Theme one
01
Regulation
I read the Act, the commencement regulations and the regulator’s guidance. Then I set out who is covered, what is already in force and what is still to come. I describe what the official sources say. Whether a particular business complies is a question for a solicitor.
Where I start: Ofcom on online safety, the ICO’s guidance for organisations, DSIT and legislation.gov.uk.
Theme two
02
Security
I take guidance from the National Cyber Security Centre and from vendor documentation. I turn it into steps a small or medium-sized business can act on. I report what the guidance says and where its authors admit the gaps. I do not assess any individual firm’s defences.
Where I start: the NCSC, its pages for small and medium-sized organisations and Cyber Essentials.
Theme three
03
Business technology
I write about the decisions an owner or manager has to make. These include which features to run on a website, how staff sign in and which AI tools to allow and on what terms. They also include what to change when the rules or the tools move. If the sources support it, I end with a short list of what to do now.
Where I start: the ICO’s advice for small organisations and Ofcom’s Online Safety Act checker.