Cyber security basics for small businesses: a 10-step plan

The 10 steps

1. Turn on multi-factor authentication for email, banking, cloud and admin accounts.
2. Use a password manager and unique passwords everywhere.
3. Keep software updated, and turn on automatic updates.
4. Back up important data, keep a copy offline or separate, and test that restores work.
5. Use anti-malware protection on every device.
6. Limit admin rights to the people who need them.
7. Train staff to spot phishing, and make it easy to report.
8. Secure your Wi-Fi and remote access, and use a VPN or secure access service for remote work.
9. Check your suppliers’ security, especially those with access to your systems.
10. Have an incident plan: who to call, what to switch off, and how to recover.

Certifications customers ask for

• Cyber Essentials (UK): five basic technical controls, backed by the NCSC.
• ISO/IEC 27001: the international information security management standard.
• SOC 2 (US): an attestation report common for software and service providers.
• NIST Cybersecurity Framework 2.0: free US guidance for managing cyber risk.

When to bring in a professional

If you handle customer payments or sensitive data, have remote staff, or customers are asking for certifications, a managed IT or cyber security provider can help. For remote working, our sister site BestVPNs compares VPN services.

Last updated: 15 September 2026