A small business does not need an expensive security programme to be reasonably safe. It needs a short baseline that is actually followed: unique passwords in a password manager, two-factor authentication on email and every important account, company-owned accounts rather than personal ones, updated devices, an offline backup that has been tested, a rule for verifying payment changes, and a clear process when staff join or leave. Written on one page and reviewed every quarter, this baseline blocks most of the attacks that hit businesses of ten to fifty people.
The hard part is not knowing what to do but keeping it alive after the first month. That needs a named owner, simple checks and a habit of fixing small gaps before they become incidents.
Why a baseline beats a big security project
Small business owners often hear about security in one of two ways: frightening news stories about huge breaches, or sales pitches for complex products. Neither helps them decide what to do on Monday morning. The result is often nothing at all, or one expensive tool that nobody configures properly.
Most attacks on small businesses are not sophisticated. They use stolen or reused passwords, phishing emails, unpatched devices, fake payment requests and the absence of backups. A short list of basic controls blocks the majority of them, the same way locking doors and windows prevents most burglaries without needing a vault.
A baseline is that short list, written down, assigned to people and checked regularly. Its value lies less in any single item than in the fact that everything on it is done consistently. One unprotected email account or one forgotten former employee's access can undo the rest.
This article gives a baseline suited to businesses of roughly five to fifty people, without in-house security staff. Adapt it, but resist the urge to make it longer before the short version is solid.
The one-page baseline
Copy this table into a shared document, add an owner name to each row and a date for the last check.
| Area | Minimum standard | Typical owner | Check |
|---|---|---|---|
| Passwords | Unique passwords stored in a business password manager | Office manager or IT contact | Quarterly |
| Two-factor authentication | On email, cloud storage, banking, social pages and remote access | IT contact | Quarterly |
| Account ownership | Company accounts, at least two admins for each critical service | Director | Quarterly |
| Devices | Screen lock, automatic updates, security software, no pirated software | IT contact | Monthly |
| Email and payments | Phone verification for any change of bank details or urgent transfer | Accountant | Every request |
| Backups | Daily versioned backup plus one offline or immutable copy, restore tested | IT contact | Restore test every few months |
| Staff changes | Checklist for joining and leaving, access removed on the last day | HR or office manager | Every change |
| Incident plan | One page: who decides, who to call, how to disconnect | Director | Yearly exercise |
If a row has no owner, it will not happen. In a very small company the same person may own several rows; that is fine as long as it is written down.
Accounts and identities: the foundation
Almost every serious incident in a small business begins with an account: an email password guessed or phished, a social media page run from one person's personal login, a shared password that a former employee still knows. Getting accounts right removes the most common starting points.
Every critical service should be owned by the company, with business accounts where the platform offers them, and at least two administrators so that one lost or compromised account cannot lock the business out. Personal accounts of staff should never be the only key to company assets.
Passwords belong in a business password manager with shared vaults by team, so access can be granted and removed cleanly. The practical setup, including master passphrases and recovery, is described in setting up a password manager safely.
Two-factor authentication goes on everything that matters, starting with email. Prefer authenticator apps, passkeys or security keys for administrators and finance staff, because those accounts are the ones scammers work hardest to reach.
Onboarding and offboarding staff
Staff changes are where access quietly accumulates. A checklist turns them into routine.
- Create accounts from a standard list. Email, password manager, shared drive, chat, and only the systems the role needs.
- Set up two-factor authentication on the first day. Do it together with the new employee, so it is done properly and they know how to recover.
- Explain the three golden rules. Never share codes, verify payment changes by phone, report anything suspicious quickly without fear of blame.
- Record which devices they use. Company laptop, personal phone with work email, any other device with company data.
- On the last day, remove access to everything. Disable accounts, remove them from shared vaults and admin roles, and transfer ownership of files and pages.
- Change shared passwords they knew. Wi-Fi, shared social accounts, alarm codes and anything not covered by individual logins.
- Collect company devices and remove company data from personal ones. Use the device management or app settings available to you, and confirm in writing.
Do not let offboarding wait for the next quiet week. Access left open for a month after someone leaves is one of the most common findings when businesses review their security.
Devices: laptops, phones, printers and routers
Keep a simple device list. Every computer, phone with company email, printer, router, camera and network storage. You cannot protect what you do not know you have.
Turn on automatic updates. For operating systems, browsers and office software. Schedule updates for routers and firewalls too.
Replace devices that no longer get security updates. Old routers and computers on unsupported systems are common entry points.
Use screen locks and disk encryption. A lost laptop with encryption is a hardware cost; without it, it may be a data breach.
Install reputable security software. Make sure alerts reach someone who will read them.
Remove pirated and unnecessary software. Cracked programs and unused tools increase risk without adding value.
Change default passwords on network devices. Routers, cameras, printers and storage devices often ship with well-known default logins.
Separate guest Wi-Fi. Customers and visitors should not share the network that office computers use.
Email: the front door, and the payment trap
Email is where most attacks start. Spam filtering provided by reputable email services blocks a lot, but not everything. Staff need a simple habit: hover over links before clicking, distrust unexpected attachments, and report suspicious messages to one person without fear of looking foolish.
One threat deserves special attention: fake payment requests. A supplier appears to email that their bank account has changed, or the director appears to ask the accountant for an urgent transfer. The email may come from a look-alike address or even from a genuine but hacked mailbox. Businesses lose large sums this way because the request looks completely normal.
The defence is procedural, not technical. Any change of bank details, and any unusual urgent payment, is verified by calling a known phone number, not one from the email. Write this rule down, tell suppliers about it, and protect the accountant from pressure when they follow it.
On the technical side, ask whoever manages your domain and email to set up the standard email authentication records that help receiving servers detect messages forged in your name. They also protect your customers from scams that impersonate you.
