5 cyber security basics every small business should have in place
You don’t need an enterprise security budget to be genuinely hard to hack. Most attacks on small businesses aren’t clever — they go after the easy targets: a reused password, an out-of-date laptop, a staff member who clicks the wrong link.
Get these five basics right and you’ve closed the doors most attackers walk through.
1. Turn on multi-factor authentication (MFA)
If you do only one thing, do this. MFA means a stolen password isn’t enough to get in — a login also needs a code from your phone. It blocks the vast majority of account takeovers, and it’s usually free to switch on for email and key apps.
Start with email, then your most important business apps.
2. Make sure your backups actually work
Plenty of businesses have a backup. Far fewer have ever tested restoring from one — and a backup you can’t restore is just a false sense of security. Aim for automatic daily backups of anything you couldn’t run the business without, and check, at least twice a year, that you can actually get the data back.
3. Keep everything updated
Those “update available” prompts you keep dismissing? They’re often patching the exact holes attackers use. Set computers, phones and key software to update automatically so it happens without anyone having to remember.
4. Help your team spot a scam
Your people are the front line. A quick bit of training — how to recognise a phishing email, a fake invoice, or a “the bank account has changed” message — pays for itself the first time someone pauses instead of clicking. It doesn’t need to be a big production; little and often works.
5. Limit who can do what
Not everyone needs to be an administrator. Give people access to what they need for their role and no more, and remove access promptly when someone leaves. It limits the damage if any single account is ever compromised.
Where to start
If that list feels like a lot, you’re not alone — and you don’t have to tackle it all at once. These basics line up with a recognised security standard, which is a practical way to work through them in order and show, with evidence, that you’ve done it.
No one can promise you’ll never be targeted. But getting these five in place — and keeping them in place — puts you well ahead of most small businesses, and out of reach of most attacks. If you’d like a hand, that’s exactly what our managed cyber security is for.
Want this handled for your business?
Book a free, no-obligation IT & security assessment. In about 30 minutes you'll know exactly where you stand — and the simplest way to fix it.