks like

1. One named director owns IT risk, and hears about it regularly. Not the person who fixes the printer: someone at board level who gets a short, plain-English report at least quarterly and can say what the top three risks are. In the survey, only 52% of medium businesses had a board member responsible for cyber security, and the share whose senior management got an update at least once a year fell from 78% to 70%.

2. Multi-factor authentication on every account, with no exceptions. Email, the accounts package, the CRM, remote access, the admin accounts most of all. 79% of medium businesses require it, which means one in five still don't. The exceptions are where attackers get in: the shared mailbox, the director who found it annoying, the old account nobody switched off.

3. Security updates go on within 14 days, and someone can prove it. Only 56% of medium businesses had a policy to apply security updates within 14 days. Good looks like a report showing every device's update status, with the firewall, router and any office server included, because those don't nag anyone.

4. A current list of every device and system, with purchase dates. 59% of medium businesses had a list of their critical assets. Good is a list that's kept up to date automatically, showing what each device is, who has it, when it was bought and when it's due for replacement. We plan laptop and desktop replacement around five years from purchase, so replacements are budgeted rather than emergencies.

5. Starters ready on day one, leavers off on the day. A new starter should arrive to a laptop that's set up, accounts that work and access to what they need, and nothing else. A leaver's access should end the day they go, with their mailbox and files handed to whoever needs them. If either of those depends on someone remembering, it will go wrong a few times a year.

6. Backups that have actually been restored. 95% of medium businesses have some form of backup. The question that separates good from fine is when someone last restored something from it and timed how long it took. A backup that's never been tested is a hope, not a plan.

7. An incident plan people have read. 57% of medium businesses have a formal incident response plan. Good is a short document that says who to call, what to do in the first hour, who decides whether to tell customers or the ICO, and where the plan lives if email is down. Our tech tip on the first hour after something goes wrong is a decent starting point.

8. Suppliers checked, including your IT provider. Only 30% of medium businesses had formally reviewed the cyber risks from their immediate suppliers. At fifty staff you'll have a dozen or more suppliers holding your data or with access to your systems. Good is knowing who they are, and having asked each of the important ones how they protect it. That includes asking your IT provider how its engineers sign in to your systems and what happens to your data if you leave.

Alongside all eight sits staff awareness. Just over half of medium businesses (54%) did any cyber security training or awareness raising in the last year. Short, regular sessions with real examples beat one long annual video.

What it doesn't have to look like

Good IT at fifty people doesn't have to mean a full-time IT manager, though some businesses that size do employ one. If you do, the honest problem is that one person can't cover the helpdesk, security, projects, supplier management and their own holidays. Most fifty-person businesses we see either outsource the lot or pair an internal person with a managed service behind them. Both work. What doesn't work is one person, however good, being the only one who knows how everything fits together.

It also doesn't mean buying more tools. Most of the eight points above are about routine and evidence, not software. A business with fewer, better-configured tools and a clear monthly routine is in better shape than one with a security product for every acronym.

A five-minute self-check

If you can answer these without asking around, you're in good shape:

• Who has admin access to your Microsoft 365 tenant, and does each of them use MFA?
• How old is your oldest laptop, and when is it due for replacement?
• When did someone last restore a file from backup, and how long did it take?
• Who would you ring at 7pm on a Tuesday if your email stopped working?
• Which of your suppliers hold customer data, and have you asked them how they protect it?

If two or more of those needed a phone call, that's normal for a business that has grown quickly, and it's fixable. If you'd like a second opinion, our managed IT support for the 45+ businesses we look after is built around these eight points, and our SecureState reviews re-score them every 90 days so you can see the trend rather than just a snapshot. If you're comparing providers, how to choose IT support for a 10–50 person business has the questions worth asking.

FAQ

When does a business count as medium-sized for cyber security purposes?

The government's Cyber Security Breaches Survey treats businesses with 50 to 249 employees as medium. In the 2025/2026 survey, 65% of medium businesses identified a breach or attack in the previous twelve months, compared with 46% of small businesses (10 to 49 staff).

Does a 50-person business need a full-time IT manager?

Not necessarily. Some businesses that size employ one, but a single person can't cover the helpdesk, security, projects and their own holidays. Many fifty-person businesses use a fully managed service, or pair an internal IT person with a managed provider behind them.

How often should laptops be replaced in a 50-person business?

We plan replacement around five years from the purchase date. That keeps devices supported and fast enough, spreads the cost evenly, and turns replacements into a budget line rather than an emergency.

What should a board see about IT and cyber risk?

A short, plain-English report at least quarterly: the top risks, what's changed, the status of updates, MFA and backups, and anything that needs a decision. The NCSC's Cyber Governance Code of Practice sets out what directors of medium and large organisations are expected to oversee.

What is the most common cyber attack on medium-sized UK businesses?

Phishing. In the 2025/2026 Cyber Security Breaches Survey, 60% of medium businesses had experienced phishing attacks in the previous twelve months, compared with 38% of businesses overall.