Small Business Cyber Security: A Practical Starting Point

Small businesses do not need an enterprise security department to make meaningful improvements. They do need clear ownership, secure accounts, managed devices, recoverable data and a plan for incidents. The goal is to reduce common risks and make recovery predictable.

Protect email and important accounts

Use unique passwords stored in a password manager and enable multifactor authentication. Remove shared accounts, keep administrator access separate from everyday work and disable access promptly when somebody leaves.

Keep an accurate device and software inventory

You cannot secure equipment you do not know exists. Record computers, servers, phones, network equipment and important cloud services. Replace unsupported technology, enable encryption and use central management to verify updates and endpoint protection.

Back up for recovery, not reassurance

Decide which data and systems are critical, how much data the business can afford to lose and how quickly operations must resume. Keep backups appropriately separated from production access, monitor every job and test restores regularly.

Reduce phishing and payment fraud

Give staff simple examples, a clear reporting route and permission to question unusual requests. Verify new bank details and high-risk payments through a trusted second channel. Technical filtering helps, but a strong process is equally important.

Prepare for an incident

• Name the people who can make operational, legal and communications decisions.
• Keep supplier and emergency contact details available outside normal systems.
• Document how to isolate devices, disable accounts and preserve evidence.
• Know which regulator, insurer, customer or bank may need notification.
• Practise a short tabletop scenario and record improvements.

Measure the basics

Review patch compliance, multifactor-authentication coverage, failed backups, unsupported assets, privileged accounts and unresolved critical risks. A small set of reliable measures is more useful than a long dashboard nobody owns.

The NCSC’s current small organisations guide covers accounts, devices, backups and attack awareness in accessible steps.

Our Astley Essentials service provides a practical protection baseline, while our managed cyber security services support organisations that need broader oversight.