Guides
Buy business technology with fewer surprises.
Practical guides for the people choosing business technology, and plain-English explainers of the standards and rules that come up along the way. Every explainer lists its sources.
Buying guides
- How to run a B2B technology buying processA step-by-step process for choosing business software or technology services: defining the problem, agreeing who decides, setting budget and timing, and testing a shortlist fairly.
- How to write requirements for a software purchaseWhat to put in a requirements document before you talk to suppliers, how to separate must-haves from nice-to-haves, and the mistakes that make supplier answers impossible to compare.
- Questions to ask a technology supplier before you signA practical checklist of questions to put to software and technology suppliers about the product, implementation, security, support, pricing, renewal and leaving.
- How to build a business case for new technologyHow to write a business case that a budget holder can approve: the problem, the options including doing nothing, the full cost of ownership, the benefits and how you will measure them.
Explainers
- What is SECR? Streamlined Energy and Carbon Reporting explainedWho has to report under SECR, the thresholds, the 40,000 kWh exemption, what to disclose, where it goes, and how SECR is changing in 2026.
- What is DORA? The Digital Operational Resilience Act explainedWhat DORA requires of EU financial entities and their technology suppliers: scope, the five areas, incident reporting deadlines, the register of information, critical providers and the UK position.
- What is NIS2? The EU cybersecurity directive explainedWho NIS2 applies to, essential and important entities, the 18 sectors, fines, management duties, incident deadlines, transposition, and what it means for the UK.
- What is Cyber Essentials? Controls, cost and the April 2026 changesThe UK Cyber Essentials scheme explained: the five controls, Cyber Essentials vs Plus, prices, renewal, the April 2026 Danzell changes, government contracts and free insurance.
- What is ISO/IEC 27001? The 2022 standard explainedISO/IEC 27001:2022 explained: what an ISMS is, the 93 Annex A controls, the end of the 2013 version, how certification and UKAS accreditation work, and how to check a certificate.
- What is SOC 2? Type 1, Type 2 and the Trust Services CriteriaSOC 2 explained: what it covers, why it is an attestation report rather than a certification, the five Trust Services Criteria categories, Type 1 vs Type 2, and what to check in a supplier's report.