Before you spend another £1 on cyber security, do these 5 things
Five free, practical steps every SME can take today to reduce cyber risk
Cyber security can become an expensive conversation very quickly. New tools. New licences. New services. New acronyms.
But, before an SME spends another pound, it is worth asking a much simpler question…
Are we already doing the obvious (and Free) things properly?
That matters because the latest UK Government survey says 43% of businesses identified a cyber breach or attack in the last 12 months, with 46% of small businesses and 65% of medium-sized businesses reporting incidents. (Gov)
The NCSC’s current small-business guidance makes the same point from a different angle. Many useful cyber improvements can be completed in just a few minutes and do not require a technical expert (NCSC).
For an MD or FD, that is good news.
You do not need to approve another cyber project to make the business meaningfully harder to attack today. If you need a helping hand, give us a bell.
1. Turn on MFA wherever it matters
If there is one free control every SME should deal with first, this is probably it.
Multi-factor authentication (MFA), or 2-step verification, adds another check after the password. That might be an app notification, a code or another authentication method.
Start with Microsoft 365, then work through the systems that would cause the most damage if somebody got into them:
- banking and finance platforms
- payroll
- cloud storage
- HR systems
- CRM
- social media
- admin accounts
Why start with email?
Because an email account is often the route into everything else. If somebody controls a director’s or finance employee’s inbox, they may be able to impersonate them, reset passwords elsewhere or watch conversations until the right opportunity appears.
The National Cyber Security Centre (NCSC) specifically highlights business email as a valuable target because access can expose private information, enable impersonation and help criminals get into other accounts.
There is also evidence that SMEs still have room to improve here. In the latest government survey, only 43% of micro businesses required two-factor authentication, although that was up from 35% the year before (GOV).
Today’s action: ask whoever manages Microsoft 365 to confirm that MFA is enforced for every user, not merely “available”. That distinction really matters.
2. Remove people who should no longer have access
Most businesses are reasonably good at creating accounts.
They are often much worse at removing them.
Think about the people who have passed through the business in the last few years like former employees, temp staff, contractors, marketing agencies, IT suppliers and freelancers. People who changed roles but kept the same permissions.
Somewhere in that list may be an account that nobody remembers. That is unnecessary risk.
Spend 30 minutes reviewing the obvious systems and ask yourself:
Who can get into this today, and do they still need to?
Pay particular attention to accounts with administrator rights.
The same principle applies to social media. The NCSC advises businesses to make sure people who leave or change roles no longer retain access.
This is not glamorous cyber security. There is no new platform to buy. But removing an old account permanently closes a door that did not need to be open.
For a growing SME, this is also where better process starts to matter. Joiners, movers and leavers should trigger access changes automatically rather than depending on somebody remembering six weeks later.
3. Stop postponing updates “Remind me tomorrow.”
It may be one of the most clicked buttons in business. Updates are easy to delay because the immediate cost of five minutes of interruption is visible. The risk of not updating is much less visible and significantly less digestible.
Software vendors release updates for lots of reasons, but one important reason is to fix known security weaknesses. Once those weaknesses are public, criminals can actively look for systems that have not been patched. That means an old laptop or unpatched application can effectively leave a known route into the business.
Check the basics
- Are Windows and macOS updating automatically?
- Are company mobiles current?
- Are browsers updating?
- Are old applications still being used simply because nobody has reviewed them?
- Check your IT provider has enabled full patch management & RMM platform
This becomes more important as businesses grow. A five-person firm may be able to check devices manually. At 50 or 150 people, relying on individual employees to remember is no longer a strategy.
Do this it’s FREE.
Turn automatic updates on wherever you can, restart devices that have been avoiding them and remove obsolete software you no longer need.
The objective is not perfection. It is to stop carrying avoidable weaknesses simply because everyone kept clicking “later” alligator.
4. Prove one backup actually restores
Most businesses will confidently answer yes if asked whether they have backups. But backups are nothing if you can’t restore.
So, the real question is “When did we last restore something from a backup?”
Choose a harmless file or folder and recover it. Actually go through the process.
The NCSC explicitly recommends not only creating backups, but knowing how to restore them and checking that they contain the important data the business needs.
This is where the distinction between backup and recovery becomes very real. A backup may exist but it may be incomplete, inaccessible or the credentials may be missing. The retention period may be wrong and nobody may know how the restore works.
You do not want to discover any of those things during a ransomware incident on a Monday morning.
This test costs nothing if you already have backup in place. And, it confirms you could actually get the data back when needed.
5. Give staff one simple rule when something feels wrong
You can spend heavily on security and still have somebody in finance receive a convincing email apparently from the MD asking for an urgent payment.
Or an employee can get an unexpected Microsoft login prompt and approve it because they assume IT is doing something.
People need a simple response when that happens, not a 40-page cyber policy, just a simple rule.
If an unexpected request involves money, passwords, MFA prompts or sensitive information, stop and verify it another way.
Phone the person, use a known number, ask internally. Do not reply to the suspicious message itself to check whether it is genuine.
The NCSC says 85% of cyber attacks against businesses start with a scam email, and lists warning signs including unknown login alerts, emails being sent from your account without your knowledge and unauthorised payments.
Make sure staff know exactly who to tell when something happens and that speed matters. A person who reports a mistake immediately gives the business a chance to contain it. Someone who hides it because they are worried about getting into trouble gives an attacker more time. This cultural point costs nothing.
Who owns these five actions?
This is where smaller businesses often get stuck. Everyone assumes the IT provider is doing it and the IT provider assumes the business decides who should have access. Meanwhile, HR assumes finance tells IT when somebody leaves and finance assumes backups are being tested. The result is activity without ownership.
We advise you to pick a named person for each of these five checks, even if the technical work is outsourced.
The MD or FD does not need to configure Microsoft 365 personally. But, leadership should be able to get a clear answer to five following basic questions.
Is MFA enforced? Are old accounts gone? Are devices updating? Have we tested a restore? Do staff know what to do when something looks wrong?
If nobody can answer those confidently, that itself tells you something.
Free does not mean unimportant
None of these actions makes an SME invulnerable, but together they remove some of the simple, avoidable weaknesses that attackers rely on. That matters at a time when almost 50% of small businesses are identifying cyber incidents and the government is reporting weaker cyber continuity planning and increasing ‘cyber poverty’ among small firms than it did a year earlier.
So before adding another security product or service to the budget, make sure the controls you already have are actually switched on, maintained and tested. It can be as simple a checking a box. If you need help doing that, get in touch.
Not sure where the obvious gaps are in your business? Book a no obligation cyber risk review.
Newsletter
Subscribe for monthly IT advice and a chance to get Co-Op Live tickets.