Cybersecurity basics for small businesses: the controls that matter most

Most attacks on small businesses are not personal. Criminals use automated tools to scan the internet for weak passwords, unpatched software and exposed services. They send phishing emails in bulk and see who clicks. A small business is attractive because it often has valuable data, access to larger customers and fewer defences.

The common outcomes are ransomware that locks your files, invoice fraud where a criminal impersonates a supplier, and stolen email accounts used to attack your clients. Each can stop work for days and damage trust. The good news is that a small set of well-applied controls blocks most of these attacks.

If you only do a few things, do these. They are listed roughly in order of impact for a typical small business.

1. Turn on multi-factor authentication everywhere

MFA asks for a second proof, such as an app prompt or a security key, as well as a password. It is the single most effective control against account takeover. Start with email, Microsoft 365 or Google Workspace, banking, your website admin, cloud hosting and any remote access. Prefer authenticator apps or hardware keys over SMS codes, which can be intercepted. Make sure admin accounts use the strongest option available.

2. Keep software up to date

Attackers move quickly once a vulnerability is published. Turn on automatic updates for operating systems, browsers and office software. Do not forget routers, firewalls, website plugins and themes. The UK Cyber Essentials scheme expects critical and high-risk security updates to be applied within 14 days, which is a sensible target for any business. Replace devices and software that no longer receive security updates.

3. Back up properly, and test restores

Backups are your recovery plan for ransomware, accidental deletion and hardware failure. A common rule is 3-2-1: three copies of your data, on two different types of storage, with one copy off site. At least one copy should be offline or immutable, so ransomware cannot encrypt or delete it. Remember that cloud apps like Microsoft 365 and Google Workspace keep your data available, but a dedicated backup gives you more control over restoring it. Test a restore every few months. A backup you have never restored is a hope, not a plan.

4. Limit admin access

Staff should use standard accounts for daily work. Keep admin accounts separate and use them only when needed. This limits what malware can do if someone clicks a bad link. Review who has access to what every quarter, and remove leavers on their last day.

5. Secure your email and domain

Email is the main route for phishing and invoice fraud. Set up three DNS records on your domain:

• SPF lists the servers allowed to send email for your domain.
• DKIM adds a digital signature that proves an email was not altered.
• DMARC tells receiving servers what to do with emails that fail those checks, and sends you reports.

Start DMARC in monitoring mode, review reports, then move to quarantine or reject once your legitimate senders pass. Google and Yahoo now require bulk senders to authenticate their email, so this also helps your messages reach inboxes. Turn on the built-in phishing and malware filters in your email platform.

6. Protect every device

Use the built-in or a business-grade antivirus and endpoint protection on all laptops and desktops. Turn on full-disk encryption, such as BitLocker on Windows Pro or FileVault on macOS, so a lost laptop does not mean lost data. Set screen locks on phones and laptops. If staff use personal devices for work, consider a device management tool so you can enforce basic settings and wipe company data if needed.

7. Use a password manager

People reuse passwords because they cannot remember dozens of unique ones. A business password manager generates and stores strong passwords and lets you share logins securely, without spreadsheets or sticky notes. Combine it with MFA for the best result.

8. Train staff on the threats they will actually see

Short, regular sessions work better than a yearly lecture. Focus on spotting phishing, checking unexpected payment requests by phone using a known number, and reporting mistakes quickly without blame. A clear rule such as "any change to bank details is confirmed by phone" prevents a lot of invoice fraud.

Yes. You do not need to invent your own approach.

• Cyber Essentials (UK): a government-backed scheme built around five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Certification is required for some UK government contracts.
• NIST Cybersecurity Framework 2.0 (US): organised around six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST publishes small business quick-start guides.
• CIS Controls: a prioritised list of safeguards, with an "Implementation Group 1" set aimed at smaller organisations.

Businesses in the UAE, Saudi Arabia and India also face local data protection rules, so check which regulations apply to the data you hold.

Write a one-page incident plan before you need it. It should answer:

1. Who to call first, internally and externally, including your IT provider and insurer if you have cyber cover.
2. How to isolate affected devices, for example by disconnecting them from the network rather than switching them off.
3. How to reset passwords and revoke sessions for compromised accounts.
4. When and how to notify customers or regulators if personal data is involved.
5. How to restore from backup and confirm systems are clean.

Keep a printed copy, because your systems may not be available during an incident.

Many of the most important controls are already included in tools you pay for. MFA, update management, email filtering and disk encryption come with Microsoft 365, Google Workspace, business editions of Windows and macOS. The main costs are a password manager, a backup service, possibly endpoint protection and the time to set everything up properly. Ongoing monitoring or managed support adds a monthly fee that depends on the number of users and devices. Our managed IT support can take on routine updates, access reviews and backup checks.

We help small businesses put these core controls in place, starting with a quick review of accounts, devices, email and backups, then fixing the gaps in order of risk. See our cybersecurity service, or contact us for a practical starting point.