Cyber security for a small business is not about buying the most complicated software. It starts with protecting the accounts and information the business cannot operate without, then making recovery part of ordinary work.
In this article
Five protections make the biggest difference
A small organisation may use dozens of online services, but the same few weaknesses cause a large share of avoidable incidents. The National Cyber Security Centre focuses its current small-organisation guidance on email, important accounts, devices, backups and the ability to spot scams.
- Secure email first. Email is often the route into password resets, invoices and customer conversations. Turn on two-step verification and remove access promptly when someone leaves.
- Protect critical accounts. Banking, payroll, cloud storage, the website and social media should each have a unique password or passkey. Do not share one administrator login across a team.
- Keep devices updated. Install security updates promptly, use screen locks and make sure lost equipment can be disabled.
- Back up essential data. Keep copies of the information needed to trade, and test that someone can restore them.
- Make scams discussable. Staff should know that reporting a suspicious click quickly is helpful, not embarrassing.
Know what the business cannot afford to lose
Security becomes manageable when it is tied to real work. List the information and services that would stop the business operating if they disappeared for a week. Typical examples include customer contacts, appointment records, active contracts, invoices, payroll, the company website and access to banking.
For each item, record where it is stored, who has access, who owns the supplier relationship and how it could be recovered. This short inventory is more useful than a generic security policy copied from the internet.
| Question | What a useful answer looks like |
|---|---|
| Who can access it? | Named roles, not “the whole team” |
| How is access protected? | Unique accounts and two-step verification |
| Where is the backup? | A separate copy with a tested restore process |
| Who responds if it fails? | A named internal contact and supplier number |
Turn security into a short monthly routine
The goal is not perfect protection. It is to make common attacks harder and recovery faster. A monthly review can be brief:
- install outstanding updates;
- check administrator and leaver accounts;
- confirm backups completed and restore a sample file;
- review unusual login or payment alerts;
- remind staff how to report suspicious messages;
- update the incident contact list when suppliers or responsibilities change.
Keep the routine owned by two people rather than one. Shared responsibility provides cover during holidays and prevents security knowledge becoming trapped with a single employee or contractor.
If something suspicious happens, preserve the evidence, contact the relevant supplier or IT support and change compromised credentials from a trusted device. If personal data may have been exposed, assess whether the incident must be reported to the ICO. Do not wait for certainty before beginning the internal response.
Where ISO 27001 fits
ISO/IEC 27001 is a standard for an information security management system, usually shortened to ISMS. It does not prescribe one universal list of software. It requires an organisation to understand its risks, choose appropriate controls, assign responsibilities and improve the system over time.
A small business does not need certification before it can benefit from this way of thinking. The useful starting habits are straightforward: define the scope, identify important information, assess realistic risks, record the controls already in place and decide what needs to improve.
Certification becomes more relevant when customers or tenders require independent assurance, when the organisation handles sensitive information at scale, or when a growing team needs a consistent management system. It should be the result of a working security practice, not a certificate pursued in isolation.
A practical first 30 days
- Week one: list critical accounts, information and suppliers. Secure the main email and domain accounts with two-step verification.
- Week two: remove obsolete users, update devices and confirm automatic updates are enabled.
- Week three: create or verify backups, then perform a test restore.
- Week four: write a one-page incident plan with contacts, responsibilities and the first actions to take.
That work will not eliminate every threat, but it will give the business something far more valuable than a shelf of policies: control over its most important information and a realistic path to recovery.
English (UK) 
Français 