Small Business Cybersecurity Basics: Plain-English Steps

Most small businesses are attacked not because they are important, but because they are easy. The UK government's Cyber Security Breaches Survey 2025 found that 43% of UK businesses identified a cyber breach or attack in the previous 12 months, and phishing (fake emails, texts or calls) was involved for 85% of those. This guide is for owners and managers of small and very small businesses, sole traders, charities and clubs who do not have an IT team. It explains, in plain English, the handful of steps that stop most everyday attacks, how to set them up, how to spot trouble, and who to call for help. Most steps take minutes, not days, and none of them needs specialist skills.

Key takeaways

Protect your email first. Your business email is the key to almost every other account, because password resets go there. Use a passkey or a long unique password, plus two-step verification.
Turn on two-step verification everywhere it matters. Banking, email, payroll, cloud storage, your website and social media. The NCSC says any type is better than none.
Keep two backups, and practise restoring. One online and one on a drive you unplug. A backup you have never restored is a hope, not a plan.
Let devices update themselves. Turn on automatic updates and replace any computer or phone that no longer gets them.
Check money requests by phone. Before you change bank details or pay an urgent invoice, call the person on a number you already have, never one in the message.

Why small businesses get targeted

Criminals use automated tools that try millions of email addresses and passwords, and send the same scam email to thousands of firms at once. They do not need to know who you are. The NCSC's small business guidance puts it simply: if you think your business is too small to be a target, think again.

The common attacks against small firms are not clever. They are:

Phishing: a fake email, text or call that tricks you into typing a password, opening a harmful file or sending money.
Account takeover: a criminal logs into your email or bank using a password that leaked from another website, because the same password was reused.
Invoice and payment fraud: someone pretends to be a supplier or your boss and asks you to pay into a "new" bank account.
Ransomware: harmful software (malware) that locks your files and demands payment. The 2025 survey estimated about 19,000 UK businesses, roughly 1%, suffered a ransomware crime in a year. See the Ransomware Basics for Small Businesses Guide.
Lost or stolen devices: a laptop or phone left on a train, with no screen lock, gives a stranger your email and customer data.

The good news is that a short list of basic controls blocks most of these. The UK government's Cyber Essentials scheme is built on exactly five of them, covered later in this guide.

Set up the basics in an afternoon

Work through these in order. The first three give you the biggest protection for the least effort.

List your important accounts. Write down every online account the business could not run without. The NCSC suggests banking, HR and payroll, email, social media, cloud storage, your website and domain name (your web address), and any card machine or till software. Note who can log in to each.
Secure your email. If your email provider offers passkeys (a newer way to sign in using your phone or computer's fingerprint, face or PIN instead of a password), turn them on. Passkeys cannot be handed to a criminal on a fake website. If not, use a long password you use nowhere else.
Turn on two-step verification (2SV). 2SV, also called two-factor authentication or MFA, asks for a second proof such as a code from an app on your phone. It stops criminals who already know your password. Do email first, then banking, then the rest of your list. See the Two-Factor Authentication for Everyone Guide.
Use a password manager. A password manager is an app that creates and remembers a different strong password for every account. Protect it with one strong master password and 2SV. See Password Managers Explained for Everyone Guide.
Set up backups. Covered in the next section.
Turn on automatic updates for computers, phones, tablets, browsers and apps.
Lock every device with a PIN, password, fingerprint or face, and turn on encryption (scrambling the data so a thief cannot read it). CISA notes that smartphones and Chromebooks encrypt by default, but Windows and Mac laptops may need it switched on (BitLocker or Device Encryption on Windows, FileVault on a Mac). Menus change, so check your maker's help pages.
Make everyday accounts "standard" users. The NCSC recommends a normal user account for daily work and a separate administrator account used only to install software or change settings. If a criminal gets into an administrator account they can take over the whole device.

Backups that actually save you

A backup is a second copy of your files kept somewhere else. It is what lets you shrug off a broken laptop, a theft or a ransomware attack. The NCSC advises backing up everything the business needs to run: documents, invoices, email, contacts, customer records and your website.

Backup type	Good for	Watch out for
Online (cloud) storage	Automatic, off site, survives fire or theft. Many providers include some free space.	Protect the account with 2SV. If a criminal gets into it, they can delete the copies.
External drive or USB stick	Works without good internet, cheap, fully in your control.	Unplug it when the backup finishes. The NCSC warns some malware also infects connected devices.
Both together	The NCSC's recommended approach: losing one still leaves you the other.	Someone must own the job and check it keeps running.

Most importantly, learn how to restore. Once a quarter, pick a few files and bring them back from each backup. CISA warns that restores often take longer than expected, so time a full restore of one computer at least once a year. For more on home and personal copies see the Backing Up Personal Data Guide.

Cyber Essentials: the UK's checklist for small businesses

Cyber Essentials is a UK government-backed certification scheme run by the NCSC. It sets what the government calls a minimum standard of cyber security for organisations of all sizes. Some public sector contracts require it, and it is a useful checklist even if you never certify.

