Cybersecurity basics every small business should have

Small businesses are attractive targets precisely because they are often less protected. The good news is that most attacks rely on simple weaknesses: reused passwords, missing updates, a convincing email. Government guides such as the UK NCSC’s small organisations guide, CISA’s Cyber Essentials and ENISA’s cybersecurity guide for SMEs all start from the same basics.

1. Strong passwords and a password manager

Every account needs its own long password. A password manager such as Bitwarden or 1Password makes that practical for the whole team. Check whether your work emails have appeared in known breaches with Have I Been Pwned.

2. Two-step sign-in everywhere

Turn on two-step verification for email, banking, your website and every cloud tool. Where it is offered, passkeys are even better: they cannot be phished like a password.

3. Updates, without delay

Most successful attacks use weaknesses that already have a fix. Turn on automatic updates for computers, phones, your website and its plugins, and replace devices that no longer receive updates.

4. Backups you have tested

Keep regular copies of important data, with at least one copy offline or in a separate account, so ransomware cannot reach it. A backup you have never restored is only a hope: test it.

5. A team that can spot a trap

Teach everyone to recognise phishing: urgent requests, unexpected attachments, payment details that suddenly change. Agree that any request to change bank details is confirmed by phone.

6. A secure website

Your website should run on HTTPS, which is free with Let’s Encrypt, have its software kept up to date and be built with common risks in mind, such as those in the OWASP Top 10.

Go further when you are ready

Once the basics are in place, a recognised scheme such as the UK’s Cyber Essentials certification or the NIST Cybersecurity Framework gives you a structured way to improve, and reassures clients who ask how you protect their data.