Cyber security for small business: where we'd start.

Most small businesses that get caught out aren't targeted by anyone clever. A password gets reused, an email gets clicked, an update gets put off, and there's no backup that actually restores. Each one is fixable.

1. Get Microsoft 365 set up properly

If your email and files live in Microsoft 365, that's where most of your protection is. Multi-factor sign-in for everyone, old accounts switched off when people leave, and the security features you're already paying for actually turned on. A lot of setups we look at have the licence but none of the settings.

2. Have backups that restore

Having a backup and being able to get your files back are two different things. Ask when anyone last restored a real file from it. Ask whether there's a copy that isn't sitting on the same network, in case something spreads. If nobody knows the answer, that's the first job.

3. Keep things updated

Computers, the router, the server in the cupboard. Updates are boring and easy to put off, which is why old ones are what gets exploited. This should be happening in the background without anyone in the office having to think about it.

4. Help your team spot a dodgy email

Fake invoices, "can you just pay this", a login page that looks almost right. A short, friendly chat with the team does more than any poster. And make it easy to ask: "Is this one real?" should be a normal question, not an embarrassing one.

Scammers often put the real company name in the address, then a dot and their own domain after it, so the part that counts is the very end. And if an email asks you to change bank details, ring that person on a number you already have.

5. Read the government's free guidance

The National Cyber Security Centre's Cyber Essentials guidance is free, written in plain English, and a good first step for any business. Even if you never get certified, it's a useful checklist.

6. Long passwords beat complicated ones

Three random words you'll remember, such as "kettle-orbit-tulip", are stronger than a short jumble of symbols, and far easier to remember. Use a different password for each important account, and a password manager if you have more than a few.

7. Turn on two-step login for everyone

If someone's password is stolen, two-step login (a code or app approval on their phone) stops the attacker getting in. Turn it on for everyone's email first; it's the single biggest improvement most small businesses can make.

8. Lock down the small things

Stop staff installing programs themselves, so a dodgy download can't take hold. Change the factory username and password on every printer, router and camera; default passwords are published online and easy to guess.

9. Know who to call

If something does go wrong, the worst part is not knowing who to ring. Have a number, have someone who knows your setup, and don't wait to see if it goes away on its own.

What about Cyber Essentials?

We don't certify or submit Cyber Essentials assessments. We do the technical preparation (firewalls, secure configuration, user access, malware protection, updates) and work alongside your chosen certification body.

None of this is glamorous. It's mostly the day-to-day IT work we already do for our customers, done carefully. If you'd like us to look at where you stand, we're happy to.