Most cyber attacks on small businesses aren’t sophisticated. They rely on a reused password, a backup nobody has tested, or a computer that hasn’t been updated in months. That’s good news, because it means a handful of simple habits remove most of the risk.
This checklist takes about five minutes to run through. You won’t fix everything in that time, but you’ll know exactly where you stand and what to do first.
Turn on multi-factor login
Most account break-ins start with a stolen or guessed password. Passwords leak in data breaches all the time, and attackers try them against email, banking and cloud accounts automatically.
Multi-factor authentication (MFA) adds a second step: a code from an app on your phone, or a tap to approve the sign-in. Even if someone has your password, they can’t get in without your phone. Microsoft and Google both say it blocks the vast majority of automated account attacks.
Check now: is MFA switched on for your email? For your online banking? For your accounting software and your website’s admin login?
Where to start: email first. Your email account is the key to everything else, because it’s where password reset links are sent. Then banking, then any system that holds customer data. Use an authenticator app rather than text messages where you can, as texts are easier to intercept.
Check your backups actually work
A backup you’ve never restored is a guess. We regularly meet businesses that were sure they were backed up, only to find the backup stopped running months ago, or only covered part of their data.
A good rule of thumb is 3-2-1: three copies of your important data, on two different types of storage, with one copy kept off-site or in the cloud. For most small businesses, that means your working files, a cloud backup, and a separate copy that can’t be changed or deleted by someone who gets into your systems.
Check now: pick one file you’d really miss, such as last month’s accounts or a key spreadsheet, and try to restore it from your backup. Note how long it takes.
Remember Microsoft 365 and Google Workspace: many people assume their email and cloud files are automatically backed up. Microsoft and Google keep their services running, but deleted or encrypted data may not be recoverable after their retention period. A separate backup of your mailboxes and shared files is worth having.
Update everything
Software updates fix security holes that attackers already know about. Leaving updates for “later” leaves a known way in.
Check now:
- Are automatic updates switched on for Windows or macOS on every computer?
- Are phones and tablets that access work email up to date?
- Is your website’s software, theme and plugins up to date?
- Is your router or firewall running current firmware?
Watch for unsupported devices. Computers that can no longer get security updates, such as those still running Windows 10 after support ended, should be upgraded or replaced. The same goes for old routers and network storage boxes.
Review who has access
Over time, access builds up. A former employee’s account is still active. A contractor still has the Wi-Fi password. Everyone shares one login for the accounts system.
Check now:
- Remove accounts for anyone who has left
- Change shared passwords whenever someone with access leaves
- Make sure only people who need admin rights have them
- Check who can log in to your domain name and website hosting, as losing control of these can take your email and website offline
That last point is more serious than it sounds. In one of our case studies, a former employee took control of a company’s domain and email, causing almost a week of downtime.
Use a password manager
Most people reuse passwords because remembering dozens of unique ones is impossible. A password manager solves that. It creates and stores a strong, unique password for every account, and fills them in for you.
For a team, a business password manager also lets you share logins securely, see who has access to what, and remove someone’s access in one step when they leave.
Make sure staff know what phishing looks like
Phishing emails and messages trick people into handing over passwords, opening malicious attachments or paying fake invoices. They’re getting harder to spot, as attackers now write convincing, well-written messages.
A few simple rules go a long way:
- Never act on an urgent request to pay or change bank details by email alone. Call the person on a number you already have.
- Be wary of unexpected attachments and links, even from people you know.
- If something feels wrong, ask before you click. A quick question is always better than a clean-up.
In another of our case studies, a convincing fake payment receipt was the first sign that a retailer’s systems had been compromised.
Consider Cyber Essentials
Cyber Essentials is a UK government-backed scheme that sets out the basic security controls every organisation should have in place: firewalls, secure configuration, access control, malware protection and keeping software updated. Many of the checks above are part of it.
Certification shows customers and suppliers that you take security seriously, and it’s increasingly asked for in tenders and supply chains. Even if you don’t certify, its requirements make a sensible checklist.
What to do next
If you only do three things after reading this, make them:
- Turn on multi-factor login for email and banking
- Test a restore from your backup
- Switch on automatic updates everywhere
Those three cover most of the risk for most small offices. If you’d like help with the rest, or want someone to check your set-up properly, our IT support service covers security, backups and updates as standard.
