Cybersecurity does not have to begin with a costly technology project or a 60-page policy. For most UK small businesses, the biggest improvements come from a handful of practical habits: protect the accounts that run the business, keep devices current, make recoverable copies of essential data, and give people a simple way to stop and report suspicious requests.
This matters whether you are a sole trader, a growing agency, a shop with a card terminal, a trades business with phones in vans, or an office-based firm using cloud software. Email, online banking, payroll, accounting, customer records, domain hosting and social-media accounts are all valuable targets because they can be used to steal money, disrupt trading or impersonate your business. The National Cyber Security Centre’s small organisations guide is intentionally built around actions that smaller organisations can take without being security specialists.
The five fixes below turn that guidance into a one-week owner-led action plan. Start with the systems whose loss would stop you trading: your main email, bank and payment services, accounting platform, payroll, website and domain, cloud storage, customer-management system and social accounts. Do not wait for a perfect inventory. A useful first version written on one page is far better than a plan that never begins.
Day 1: Put passwords in a password manager
Shared spreadsheets, notebooks in drawers, browser tabs containing reset links and the same password used across several services are all warning signs. They are understandable shortcuts when people have too many logins to manage, but they turn one stolen password into access to multiple parts of the business.
A password manager gives each person a secure vault for creating and storing long, unique passwords. That means staff do not need to memorise every credential or reuse a familiar one. The NCSC says the security benefits generally outweigh the risks, provided the product is usable for your team and set up properly. Its password manager buyer’s guide also explains why password managers can reduce insecure workarounds caused by password overload.
What to do this week
- Choose one approach. For a very small firm, the password manager built into an operating system or browser may be a practical starting point. For teams, consider a business-focused manager with individual vaults, controlled sharing, removal of former staff and activity records.
- Protect the vault itself. Give every user a strong, memorable master password or passkey where available, and turn on multi-factor authentication for the vault.
- Change the highest-risk passwords first. Start with the owner’s email, domain registrar, cloud storage, online banking, payment processor, payroll, accounting system and website administrator account. Generate a different password for every account.
- Stop casual password sharing. Do not send credentials through email, WhatsApp or a group chat. Use named user accounts wherever the service permits them. If a shared credential is unavoidable temporarily, store it in a controlled shared vault and set a date to replace it with proper delegated access.
- Plan for leavers and emergencies. Decide who can remove a departing employee’s access and how the business can recover essential accounts if the owner is unavailable. Recovery should not mean one person can silently read every employee’s private vault.
A password manager is not magic. A criminal may still persuade someone to approve a sign-in, install harmful software, or use a legitimate account after it has been compromised. But unique credentials mean a breach of one supplier or service is less likely to cascade into your email, finance and customer systems.
Day 2: Turn on multi-factor authentication for the accounts that matter
Multi-factor authentication, often called MFA, two-factor authentication or two-step verification, asks for more than a password when someone signs in. The additional proof might be an approval in an authenticator app, a code, a security key, a passkey or another method offered by the service. This creates a valuable barrier when a password has been guessed, leaked or entered into a convincing fake login page.
The NCSC recommends securing important online accounts with strong, unique passwords and two-step verification where passwords are still used. Its guidance on important online accounts identifies the right priorities: finance, HR and payroll, cloud storage, company website and domain hosting, point-of-sale systems and social-media accounts.
Prioritise in this order
- Email first. Whoever controls an inbox can often reset passwords elsewhere and impersonate the account holder.
- Finance next. Secure online banking, accounting, payroll, payment services and any platform that stores payment details.
- Then business control points. Turn it on for domain registrar, website hosting, cloud storage, customer systems and social-media administrator accounts.
- Finally, secure the password manager. A cloud-synchronised vault deserves MFA because it protects many other credentials.
Where a service offers passkeys, consider enabling them for critical accounts. The NCSC describes passkeys as a more secure sign-in method that is resistant to common phishing because a user cannot simply type or disclose a passkey to a fake site. However, keep recovery methods secure too. Attackers know that recovery email addresses, telephone numbers and helpdesk processes can be easier targets than the login itself.
