Make this a joint editorial review
The NCSC advises organisations to consider what their websites and social pages reveal, and which details visitors actually need. Its examples of potentially unnecessary material include staff biographies, personal details in blogs and outdated social connections. The practical question is whether each piece of information still serves an agreed business purpose.
Our recommendation is to run a small review with the people responsible for the website and communications. Start with pages you control. Do not ask IT to remove biographies or rewrite customer-facing material without its owner: an unexplained deletion can lose useful context as well as unnecessary detail.
Review one journey through the site
Choose a normal customer journey, such as learning about a service and finding its contact details. Read the pages as a visitor without logging in. Keep a private working list of the page address, the detail you want to discuss and the owner who can decide whether it belongs there.
For each questionable detail, ask what the customer needs it for, whether it is current and whether a less specific description would do the job. Prioritise information with no current owner or a purpose nobody can explain. Treat uncertainty as a question for the responsible team, not proof that the page is dangerous.
Agree the change before making it
Consider a fictional consultancy whose old event recap includes a named employee’s routine travel arrangements. The communications owner decides the recap still has value but that the itinerary does not. They retain the useful event summary, remove the unnecessary detail and record the decision. This is an illustrative review, not a report about a real organisation.
Use your normal publishing process for the agreed correction. Check the resulting page as a public visitor and record any related pages that need their own review. Keep screenshots and working notes limited to what the decision requires; avoid creating a widely shared catalogue of personal information while trying to reduce exposure.
Include the social account handover
The NCSC also recommends reviewing what business-used social accounts reveal publicly, controlling who can post and removing access when staff leave or change roles. Ask the account owner to confirm who can make those decisions for each channel. A page-content review and an account-access review are related tasks, but each needs a clear outcome.
Finish with a short change log and a named owner for unresolved questions. Set the next review around a relevant business event, such as a staff or service change, rather than inventing a universal deadline. Removing a detail from a page you control is not a promise that every copy elsewhere has disappeared. If you discover an incident or information requiring specialist advice, use the organisation’s reporting route.
Sources
Practical suggestions in this article are editorial recommendations. The source supports the guidance attributed to it.
- NCSC · Spotting cyber attacks ↗
Checked 9 October 2026
Something needs correcting?
Get in touch to explain which claim needs attention and share the supporting source.