Cybersecurity Practices for Small and Medium-Sized Businesses

A cybersecurity program does not have to start with a large security team. For a small or medium-sized business, the first goal is to keep essential services running: protect the accounts people depend on, make important data recoverable and decide who will act when something goes wrong.

The priorities below are a starting point, not a guarantee against attack. Adapt them to your systems, budget, industry and contractual obligations. The NIST small business quick-start guide provides a useful framework for organizing that work. nist.gov

1. Identify what the business cannot operate without

List critical services and their owners: email, payment and accounting systems, customer records, websites, cloud applications and administrator accounts. For each, record where its data is stored, who can access it and whom to contact if it fails. Agree on how much data loss and downtime the business can tolerate; use those decisions to set backup and recovery priorities.

2. Secure accounts and limit access

Turn on multifactor authentication (MFA) for email, cloud administration, finance, remote access and backups first, then expand it wherever supported. Prefer phishing-resistant options such as FIDO security keys or passkeys when suitable. If an application does not support them, use an available MFA method and plan an upgrade or alternative. Review recovery methods too: a weaker fallback can undermine a stronger login. cisa.gov

Use unique passwords stored in a reputable password manager. Give each person an individual account and only the access needed for their role. Review permissions regularly, promptly remove access when people leave and keep administrator accounts separate from everyday accounts where practical.

3. Make backups you can actually restore

Back up critical data and configurations on a schedule that reflects how much work the business can afford to lose. Keep at least one protected copy separate from the main environment, such as an offline or appropriately protected independent backup. Restrict backup administration and test restoration regularly, recording what was recovered and how long it took.

Do not assume cloud file history alone is a complete backup. Confirm what each provider protects and maintain an independent copy where needed, as the UK National Cyber Security Centre advises. ncsc.gov.uk

4. Maintain devices and prepare employees

Keep an inventory of laptops, phones, network equipment and business software. Enable automatic updates where feasible; assign an owner to track urgent security fixes and unsupported products. Use device encryption, screen locks and appropriate endpoint protection. Plan replacements for systems that no longer receive security updates.

Teach staff how to report suspicious messages without blame. Establish a second-channel check for payment changes or requests for sensitive information: for example, call a known number rather than replying to the message. Training complements technical controls; it does not replace them. The NCSC guide for small organisations covers devices, accounts and scams. ncsc.gov.uk

5. Plan for incidents before they happen

Write a short response plan that names a decision-maker, a backup contact and external providers. Keep contact details and a copy of the plan accessible if email is unavailable. Define how staff report an incident, when to isolate affected devices, how evidence and logs will be preserved, and who can authorize recovery.

Practise a scenario such as a compromised mailbox or ransomware. Before restoring, investigate the cause and work with qualified responders to avoid bringing compromised systems back online. Assess notification and contractual requirements with appropriate advisers for each relevant jurisdiction. The NCSC response and recovery guide offers a starting point. ncsc.gov.uk

6. Choose delivery partners carefully

Decide which tasks your team can own and where outside expertise is needed. Options include training existing staff, adding specialists or contracting a managed provider. Whichever model you choose, the business should retain a named owner for risk and access decisions. NIST discusses these staffing and outsourcing choices. nist.gov

Before signing, ask prospective providers who monitors alerts, applies patches, tests restores and responds after hours. Agree on scope, response times, access limits, subcontractors, evidence of completed work and an exit process that returns data and removes access. Review critical suppliers periodically; NIST’s supplier due diligence guide and the NCSC’s managed provider checklist can inform the questions. csrc.nist.gov

Altweeb’s technology consulting, software development and IT staffing services can be part of a broader technology conversation. Define security responsibilities and any specialist support needed before agreeing on a delivery scope.

A practical first 90 days

Days 1–30: Name an owner, inventory critical services, enable MFA on priority accounts and verify that backups exist.
Days 31–60: Test a restore, address overdue updates, remove unnecessary access and document incident contacts.
Days 61–90: Run a short incident exercise, review key suppliers and agree on a recurring schedule for access reviews, updates and restore tests.

These are suggested milestones, not a universal deadline. Track a few measures—such as priority accounts with MFA, overdue critical updates and the date of the last successful restore—and review gaps with leadership. Consistent ownership and tested recovery make the basics more valuable than a checklist completed once.

To explore this further, see Technology Consulting & Digital Transformation.