Cyber Security for Small Businesses: A Practical UK Guide

Cyber security for small business owners comes down to five basics: a proper firewall, securely set-up devices, control over who can access what, protection against malware, and prompt security updates. These are the five technical controls behind the government-backed Cyber Essentials scheme, and the NCSC designed them to prevent the most common internet-based threats. Add reliable backups and a password manager, and you have a sound setup without enterprise costs.

This guide explains each control in plain terms, shows what we typically set up for micro businesses of 1 to 15 staff, and covers Cyber Essentials certification and when managed IT support starts to make sense.

Why Small Businesses Are a Target

Many owners assume they are too small to interest attackers. The National Cyber Security Centre disagrees: its small business guide states that 1 in 2 small businesses suffer a cyber incident every year.

Most cyber attacks are not aimed at you personally. Automated tools scan the internet for weak passwords, unpatched software and badly configured devices, and break into whatever they find. A small business with no IT staff is often easier to get into than a large company, which is exactly why the basics matter.

The Five Cyber Essentials Controls

The NCSC's Cyber Essentials scheme is built on five technical controls. Even if you never apply for certification, they are the best checklist a small business can work from.

1. Firewalls

A firewall sits between the internet and your network and decides what traffic gets through. Most small businesses rely on the router their broadband provider supplied, which is built for convenience rather than control. These routers typically offer basic firewall rules, little logging, and no way to keep staff devices apart from guests or smart printers.

For small offices we typically install a Unifi firewall. It gives proper firewall rules, a simple VPN for remote staff, and one place to manage every network device, on hardware that suits a small budget.

2. Secure Configuration

Secure configuration means setting up computers so there are as few ways in as possible. In practice:

• Staff use standard accounts, not administrator accounts, so malware can't make system changes

• Laptops are encrypted with BitLocker, so a lost or stolen device doesn't expose sensitive data

• Software and user accounts nobody uses are removed

For larger teams, Microsoft Intune adds central control: security policies applied to every device, and the ability to lock or wipe a laptop remotely.

3. Security Update Management

Attackers look for known weaknesses in software, often ones the maker has already fixed. Turn on automatic updates for operating systems and software, apply security patches promptly, and replace anything that no longer receives updates. Old software that the maker has stopped supporting is one of the easiest ways in.

4. User Access Control

User access control decides who can reach your data and what they can do with it. Give each person access only to what their role needs, turn on multi-factor authentication (MFA) for every system that offers it, and remove accounts as soon as someone leaves.

Passwords are part of this. Password managers let a team store and share logins securely, and we typically set up Keeper so nobody reuses passwords or keeps them in a spreadsheet.

5. Malware Protection

Malware protection finds and stops viruses and other malicious software before they do damage. Every business device needs up-to-date endpoint protection, managed centrally so you know it is running everywhere, not just installed once and forgotten.

Email and Microsoft 365 Security

Email is a common way in, through phishing attacks and stolen logins. For most small teams we recommend Microsoft 365 Business Premium. It includes Microsoft's business security tools, device management and conditional access, which can block logins that don't meet your rules.

Enforce MFA on every account, and keep files in OneDrive and SharePoint rather than on individual laptops. That way work is backed up with version history and doesn't disappear with a lost device.

Backups: Your Way Back

Backups are the core of business continuity. They let you recover from ransomware, a failed disk or a deleted folder. The setup we typically recommend has three layers:

• On-site storage (a NAS or server) for fast local restores

• OneDrive and SharePoint for day-to-day file sync and version history

• A separate backup of Microsoft 365, because Microsoft keeps your service running but doesn't replace a proper backup of your data

Test a restore now and then. A backup you have never restored from is a hope, not a plan.

Working Remotely Without Opening Doors

Remote and hybrid working mean company data leaves the office. Give remote staff a VPN so their connection to office systems is encrypted, make sure their laptops are set up to the same standard as office machines, and write a short remote working policy so everyone knows the rules for home networks, shared devices and public Wi-Fi.

Getting Cyber Essentials Certified

Cyber Essentials certification shows customers and suppliers that you have the five controls in place. The NCSC notes that a growing number of organisations require suppliers to be certified before they can bid for work.

There are two levels. Cyber Essentials is a verified self-assessment, and the NCSC lists it as priced by organisation size, starting at £320 plus VAT. Cyber Essentials Plus covers the same five controls but adds independent technical testing of your systems. Certification is run by IASME, the NCSC's delivery partner, and the NCSC publishes the assessment questions free, so you can see what is involved before you apply.

We hold Cyber Essentials certification ourselves, and we help businesses prepare for it and through the certification process. If you want help getting certified, get in touch.

When to Bring In Managed IT Support

Running your own IT can work in the early days. It tends to fall apart once you reach around five users, or when you make your first remote hire. At that point, someone needs to own updates, backups, new starters, leavers and the problems that always arrive at the worst moment.

Our managed IT support costs £60 to £75 per user per month, plus £200 to £250 a month for each site or network, depending on whether you take a 12-month contract. The per-user price covers Microsoft 365, support, antivirus, device management, remote monitoring, BitLocker and email signatures. One-off work is charged by the hour. See our IT support page for what is included.

Common Objections

"We're Too Small to Be a Target"

Attacks are automated, so size doesn't protect you. If a system is open, it gets found.

"We Can't Afford It"

A day of downtime, or the cost of recovering from a breach, can easily outweigh months of prevention. Several of the controls, such as MFA and automatic updates, cost nothing beyond setup time.

"Someone on the Team Handles IT"

That works until they leave, go on holiday or hit something outside their experience. Security needs consistency, and it shouldn't depend on one person.

Small Business Cyber Security Checklist

• A business firewall, not only the broadband router

• Standard (non-admin) user accounts and BitLocker on every laptop

• Automatic updates turned on; unsupported software replaced

• MFA on email and every system that offers it

• A password manager for the whole team

• Endpoint protection on every device, managed centrally

• Three layers of backup, with a tested restore

• A VPN and a written remote working policy

If your website is part of the picture, our guide to the signs your website has been hacked covers what to watch for there.

Small Business Cyber Security FAQs