A small business usually has no security team and often no full-time IT person, yet it holds customer data, money and accounts that criminals want. This article sets out which security measures a small business should put in place first, in what order, and which free help exists. It draws on guidance from CISA (the US cybersecurity agency), the NCSC (the UK's national cyber security centre) and NIST (the US standards institute). The main message is that a few basic measures, done well, matter more than buying many products.

Why small businesses are targeted

CISA says small businesses hold valuable information that cybercriminals seek, often with fewer resources for cybersecurity than larger firms, and that incidents affecting small businesses have surged, especially ransomware (malware that locks files until a ransom is paid). The NCSC defines a small organization as one with 0 to 49 employees in the UK, says such organizations are just as likely as larger ones to suffer online crime, and states that about 1 in 2 small businesses have a cyber incident every year. That figure is the NCSC's statement about UK organizations, not a Thai statistic.

Start with ownership, not products

CISA's small business guidance gives each role a short list of tasks. The chief executive builds a security culture and sets simple goals such as how many accounts use multifactor authentication (MFA, a second login step), how quickly updates are installed and how much data is backed up. CISA states that culture cannot be delegated. The chief executive also names a security program manager, who does not need to be a security expert and who reports progress at least monthly. The NCSC adds that cybersecurity should not rest with one person, because every team member has a part in it.

The measures to put in place first

The order below is our own view, built from the CISA and NCSC lists. Each measure is one that those agencies name for small businesses:

  • Turn on MFA, starting with email, administrator and finance accounts: CISA says to enforce MFA through technical settings instead of relying on people, and to require it for all system administrator accounts. Any MFA is better than none, and CISA calls FIDO authentication the only widely available phishing-resistant option
  • Use a password manager and long, separate passwords: CISA recommends at least 16 characters or a passphrase of 4 to 7 unrelated words, a different one for each account
  • Back up what the business cannot run without, and test the restore: the NCSC says to keep both an online copy and an offline copy, to unplug external drives when not in use, to turn on 2-step verification for online backups, and to practice restoring. CISA notes that many ransomware victims had no backups or damaged ones
  • Install updates automatically, and fix the actively attacked flaws first: CISA says to enable automatic updates where possible and to give priority to flaws in its Known Exploited Vulnerabilities (KEV) catalog
  • Lock down laptops: CISA says to remove administrator rights from ordinary users' laptops and to turn on disk encryption on Windows and Mac laptops
  • Use a mainstream cloud workspace and its security settings: CISA suggests moving on-premises mail and file storage to services such as Google Workspace or Microsoft 365, and points to its SCuBA baselines for configuring them
  • Train people to spot scams and to report them: CISA's list for the program manager includes training on MFA, updates, avoiding phishing links and how to report suspicious activity
INFOGRAPHIC
Four areas a small business should cover first
Security basics
do these well before buying more tools
Accounts and passwords
MFA, password manager
Backups
online and offline, tested
Devices and updates
auto-update, no admin rights
People and response
training, an owner, a rehearsed plan

For the everyday habits behind these measures, see Easy Cybersecurity Tips for Everyone. For which kind of MFA to choose, see MFA: Which Type Is Safer?. For a stronger backup design, see Backup 3-2-1-1-0 and Immutable Backups.

Free help you can use

Several agencies publish free material for small businesses:

  • NCSC small organisations guide: its landing page names three topics: backups, protecting devices and accounts, and spotting scams. The NCSC says the guide needs no technical expertise and that many recommendations take about five minutes each
  • CISA Cyber Guidance for Small Businesses: tasks for the chief executive, the program manager and the IT lead, plus tips on incident response plans and tabletop exercises
  • CISA no-cost services: its pages list Cyber Hygiene Services (no-cost monitoring to help reduce exposure to threats) and the SCuBA project for securing cloud services. Eligibility and availability for organizations outside the US are not stated on the pages we read, so check before relying on them
  • NIST Small Business Cybersecurity Corner: guidance by topic (ransomware, phishing, MFA, cloud security, supply chain, cyber insurance, incident response), training videos, and a finder for regional support programs

When to buy a service instead of doing it yourself

This section is our own view, not taken from the agencies. If nobody in the business can keep up with updates, alerts and account reviews, paying a managed service provider (a company that runs IT or security for you) can be more realistic than hiring. Before you sign, ask what the provider does when an alert fires, who can log in to your systems, how your data and backups are protected, and what happens to your data if you leave. For the wider choices, see EDR, XDR and MDR Compared and MDR: How to Choose a Provider.

Prepare before something happens

CISA says the chief executive should review and approve the incident response plan before an incident occurs, and take part in tabletop exercises (a talk-through of a made-up incident). It suggests a scenario in which an employee's laptop is locked by ransomware. If it has already happened, see Ransomware: The First 5 Steps, and for a ready scenario to rehearse, see Ransomware Tabletop: A Ready-to-Use Scenario Template.

A 90-day plan

The plan below is our own example, not a standard. It puts the measures above into three stretches so that a small team can finish each one.

  • Days 1 to 30, accounts and backups: turn on MFA for email, administrator and finance accounts, set up a password manager, and make and test one backup
  • Days 31 to 60, devices and updates: turn on automatic updates, remove administrator rights from ordinary laptops, and turn on disk encryption
  • Days 61 to 90, people and response: train staff, name the security program manager, write a short incident response plan, and run one tabletop exercise
INFOGRAPHIC
A 90-day plan (our own example)
1
Days 1–30: accounts, backups
MFA, password manager, one backup
2
Days 31–60: devices
auto-update, disk encryption
3
Days 61–90: people, plan
training, a plan, one exercise

Common mistakes

  • Buying tools before turning on MFA and backups: the basic measures cost little and cover the most common attacks (our view)
  • Assuming the business is too small to be a target: the NCSC says small organizations are just as likely as larger ones to suffer online crime
  • Having backups nobody has tested: CISA notes that many ransomware victims had no backups or damaged ones, and restore times were longer than expected
  • Leaving security to one person: the NCSC says every team member has a part in it
  • Giving everyone administrator rights on their laptop: CISA says to remove those rights from ordinary users
  • Relying on staff to remember to turn on MFA: CISA says to enforce it with technical controls and audit for gaps
INFOGRAPHIC
Common slips versus better habits

Common slip

  • Buy tools firstMFA still off
  • Backups never testedrestores may take longer than expected
  • Everyone is an adminCISA says to remove admin rights

Better habit

  • Start with MFA and backupslow cost, wide cover (our view)
  • Restore a real filelearn before an incident
  • Remove admin rightsas CISA states

Start today

  • Turn on MFA for the owner's and finance staff's email accounts: this is usually quick (our view)
  • Pick a password manager and move your most important accounts into it
  • Copy your key business files to an online store and an offline drive: then try restoring one file
  • Turn on automatic updates on every computer and phone
  • Name one person as the security program manager: and agree on a monthly check-in
  • Read the NCSC small organisations guide: many of its recommendations take about five minutes each, according to the NCSC

To see where your business stands today, try the self-assessment. For the basics in plain language, see What Is Cybersecurity?.

Small organizations that want to rank where to invest first can use Simple Cyber Risk Assessment You Can Do Yourself.

References and further reading

The advice comes from the CISA, NCSC and NIST pages listed below, which were read on 4 November 2026. We read the NCSC backup page and the landing page of its small organisations guide, but not its pages on devices, accounts and scams, so nothing here is attributed to those. The order of the measures, the section on managed services and the 90-day plan are our own, and the NCSC figure describes UK organizations. Guidance changes, so check the original pages before acting.