In May 2026 the Information Commissioner’s Office fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 over a Cl0p ransomware attack that exposed the personal data of more than 630,000 customers and employees. The interesting part is not the number. It is that the ICO published its reasoning — and in doing so listed, in order, the four controls it expects you to have.

This is not breach commentary. A regulator naming specific failings in a public penalty notice is the closest thing UK organisations get to a marked exam paper, and the four it named are not exotic. Every one of them is something a fifty-person company can check this week.

A note on how this is written. Every figure below comes from the ICO’s published penalty notice as reported by The Register, Computer Weekly, Computing and the law firm Burges Salmon, which agree on the detail. The point of this piece is the control lessons, not the company. South Staffordshire cooperated, settled voluntarily and made full admissions — which, as you will see, mattered considerably.

What happened, briefly

September 2020: an employee opens a malicious email attachment. That is the whole of the initial access — no zero-day, no sophisticated supply-chain compromise. A phishing email that worked.

The attackers then stayed inside the network, undetected, for roughly twenty months. In May 2022 they obtained a domain administrator account and began moving across systems in earnest. The intrusion was finally noticed in July 2022, when engineers investigated performance problems.

Sit with that sequence for a moment, because it is the actual lesson. The prevention failure lasted one click. The detection failure lasted nearly two years.

The four failings the ICO named

ICO finding	The control behind it
Only about 5% of the IT environment was monitored	Logging and monitoring coverage — knowing what you can actually see
Unsupported software still in use, including Windows Server 2003	Asset inventory and end-of-life management
Inadequate vulnerability management, with unpatched critical systems	Patching cadence and regular scanning
Failure to apply least privilege, allowing escalation to domain admin	Privileged access management

None of these is advanced. All four appear in ISO 27001’s Annex A, in the SOC 2 Common Criteria, in Cyber Essentials, and in the CIS Controls. If you hold any of those, you have already told someone you do these things.

1. Monitoring coverage: the 5% number

This is the finding worth dwelling on, because almost nobody knows their own figure.

Most teams asked “do you have logging?” will say yes, and they are telling the truth — logging exists. The question the ICO effectively asked is different: what percentage of your estate is actually monitored? Not producing logs somewhere. Monitored, with something or someone looking at the output and capable of raising an alarm.

Gaps cluster in predictable places: legacy servers nobody owns, systems inherited through acquisition, developer environments that quietly hold production-like data, third-party-managed infrastructure where the contract never specified who watches it, and SaaS admin activity that never reaches your own log store at all.

Check yours this week. Take your asset inventory — if you do not have one, that is finding number two arriving early. For each asset, answer three questions: does it generate logs, do those logs reach a place someone looks, and would anyone notice within 24 hours if something went wrong on it? Count the assets where all three are yes. That is your number. Almost everyone is surprised by it, and almost everyone’s is lower than they expected.

Coverage beats sophistication. A simple alert on every system is worth more than an advanced detection platform watching 60% of them. Attackers do not stay in the monitored segment out of politeness — they move toward the quiet parts, and the quiet parts are defined by your coverage gap.

2. Unsupported software: the Windows Server 2003 problem

Windows Server 2003 left extended support in July 2015. Its presence on a network in 2022 is not really a patching failure — it is an inventory failure. Nobody knowingly decides to run a seven-years-unsupported operating system. They lose track of it.

End-of-life systems survive for a small number of recurring reasons: they run one application nobody will pay to replace, they arrived with an acquisition, the person who understood them left, or a supplier requires them and the contract never got renegotiated.

Check yours this week. Pull every operating system version and every major software version in your estate, and compare against vendor support dates. Anything past end-of-life needs one of three documented outcomes: a replacement date, a compensating control with the risk formally accepted by a named person, or removal. What the ICO penalises is the fourth outcome — nobody knew.

For a small company this is genuinely a morning’s work, and it is the single cheapest item on this list.

3. Vulnerability management: scanning is not the hard part

The ICO found unpatched critical systems and no regular security scanning. Scanning is the easy half — cloud providers give you much of it, and a scanner is inexpensive. The difficult half is what happens to the output.

A vulnerability management programme that survives regulatory scrutiny has four properties, and most teams have two of them:

Defined remediation timelines by severity — critical in days, high in weeks, and a number you actually wrote down rather than "promptly".
An owner per finding. Unassigned findings age forever; assigned ones get argued about, which is progress.
Evidence of the trend over time, not a point-in-time snapshot. Auditors and regulators both look for direction of travel.
A documented exception route for what you consciously will not fix, with a reason and a review date.

Check yours this week. Find your oldest open critical vulnerability and see how long it has been open. If the answer is measured in months, the problem is not your scanner.

4. Least privilege: how one foothold became domain admin

The attackers got in through one user’s mailbox and eventually held domain administrator rights. That escalation path is what converted an incident into a 630,000-person data breach.

Least privilege is the control everyone claims and few can evidence. The honest test is not whether you have a policy. It is whether you can answer, right now, who holds administrative rights to your production environment, your identity provider and your cloud accounts — and whether every one of those people still needs them.

Count your domain and cloud administrators. If the number surprises you, that is the finding.
Separate administrative accounts from daily-use accounts. Reading email as domain admin is how one phishing click becomes total compromise.
Require MFA on every privileged account without exception — service accounts included, or documented and compensated where genuinely impossible.
Review privileged access quarterly, and keep the evidence. This is the most-sampled control in any audit and the one the ICO reached for here.
Prefer time-bound elevation to standing rights. Access granted for four hours cannot be stolen in month eleven.

The 40% that is easy to miss

South Staffordshire entered a voluntary settlement with the Commissioner in April 2026 and made full admissions. The reported effect: they paid around 40% less than the ICO would otherwise have sought.

That is worth more attention than it usually gets. Regulatory outcomes are not fixed by the facts of the breach alone — cooperation, candour and the quality of your response materially change the number. Which means your incident response plan has a commercial function as well as a technical one, and that the instinct to minimise, delay or contest is expensive.

It also means the evidence you keep before an incident does double duty. An organisation that can hand a regulator a clear asset inventory, access review records and a vulnerability register is telling a very different story from one reconstructing its estate under pressure.

Enforcement is slow, and then it arrives

Note the timeline: initial compromise September 2020, detection July 2022, penalty May 2026. Nearly four years passed between the breach becoming known and the fine landing.

Two things follow. First, do not read the absence of enforcement news as evidence that regulators are not acting — they are working through a queue. Second, the controls you are judged on are the ones that were in place at the time of the incident, not the ones you implemented afterwards. Remediation is expected and does not undo the finding.

Why this matters if you are nowhere near a water company

It is tempting to file this under critical national infrastructure and move on. The failings say otherwise. Incomplete monitoring, forgotten end-of-life systems, ageing vulnerabilities and too many administrators are the four most common findings in organisations of any size, and they are more common in small ones, not less — because small teams inherit systems, lose the people who understood them, and have no one whose job is to notice.

The regulator has effectively published its checklist. The reasonable response is not alarm; it is to spend an afternoon establishing your own four numbers: your monitoring coverage percentage, your count of end-of-life systems, the age of your oldest open critical vulnerability, and your number of privileged accounts.

If you do not know all four, that is the finding — and it is a much cheaper one to make yourself than to have made for you.

Four Controls, One £963,900 Fine: What the ICO Just Told Everyone It Checks