Cyber Essentials control	What it means in plain English	Simple first step
Firewalls	A barrier between your devices and the internet that blocks unwanted connections.	Check the built-in firewall is on in each computer and your office router.
Secure configuration	Remove what you do not use and change default passwords.	Change the router's admin password; delete unused apps.
Security update management	Keep software up to date and stop using software that no longer gets fixes.	Turn on automatic updates; replace unsupported devices.
User access control	Only the right people get access, with only the rights they need.	Remove leavers' accounts; take admin rights off daily accounts.
Malware protection	Stop harmful software running.	Check built-in antivirus is on; only install apps from official stores.

There are two levels. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds hands-on technical testing by an assessor. Certification is handled by IASME, the NCSC's delivery partner. At the time of writing the NCSC lists Cyber Essentials from £320 plus VAT, priced by organisation size, with Plus quoted separately. Free help includes a readiness tool that builds an action plan, a free download of the question set, and a free 30-minute consultation with an NCSC-assured Cyber Advisor for small and medium-sized firms. UK organisations with turnover under £20m that certify their whole organisation also get cyber liability insurance included. Check current prices on the NCSC site, as they change. For the full detail see the Cyber Essentials Guide.

Outside the UK, CISA's guidance for small businesses gives similar steps, split by role: the owner sets the culture and approves the plan, one named person runs the security programme and checks 2SV each month, and whoever handles IT enforces 2SV, applies updates, tests backups and removes admin rights from laptops.

Signs something is wrong

Attacks often start quietly. The NCSC lists these warning signs:

Emails in your sent folder, or customers receiving messages, that you did not send.
Login alerts or 2SV codes you did not ask for.
Devices running slowly or behaving oddly, new pop-ups or programs you did not install.
Payments leaving your account that you did not authorise.
New email forwarding rules or changed bank details on supplier records.

For phishing, look for a sender address that is slightly wrong, an unexpected attachment, a generic greeting, pressure to act fast and links to unfamiliar websites. If in doubt, contact the organisation using details from its official website, never the message. See the How to Spot a Phishing Email Guide and, for phone scams, the Recognising Tech Support Scams Guide.

What to do if it happens

Do not panic, and do not hide it. Tell staff to report mistakes straight away. A quick report matters more than blame.
Change the password and sign out everywhere on any account you think is affected, starting with email. Turn on 2SV if it was off.
Call your bank immediately if money was sent or card details shared. Speed improves the chance of recovering funds.
Disconnect an infected device from Wi-Fi and the network, but leave it switched on unless an expert tells you otherwise.
Report it (see the next section) and keep notes: what happened, when, and which emails or screens you saw.
Check whether personal data was involved. If customer or staff personal data was exposed, UK GDPR may require you to tell the ICO within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. The NCSC's reporting service does not pass reports to the ICO, so you must contact the ICO separately.

The NCSC also recommends a simple cyber attack plan that says who does what, and when. Write it on one page, print it, and keep phone numbers on paper in case your computers are down. A template is in the Incident Response Plan Template.

Where identity fits

Most small business incidents come back to who can log in to what. Old accounts for staff who have left, shared logins for the bank or social media, and IT suppliers with permanent remote access are all doors left open. The NCSC advises removing accounts for leavers, suppliers and contractors, and reviewing access to important accounts every few months. For organisations that want to go further, see the Small Business Identity and Access Security Guide.

Where to get help

NCSC (UK): the free Small Business Guide, the Cyber Essentials readiness tool, and the report service at gov.uk/report-cyber for live cyber incidents. Forward suspicious emails using the NCSC's scam email reporting service.
Report Fraud (formerly Action Fraud) (England, Wales and Northern Ireland): describes itself as the UK's national fraud and cyber crime reporting centre. In Scotland, contact Police Scotland on 101.
ICO: for personal data breaches and help with data protection duties.
CISA (US): free small business guidance and the CSET self-assessment tool. Report incidents 24/7 to CISA Central on (888) 282-0870 or through its online form.
FBI IC3 (US): the FBI's central hub for reporting cyber-enabled crime, including fraud and ransomware.

Common failure patterns

"We are too small to bother with." Automated attacks do not check your size. Small firms are often chosen because the basics are missing.
2SV on some accounts but not email. If your email falls, a criminal can reset the password on everything else.
Old accounts never switched off. A leaver's account or forgotten remote login with no 2SV is a ready-made way in. That is how attackers entered Colonial Pipeline in 2021: an unused VPN account with a leaked password and no 2SV, described in the Colonial Pipeline Ransomware Attack 2021 analysis.
A backup drive left plugged in. Ransomware can encrypt it along with everything else.
Paying a "new bank details" invoice without a phone check. One call to a known number stops most payment fraud.
Running an old computer that no longer gets updates. Known security holes stay open forever.

Practitioner checklist

Write down your important accounts and who can access each.
Turn on passkeys or 2SV for email, then banking, payroll, cloud storage, website and social media.
Install a password manager and replace any reused passwords.
Set up an online backup and an unplugged drive backup, and test a restore.
Turn on automatic updates and replace devices that no longer get them.
Lock and encrypt every laptop and phone.
Remove leavers and old supplier accounts; take admin rights off everyday accounts.
Agree a rule: every change of bank details is confirmed by phone.
Print a one-page plan with who to call, including your bank and the NCSC or CISA reporting details.
Run the free Cyber Essentials readiness tool and decide whether to certify.

Small Business Cybersecurity Basics Guide: Plain-English Steps to Stay Safe