Cybersecurity basics for small businesses

Small businesses are frequent targets precisely because they have fewer defences. A few basic measures stop most attacks.

The essentials

1. 1Multi-factor authentication on email, banking, accounting and government portals.
2. 2Strong, unique passwords stored in a password manager — never shared by message.
3. 3Updates for computers, phones and software, applied promptly.
4. 4Backups of accounting and key files, kept separately and tested.
5. 5Limited access: staff only get the systems they need, and access is removed when they leave.

The most common scam

An email that looks like it's from a supplier, saying their bank account has changed. Always confirm new bank details by phone, using a number you already have, before paying.

People

Short, regular reminders to staff about phishing do more than one long training session.

Regulation

The National Cybersecurity Authority (NCA) issues cybersecurity controls and guidance. Some sectors and entities have mandatory requirements — check whether they apply to you, and to your clients' contracts.