A practical, low-cost starting point for UK small businesses: backups, malware protection, updates, passwords and 2SV, phishing, an incident plan, and Cyber Essentials.
Small businesses are frequent targets for cyber criminals, often because they have valuable data and money but fewer defences than large firms. The good news is that a handful of basic measures block most common attacks, and many cost little or nothing. This guide follows the NCSC's advice for small organisations.
1. Back up your data
If ransomware locks your files or a laptop is stolen, backups let you recover.
- Identify the data you couldn't run the business without: customer records, invoices, designs, accounts.
- Back up automatically and regularly, ideally to a cloud service and/or a device kept separate from your network.
- Make sure at least one backup can't be changed or deleted by an attacker who gets into your systems.
- Test restoring files occasionally.
2. Protect against malware
- Turn on the antivirus built into modern operating systems, or use a reputable product.
- Only install apps from official stores and trusted suppliers.
- Turn on firewalls on devices and the router.
3. Keep everything updated
Updates fix security holes that attackers actively exploit. Turn on automatic updates for operating systems, apps, browsers and routers. Replace devices and software that no longer receive updates.
4. Passwords and two-step verification
- Use a password manager so everyone can have strong, unique passwords.
- Turn on two-step verification (2SV) for email, banking, cloud storage and accounting software as a priority. Email is especially important, because it is used to reset other passwords.
- Change default passwords on devices and routers.
- Remove accounts for staff who leave, promptly.
5. Defend against phishing
- Train staff to recognise phishing and report it, without blame.
- Agree a process to verify payment requests, especially changes to supplier bank details, by calling a known number. Invoice fraud is a common and costly attack.
- Limit admin rights: staff shouldn't browse the web or read email using administrator accounts.
6. Secure devices and Wi-Fi
- Turn on screen locks and encryption on laptops and phones.
- Make sure you can track and wipe lost devices.
- Secure the office router and use a separate guest network for visitors.
7. Plan for an incident
Write down, on one page, what to do if something goes wrong: who to call (your IT support, bank, insurer), how to contact staff and customers, and where backups are. The NCSC's Exercise in a Box is a free way to practise. If you hold personal data and suffer a breach, you may have to report it to the ICO within 72 hours.
Cyber Essentials
Cyber Essentials is a government-backed certification scheme that checks you have basic controls in place: firewalls, secure configuration, user access control, malware protection and security updates. It reassures customers, is required for some government contracts, and the process itself helps you find gaps. Cyber Essentials Plus adds independent technical testing.
Data protection
If you handle personal data, UK GDPR applies. Most organisations that process personal data must pay the ICO data protection fee unless exempt. The ICO has guidance and a self-assessment tool for small businesses.
Working with IT suppliers and cloud services
Many small businesses rely on an IT provider, cloud email and accounting software. Ask suppliers how they protect your data, whether they hold Cyber Essentials, and who is responsible for backups and updates. Check the security settings in cloud services yourself: turn on 2SV for every user, review sharing settings so files aren't open to "anyone with the link", and keep a list of who has admin access.
Cyber insurance
Cyber insurance can cover costs such as incident response, data recovery and business interruption. Insurers increasingly expect basic controls, such as 2SV and backups, before offering cover, and Cyber Essentials can help. Read what is excluded.
Start this week: a five-step plan
- Turn on 2SV for business email and banking.
- Check backups are automatic and test a restore.
- Turn on automatic updates everywhere.
- Set up a password manager.
- Agree a payment verification rule.
Sources and further reading
- NCSC: Small organisations guide to cyber security
- NCSC: Cyber Essentials
- NCSC: Exercise in a Box
- ICO: Personal data breaches
- ICO: Data protection fee
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.