For staff, an authenticator app or passkey is often preferable to relying solely on text-message codes, but the best method is the one your business can use reliably. Record recovery codes in the appropriate person’s password vault, not in an unprotected notes app. Make sure there is a documented route if a staff member loses a phone, changes number or leaves suddenly.
Day 3: Make updates automatic, then remove unsupported technology
Updates are not merely about new features. They fix weaknesses in operating systems, browsers, apps, routers and security tools that criminals can exploit. Leaving devices running old software is like knowingly leaving a faulty lock on the back door because replacing it is inconvenient.
The NCSC’s device protection guidance advises keeping devices, software and apps up to date, and replacing devices that no longer receive security updates. This includes work laptops and mobiles, but also shared tablets used for bookings, a home computer used for company accounts, and the router or Wi-Fi equipment that connects the business.
Carry out a 45-minute update sweep
- Turn on automatic operating-system and app updates on company devices, where this is not already managed by an IT provider.
- Restart laptops and phones that have been postponing updates. A download is not always a completed security fix until the device restarts.
- Update browsers and remove old extensions. A browser extension with broad access to webpages and passwords deserves particular scrutiny.
- List any unsupported computers, phones, tablets, accounting packages or line-of-business software. Set a replacement, upgrade or retirement date rather than accepting “we cannot update it” as the final answer.
- Check that built-in firewall and anti-malware protections have not been disabled. Download software only from official stores or the supplier’s official site.
If your business uses an external IT company, ask one direct question: “Which devices and applications in our business are unsupported or missing critical updates, and who owns fixing each one?” Get the answer in writing. You do not need to understand every technical detail; you do need an accountable owner and a deadline.
Day 4: Back up the data you need to trade, and test the restore
A backup is a usable copy of the information your business needs when the original is unavailable. It can help after ransomware, accidental deletion, device failure, loss or theft. The relevant data is broader than a folder marked “accounts”: think customer contacts, quotes, invoices, job files, product images, email, website content, supplier records, payroll information and the configuration details needed to regain access to key services.
The NCSC advises creating copies of important business data and checking that you know how to restore them. Its backups guidance notes that a connected external drive can also be affected by malware, so it should not remain connected when it is not being used.
A realistic small-business backup standard
- Identify the essentials. Ask, “What would stop us invoicing, serving customers or paying people tomorrow?” Back up that information first.
- Use more than one copy. For example, maintain a protected cloud backup and a separate external copy stored securely. Do not depend on a single laptop or USB stick.
- Protect backup accounts. Turn on MFA for cloud storage and backup services. Limit administrator access to the people who genuinely need it.
- Set a schedule. Daily may be suitable for working files; weekly may suit less frequently changing material. The important point is that the schedule matches the amount of work you could afford to lose.
- Test one restoration. This week, restore a non-sensitive file or folder into a safe location. Confirm it opens, is complete and can be found by someone other than the person who set the system up.
Cloud synchronisation is useful, but it is not automatically the same as a tested backup. If a file is deleted or maliciously encrypted and that change synchronises everywhere, you may need version history or a separate backup to recover it. Check what your provider retains, for how long, and whether you can restore without the original device.
Day 5: Create a phishing-reporting habit that works against AI impersonation
Phishing is not just an obviously misspelled email asking for bank details. It can be a supplier invoice with amended bank details, a text posing as a delivery company, a fake Microsoft or Google sign-in page, or a caller pretending to be your accountant. AI can make the wording more fluent, tailor messages from public information, and help criminals mimic a familiar voice or create convincing images and video. That raises the need for verification; it does not mean every message, call or video is fake.
No technical control can reliably determine whether an urgent instruction from a familiar-looking email, voice or video reflects a genuine human decision. MFA, password managers, email filtering and updated software reduce important routes into an account, but they do not replace a payment-control process. Your people must have permission to pause.