Data: know what you hold and where it lives
List the important data types. Customer details, staff records, contracts, accounting data, designs, price lists.
Note where each type is stored. Shared drive, cloud workspace, accounting software, personal laptops, chat groups. Scattered data is hard to protect.
Move business data off personal devices where possible. Shared, managed storage is easier to back up and to control when staff leave.
Limit access by role. Not everyone needs payroll files or full customer lists. Use folders and permissions.
Stop sending sensitive files through chat apps. ID card photos and contracts sent in chat remain on many phones indefinitely.
Delete what you no longer need. Old customer lists and records kept "just in case" are a liability if they leak.
Check legal obligations with a professional. Rules on personal data protection apply to businesses and change over time. Ask a lawyer or qualified adviser what applies to you.
Backups and ransomware readiness
A business that can restore its data without help from attackers turns ransomware from a catastrophe into a painful but survivable event. That requires versioned backups, at least one copy that malware on office computers cannot reach, and a restore that has actually been tested.
The ways ransomware gets into small businesses, from exposed remote desktops to pirated software, and the steps to block them are covered in our ransomware prevention checklist for small businesses. The baseline here assumes those steps are part of the device and account sections above.
Put the restore test on the calendar. Choose a folder and the accounting data, restore them to a spare computer, and ask the people who use them to confirm everything opens. Time it, and write the steps down for the day it is needed for real.
Keep the one-page incident plan next to the backup instructions, printed, outside the main systems. On the worst day, people will look for paper.
A worked example: a 12-person trading company
A family-run import and distribution company with twelve staff has grown without thinking much about security. Email accounts use passwords people chose years ago, the company's social media page belongs to the founder's son's personal account, accounting runs on one desktop computer, and backups are a USB drive that was last plugged in some months ago.
The director asks the office manager to own the baseline. In the first month she moves passwords into a business password manager, turns on two-factor authentication for all email accounts, and adds herself as a second administrator on the social media page. The IT freelancer the company already uses sets up automatic updates and replaces an old router that no longer receives security updates.
In the second month they set up daily cloud backup with version history for the shared drive, a weekly backup of the accounting data using the software's own function, and a second external drive that the director takes home and swaps every week. The first restore test reveals that the accounting backup needs a password nobody had written down; they fix that.
In the third month the accountant receives an email from a regular supplier announcing new bank details. Following the new rule, she calls the supplier on the number in the contract. The supplier knows nothing about it; their email had been hacked. The payment that would have gone to the scammers goes to the right account instead. For the director, that single phone call justifies the whole effort.
Common mistakes
Buying a product instead of building habits. Tools help, but without owners and checks they become expensive decoration.
Exempting the boss. Directors and accountants are prime targets; they need the strongest protection, not exceptions.
Running business assets from personal accounts. When that person leaves or is hacked, the business loses control.
Sharing one login among several staff. It hides who did what and makes offboarding impossible.
Assuming backups work. Untested backups fail at the worst moment.
Paying bank detail changes without a call. This single gap causes some of the largest losses in small businesses.
Punishing staff who report mistakes. People who fear blame hide clicks and compromises until it is too late.
Writing a long policy nobody reads. One page that is followed beats twenty pages that are filed.
When to bring in outside help
Setting up email authentication and domain security. Ask your domain or email provider, or an IT professional, to configure it correctly.
Network design and firewalls. A qualified IT provider can separate guest and office networks and secure remote access.
Personal data obligations. A lawyer or qualified adviser can explain current requirements for the data you hold.
After any suspected compromise. Bring in an experienced IT or security firm before cleaning up, to avoid destroying evidence.
Choosing business software for sensitive data. Ask for references and security information, and test exports so you are not locked in.
Insurance questions. If you consider cyber insurance, a qualified insurance adviser can explain what policies require and cover.
Fraud and losses. Report financial fraud to your bank and the police immediately; they decide what can be recovered or investigated.
Keeping it alive: the quarterly half hour
The baseline decays without attention. People join and leave, new tools appear, someone creates a social account for a campaign and forgets it. A thirty-minute review every quarter catches most of this drift.
Go through the table row by row. Are all staff in the password manager? Does every critical account still have two-factor authentication and two administrators? Are there any devices on the list that stopped updating? When was the last restore test? Did anyone leave whose access was not fully removed?
Also ask one open question: what almost went wrong this quarter? A suspicious email that nearly worked, a lost phone, a payment request that felt strange. Near misses are free lessons, and they often point to the next small improvement.
Write the date of the review on the document. After a year, the company has a simple, honest record of its security, built without a large budget and owned by the people who run the business every day.
Frequently asked questions
How much should a small business spend on cybersecurity?
There is no standard figure. Many baseline steps cost little beyond time: two-factor authentication, updates, offboarding and payment verification. Spend first on a password manager, reliable backups and a trusted IT provider.
Who should own security in a company without IT staff?
Usually an organised manager, such as the office manager or operations lead, with support from an outside IT provider. The owner does not need to be technical but must keep the baseline and reviews alive.
What is business email compromise?
It is fraud in which attackers use a fake or hacked email account to trick a company into paying money to the wrong bank account. Verifying payment changes by phone on a known number is the main defence.
Do we need security training for staff?
Short, practical sessions help more than long courses. Show real phishing examples your company received, explain the three golden rules, and make reporting easy and blame-free.
Is it safe for staff to use personal phones for work email?
It can be acceptable with a screen lock, updates, two-factor authentication and the ability to remove company data when someone leaves. Agree these conditions in writing.
How often should the baseline be reviewed?
A short review every quarter, plus an immediate check whenever someone leaves, a new critical tool is added or a suspicious incident occurs.
