Cyber security basics for small businesses

Many attacks on small businesses don’t need a skilled hacker. They rely on a reused password, a laptop that missed its updates or one convincing email. The basics close those gaps, and many take only minutes to put in place.

This guide follows the National Cyber Security Centre (NCSC), the UK’s authority on cyber security. Its Small Business Guide, refreshed in April 2026 as the Small organisations guide to cyber security, comes down to five habits: secure how people sign in, keep devices updated, back up your data, spot scams, and plan for when something goes wrong.

Secure your email and important accounts first

Your email is the key to everything else, because whoever controls it can reset the passwords on your other accounts. Secure it first. Then move on to the accounts your business couldn’t run without: banking, payroll, cloud storage, your website and domain, social media, card payments and your phone system (our guide to VoIP security covers that one).

For each account, the NCSC’s advice on securing email runs in this order:

• Use passkeys where you can. A passkey signs you in with your device, using a fingerprint, your face or a PIN, instead of a password, and it resists phishing. The NCSC says to turn them on as a priority.
• Otherwise, use a strong password that’s unique to that account. The NCSC suggests combining three random words to make one. A password manager, or the one built into your device or browser, means you don’t have to remember them all.
• Turn on 2-step verification (2SV). Also called two-factor or multi-factor authentication, it asks for a second check, such as a code sent to your phone, so a stolen password isn’t enough on its own. The NCSC says any type of 2SV is better than none.

Then tidy up who has access. Remove accounts for staff, suppliers and contractors who no longer need them, and review who can reach your important accounts every few months. On computers, use an everyday account for normal work and keep a separate administrator account for installing software and changing settings.

Keep devices and software up to date

Updates fix the weaknesses criminals use to get in. The NCSC calls keeping devices up to date the best way to protect your organisation from viruses.

• Turn on automatic updates for devices, apps and web browsers.
• Replace phones, laptops and computers that no longer get updates. They don’t need to be new, just still supported.
• Delete apps you don’t use, and only install apps from official stores.
• Check that the built-in antivirus and firewall are switched on.
• Lock every device with a six-digit PIN, a strong password or a fingerprint or face scan, including personal phones used for work.

If you’d like a benchmark, Cyber Essentials requires updates that fix critical or high-risk weaknesses to be installed within 14 days of release.

Back up what you couldn’t work without

Ransomware (malicious software that locks your files and demands payment to unlock them), a stolen laptop or a failed hard drive can all cut you off from your data. A backup is what gets you working again. The NCSC’s backup advice, in short:

• Back up everything the business needs to run: documents, emails, invoices, contacts, customer records and your website.
• Use both online storage and a storage device if you can, so one copy survives if the other is lost or fails.
• Disconnect a backup drive when you’re not using it, because some malware spreads to connected devices.
• Turn on 2SV for your online backup account.
• Practise restoring, so you know the backup works and holds everything important.

Learn to spot phishing

Phishing is a fake email, text or call that tries to get you to click a link, open an attachment, hand over login details or send money. The NCSC says most cyber attacks against businesses start with a scam email.

Warning signs include:

• pressure to act quickly
• an attachment or link you weren’t expecting
• a generic greeting, such as “Dear valued customer”
• a sender’s address that’s slightly wrong
• spelling mistakes or a poor-quality logo

If a message asks for money or new bank details, check it with the sender using a phone number or website you already know, never the details in the message. Take extra care with invoices and requests to change a supplier’s bank account.

It also helps to share less online. Staff profiles and posts that reveal who does what make convincing scams easier to write.

Plan for when something goes wrong

Spotting an attack early and knowing what to do can stop a small problem becoming a big one. Agree now who does what if an account is hacked or files are locked: who calls the bank, who resets passwords and who tells customers. The NCSC has step-by-step help for small organisations on phishing, hacked accounts, ransomware and payment fraud.

Where to report an attack or a scam

• Suspicious emails: forward them to report@phishing.gov.uk, the NCSC’s reporting service.
• Suspicious texts: forward them to 7726, which is free with most phone providers.
• Fraud and cyber crime in England, Wales and Northern Ireland: report it to Report Fraud online or on 0300 123 2040. It replaced Action Fraud in December 2025.
• In Scotland: call Police Scotland on 101.
• If money has gone: call your bank straight away.
• If personal data was exposed: you may have to report it to the ICO within 72 hours of finding out. The ICO’s guide explains when, and says to keep a record of every breach either way.

Not sure where yours belongs? The government’s signposting service points you to the right place.

Cyber Essentials: proof you’ve covered the basics

Cyber Essentials is a government-backed scheme that certifies you have five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. There are two levels. Cyber Essentials is a self-assessment that’s checked independently, and Cyber Essentials Plus adds independent technical testing.

The current requirements, updated in April 2026, say that signing in to cloud services must always use multi-factor authentication. The government also uses the scheme for certain public contracts, such as those where a supplier handles people’s personal information.

Not ready to certify? The NCSC’s free Cyber Action Toolkit gives small organisations personalised steps to work towards it.

Where to start

Turn on 2SV for your email today, then work through your other important accounts, your updates and your backups. If you’d like help, VoIPTech offers IT support and a free IT audit, where we review your set-up, security and network and send you a report on how to get the best from your systems.