You do not need a large budget to make your business a much harder target. The UK’s National Cyber Security Centre (NCSC) publishes free guidance for small organisations. This checklist turns the basics into actions you can finish in a week.
1. Back up your data
Keep copies of important files and test that you can restore them. Store at least one copy offline or in a separate account, so ransomware cannot reach it. Our 3-2-1 backup guide explains how.
2. Protect against malware
- Use up-to-date security software on every computer.
- Only install apps from official stores or trusted vendors.
- Keep Windows, macOS and your apps on automatic updates.
3. Secure your passwords and logins
- Use a password manager and give every account a long, unique password.
- Turn on multi-factor authentication for email, banking, accounting and cloud storage. See our MFA setup guide.
- Remove access quickly when someone leaves.
4. Defend against phishing
Most attacks start with a convincing email. Train your team to check the sender, hover over links and verify unusual payment requests by phone. Use our phishing email checklist as a starting point.
5. Lock down your devices
- Turn on disk encryption and screen locks.
- Use a firewall, which is built into modern operating systems.
- Be careful with public Wi-Fi, and use a VPN or your phone’s hotspot for sensitive work.
6. Limit who can do what
Give staff only the access they need. Use separate admin accounts that are not used for browsing or email.
7. Have a simple incident plan
Write down who to call and what to do if you are hacked: disconnect the device, change passwords, contact your bank if money is involved, and report fraud to Action Fraud. If personal data may be affected, you may have a duty to report it to the ICO within 72 hours.
Cyber Essentials
Cyber Essentials is a UK government-backed certification covering these basic controls. Some public sector and larger customers ask for it, so it can help you win work. Check the official NCSC website for how to apply.
Frequently asked questions
What is the single most useful step?
Turning on MFA for your email and key accounts, closely followed by reliable backups.
Is antivirus enough?
No. It is one layer. Updates, backups, MFA and staff awareness matter just as much.
Can you help us do this?
Yes. See our services or get in touch.
