The Exhibitions Group is a membership organisation representing exhibition makers, museums, galleries and cultural venues across the UK. Its network includes organisations ranging from small local galleries to major national institutions. Operating entirely remotely, the organisation delivers member services, online resources, training and events through a small team of freelance consultants who rely on cloud-based technologies to collaborate and support members.
The Exhibitions Group identified cybersecurity and IT resilience as key organisational risks requiring closer scrutiny. As a fully remote organisation using a small team of freelance consultants working on personal devices, trustees wanted an independent view of the organisation’s current technology setup and the risks associated with it.
Microsoft 365 had been adopted successfully and had become the central platform for communication, collaboration and document management. However, the environment had developed organically over time, supported by evolving working practices and legacy tools. While GDPR policies were already in place, the organisation lacked a comprehensive framework covering IT governance, artificial intelligence usage, device management and cyber security best practice.
Trustees and management sought greater clarity around access controls, data sharing, multi-factor authentication, device security and Microsoft 365 security recommendations. The objective was not simply to improve security, but to ensure controls were practical, proportionate and aligned with the organisation’s resources and remote working model.
We began with a comprehensive review of the Microsoft 365 environment, focusing on security configuration, user access, authentication controls, data management processes and collaboration practices across SharePoint, Teams and Exchange Online.
The audit assessed current settings against recognised cybersecurity best practices while considering the needs of a small, fully remote organisation. Particular attention was given to account security, multi-factor authentication adoption, privileged access management, sharing permissions, data retention practices and security monitoring capabilities.
Alongside the technical review, we examined how organisational data was being accessed, stored and shared across personal devices used by freelance consultants. Rather than recommending unnecessary complexity, our focus was on identifying realistic improvements that could significantly reduce risk while remaining practical and manageable.
A detailed findings report was produced using clear, non-technical language suitable for trustees and senior decision-makers. Recommendations were prioritised according to risk, impact and implementation effort, providing a structured roadmap for improvement rather than an overwhelming list of technical actions.
We also reviewed existing governance documentation and supported the development of IT and AI usage policies tailored to the organisation’s operating model. This ensured policies aligned with GDPR obligations while providing practical guidance around remote working, acceptable use, data protection and emerging technologies.
To help support future resilience, we outlined options for ongoing managed support, combining responsive technical assistance with regular security reviews, governance guidance and strategic account management. This provides The Exhibitions Group with access to specialist expertise as technology requirements evolve and new risks emerge.
The Exhibitions Group gained a much clearer understanding of its current security posture and the practical steps required to strengthen cyber resilience. Trustees and management were provided with an independent assessment of risk, supported by clear recommendations that could be implemented in a structured and manageable way.
The review helped establish greater confidence in the use of Microsoft 365 by identifying opportunities to improve security settings, strengthen access controls and enhance protection for organisational data. A clearer approach to managing information across personal devices also reduced uncertainty around remote working risks.
The development of supporting IT and AI policies improved governance and provided staff with practical guidance on the safe use of technology, helping ensure consistency across the organisation while supporting GDPR compliance.
By translating technical findings into clear business-focused recommendations, decision-makers were able to prioritise investments and improvements more effectively. The organisation now has a roadmap for ongoing security improvement, supported by the option of regular reviews and specialist guidance.
Most importantly, The Exhibitions Group gained greater assurance that its technology environment is aligned with its operational needs, enabling the organisation to continue supporting members with confidence while reducing exposure to cyber security risks.
- Independent audit of Microsoft 365 security and configuration
- Improved understanding of organisational cyber risk
- Enhanced access controls and authentication recommendations
- Review of data storage and sharing practices
- Guidance on secure use of personal devices
- Development and refinement of IT and AI governance policies
