This week’s PHP security alert will eventually be dealt with and largely forgotten. The question it put to every surveying practice is the one worth keeping.
On 21 October, the National Cyber Security Centre issued a critical alert concerning two faults in PHP, the software engine that operates quietly behind a very large share of the world’s websites and online services. The faults were serious. Left uncorrected, they could allow a criminal to reach a web server without needing the usual username or password, and attempts to exploit them were reported within hours of the fix being released.
We issued a member newsflash the same day. The advice in it was straightforward: contact whoever looks after your website and online systems, and ask them to confirm that the updates have been applied. What became apparent very quickly is that for a good number of practices, the difficult part of that sentence is not the word “updates”. It is the words “whoever looks after”.
The question most practices cannot answer in five minutes
Ask a surveying practice who is responsible for its website and you will usually get a prompt answer. Ask who is responsible for the report-writing platform, the document storage, the client portal, the appointment diary and the online payment facility, whether any of those share a supplier, and who to telephone about each one out of hours, and the answer tends to arrive rather more slowly. Sometimes it does not arrive at all.
That matters more than it first appears. A practice which cannot say who is responsible for each of its systems cannot respond properly to a security incident. Not to this incident specifically. To any of them. The alert becomes a general sense of unease rather than a list of telephone calls, and general unease is not a response.
This is not a criticism of members. It is an observation about how small professional practices actually operate, and it applies to a great many firms well beyond surveying.
How the estate gets built
Nobody sets out to create a situation of this kind. It accumulates. A website is built in 2016 by a capable local designer who has since changed career. Report-writing software is chosen after a free trial and becomes indispensable. Documents migrate to a cloud storage account opened years ago on somebody’s personal login. A payment link is added because a client asked to pay by card. An online diary appears because it saved an hour a week. Every one of those decisions was sensible on the day it was made.
The result, five or ten years later, is an estate of four or five suppliers, several of whom have never heard of one another, holding between them everything the practice needs in order to operate and everything its clients entrusted to it. There is no single list. There is rarely any single person who knows the whole picture.
Surveyors will recognise the pattern, because we write about it every week. It is the professional equivalent of a house extended three times by three different builders with no drawings retained. Nothing is necessarily defective. But nobody can tell you what is behind the walls, and the first person who urgently needs to know is whoever is investigating the problem.
What a supplier map looks like
The remedy is unglamorous and takes about an hour. It needs no software and no consultant. A single page, stored securely somewhere you can access from your phone when away from the office, should record the following.
- What the system does and what client information it holds
- Which company provides it, and under what account name
- How to contact that company urgently, including outside office hours
- Who within the practice holds administrator access
- Whether multi-factor authentication is switched on
- The date of the latest security or patching confirmation received from the provider
Do not record passwords, recovery codes or other authentication details on the map.
The patching confirmation is the entry most practices have never kept, and it is the one that turns an alert like this week’s into a twenty-minute task rather than a fortnight of vague worry.
There is a simple test of whether your practice needs this. If you were standing in somebody’s loft this afternoon and received a telephone call telling you that one of your systems had been compromised, could you say which company to ring, from your phone, within five minutes? If the honest answer is no, the hour is well spent.
This is professional risk, not IT housekeeping
It would be easy to file all of this under technology and leave it to somebody else. That would be a mistake, because the consequences land squarely in professional territory.
Surveying practices hold a great deal of personal information. Names, addresses, telephone numbers, the dates on which properties will be empty, photographs of the inside of people’s homes, and reports describing in detail what is wrong with the most valuable thing most of our clients will ever own. Every suspected personal data breach must be assessed and documented, and where it is likely to result in a risk to individuals’ rights and freedoms it must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of it. That clock starts at the point of awareness, not at the point an investigation concludes.
Practices holding Cyber Essentials certification have a further obligation, since the scheme requires high and critical severity updates to be installed within 14 days of release. Panels, lenders and corporate clients are also asking more searching questions about data handling than they were five years ago, and a practice that can produce a supplier map and a patching record answers those questions in a single email.
The case for cyber cover
The Government’s Cyber Security Breaches Survey for 2025/26 found that 43 per cent of UK businesses identified a cyber breach or attack in the preceding twelve months, which equates to roughly 612,000 businesses. Among small businesses the figure was 46 per cent, and among micro businesses 42 per cent. Being small is plainly no protection.
I want to be straightforward about the cost figures in that survey, because they are frequently misused. The median perceived cost of the most disruptive breach was nil, and most businesses put it somewhere between nothing and a couple of hundred pounds. Anyone claiming that the typical cyber incident ruins a small firm is overstating the position.
The case for insurance was never about the median. It is about the tail. The worst affected five per cent reported costs of around four thousand pounds and upwards, and those are perceived costs, which tend to capture the immediate disruption rather than everything that follows: forensic investigation to establish what was actually taken, legal advice, notifying affected clients, rebuilding records, and the fee income lost during whatever period you are unable to issue reports. For a small practice, a fortnight unable to deliver reports could put cash flow, client commitments and the business itself under serious pressure.
The figure from that survey which ought to concern members most, however, is a different one. Forty-seven per cent of businesses hold some form of cyber insurance, but only 10 per cent hold a specific cyber policy. The remainder rely on cover included within a wider business policy, where the breadth of protection can vary considerably. That means many firms may believe they are protected without having checked exactly what the policy covers or excludes.
That gap is the single most useful thing to take from this week. Professional indemnity insurance is not cyber insurance. General business or office insurance is not cyber insurance. They may contain some cyber element, and that element may be perfectly adequate for your circumstances, but the only way to know is to look.
Where a practice does hold proper cover, the most valuable component is usually not the money at all. It is the immediate access to people who have dealt with this before: incident response specialists who can establish what happened, legal advisers who can tell you whether the matter is notifiable, and support in communicating with clients. Most of us would not know where to find any of that at nine o’clock on a Friday evening. A policy that provides a single telephone number is doing a great deal of work.
It is worth adding that insurers increasingly ask about multi-factor authentication, tested backups and patching before they will quote, and the answers can affect both premium and cover. The supplier map described above is therefore not merely good practice. It is increasingly the paperwork your insurer expects you to have.
Howden is the RPSA’s recommended insurance broker and can advise members on appropriate cyber protection. The RPSA does not advise on individual policies and nothing here should be taken as a recommendation of any particular product. The point is simply that members should know what they currently hold rather than assuming.
Three things worth doing this week
- Finish the PHP checks. Contact each provider separately and obtain written confirmation. Updating the public website does not protect the report-writing platform, the portal or the payment facility.
- Write the supplier map. One page, one hour, kept where you can reach it from site.
- Telephone your broker and ask one specific question: do I hold a standalone cyber policy or an extension within another policy, and what does it exclude?
The PHP faults will be dealt with. Within a month most of us will have forgotten the names of the two vulnerabilities, and quite right too. What is worth keeping is the list, and the knowledge of who to ring. That is not a technology project. It is the same discipline we apply to every property we inspect: find out what is actually there, write it down, and do not assume that because nothing has gone wrong yet, nothing is going to.
Howdens Cyber Insurance Brochure
The RPSA Data Protection and Privacy Policy and the Howden guidance Cyber Insurance: What It Covers and Why It Is Important are both available in the Useful Documents area of the RPSA website.
Sources: NCSC alert, Critical security issue affecting PHP, 21 October 2026. Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/26, published 30 April 2026.