Build a “stop, verify, report” rule
Tell every member of staff: no unexpected request to change bank details, release money, buy gift cards, disclose data, reset an account or install software should be acted on from the original message alone. Verify it independently using a known telephone number, a saved contact, a supplier portal or a fresh message to a previously confirmed address. Do not use a number, link or reply address supplied in the suspicious request.
Make the check proportionate to the risk. A routine order may need one confirmation; an urgent request from “the director” to send a large payment should require a call-back and a second approver. The process should apply even if the request appears to come from the owner. In fact, senior-person impersonation is exactly where it matters most.
Give staff a reporting route in one sentence
Use a simple instruction such as: “Forward suspicious emails to report@phishing.gov.uk, then send them to our internal reporting address or named person; do not click, reply, download or delete the original until it has been reviewed.” The NCSC’s phishing guidance explains how suspicious messages can be reported, while the UK reporting service says reports help it identify and disrupt malicious messages and websites.
For suspicious text messages, staff can forward the message to 7726, which is used by participating UK mobile providers. If money has been lost, an account has been compromised, or there is suspected fraud, report it through Report Fraud. Keep the message, headers where possible, screenshots, payment references and a short timeline; evidence helps your bank, insurer and investigators.
Your owner-friendly incident-response checklist
A calm, repeatable response can limit damage. Print this list, keep it with your continuity documents and make sure at least two people know where it is. It complements the NCSC’s Response and Recovery guidance.
- 1. Pause and preserve. Do not panic, pay a ransom, wipe devices or delete suspicious messages. Write down the time the issue was found, who noticed it and what they saw.
- 2. Contain safely. Disconnect an affected computer from Wi-Fi and wired networks if you suspect malware or ransomware. Do not turn off a device unless instructed by competent support, because useful evidence may be lost. Do not keep using a suspected compromised account.
- 3. Contact the right people. Alert your IT support provider, business owner or incident lead. Contact your bank’s fraud team immediately if a payment or banking account may be involved, using a trusted number. Notify your cyber insurer if you have one and follow its conditions.
- 4. Secure the control points. From a known-clean device, change passwords for affected accounts, end active sessions where the service allows it, review forwarding rules and connected apps in email, and reset credentials that may have been exposed. Enable MFA if it was missing.
- 5. Assess data and business impact. What systems, accounts, people and information are involved? Can you still trade? Which customers or suppliers need a temporary warning about fraudulent messages or altered payment instructions?
- 6. Report where appropriate. Report fraud or cybercrime to Report Fraud. If a significant cyber attack is ongoing, the NCSC says businesses can call 0300 123 2040. If personal data is involved, start a breach log immediately and assess whether the incident is reportable to the Information Commissioner’s Office.
- 7. Meet data-protection duties. The ICO says an organisation must notify it without undue delay, and where feasible within 72 hours, when a personal data breach is likely to create a risk to people’s rights and freedoms. If the risk is high, affected people may also need to be told without undue delay. Use the ICO’s data-breach reporting guidance and obtain appropriate professional advice if needed.
- 8. Recover carefully. Restore from a known-good backup only after you understand the cause sufficiently to avoid reintroducing the problem. Check access rights, update software and monitor accounts after restoration.
- 9. Learn and improve. Hold a short review: what happened, what delayed the response, what control would have reduced the impact, and who owns the fix? Turn the answer into a dated action, not a vague intention.
Make this the week cybersecurity becomes routine
These five fixes are deliberately unglamorous. They will not eliminate fraud, ransomware or AI-enabled impersonation, and no responsible adviser should promise that. What they do is reduce the chance that one careless click, leaked password, missed update or lost laptop becomes a business-stopping event.
Set aside an hour with the people who run your key systems. Assign a named owner to passwords, MFA, updates, backups and phishing reporting. Put completion dates beside each action, test one recovery and rehearse one suspicious-payment call-back. Then use the NCSC’s free Cyber Action Toolkit to keep building from a practical baseline. The best cybersecurity plan for a small business is not the most elaborate one; it is the one your business can actually maintain next week, next month and when someone is under pressure.
