Last Updated: 1 November 2026
Quick Summary
To improve IT security, UK SMEs should start with a plain risk assessment, then turn on multi-factor authentication for email and finance accounts, deploy a password manager, patch outdated systems, lock down networks and access, train staff on phishing, keep a monthly checklist and policy, and back up data with a tested incident response plan.
- Rank each risk as high, medium or low to set your priority order.
- Set up MFA on email first, then work down the list of key accounts.
- Give each person only the permissions their job needs and nothing more.
- Restore a real file monthly and a full system at least twice a year.
- The 72-hour ICO reporting clock starts when you become aware of a breach.
Table of Contents
- Why IT Security for UK SMEs Starts with a Risk Assessment
- Step 1: Turn On Multi-Factor Authentication for Businesses
- Step 2: Fix Passwords and Deploy a Password Manager
- Step 3: Patch Outdated Systems and Keep Software Updated
- Step 4: Lock Down Networks, Firewalls and Access Control
- Step 5: Train Staff Awareness to Spot Phishing and Social Engineering
- Step 6: Build a Cybersecurity Checklist for Small Businesses and a Policy to Match
- Step 7: Back Up Data and Write a Small Business Incident Response Plan
- Frequently Asked Questions
Why IT Security for UK SMEs Starts with a Risk Assessment
Most small firms treat IT security like a fire extinguisher: bought once, mounted on the wall, forgotten.
A risk assessment asks three questions:
- What data and systems do we rely on daily?
- Who could get at them, and how?
- What would a day of downtime or a leak cost us?
Write the answers down. Rank each risk as high, medium or low. That list becomes your priority order for the seven steps below.
Watch out: skipping this step is the most common mistake we see.
Layered cybersecurity for small businesses explains how each control backs up the others.
Step 1: Turn On Multi-Factor Authentication for Businesses
Multi-factor authentication, usually shortened to MFA, is a second check at login (Setting up 2-Step Verification (2SV)). After your password, you enter a code from your phone or tap an approval prompt.
Start with the accounts that matter most:
- Email, which is the master key to almost everything else
- Your bank and accounting software
- Cloud storage and any customer database
Set it up on email first, then work down the list. Multi-Factor Authentication: Your Business’s First Line of Defence in Ascot explains how to implement it with expert IT support.
Step 2: Fix Passwords and Deploy a Password Manager
Weak passwords remain the easiest door to push open. A password manager fixes this by generating and storing long, unique passwords for every account. Staff only need to remember one strong master password.
Rules that work in practice:
- No password sharing by email or sticky note
- One unique password per account, no exceptions
- A manager app for the whole team, with admin controls
A common mistake is rolling out a manager but leaving the old shared logins active. Close those down the same week.
Step 3: Patch Outdated Systems and Keep Software Updated
Patching means installing the security fixes that software makers release (Device security guidance | Managing deployed devices | Keeping devices and software up to…). Outdated systems are a known weak link, and attackers scan for them automatically. Set updates to install without asking, and check monthly that they actually did.
Cover these areas:
- Operating systems on laptops and desktops
- Browsers and email clients
- Line-of-business software and plugins
Retire anything the maker no longer supports. An unpatched machine on your network undermines every other control you have.
Step 4: Lock Down Networks, Firewalls and Access Control
Your business network needs a firewall between it and the internet, and a separate Wi-Fi network for guests. Give each person the permissions their job needs and nothing more, so a single compromised account cannot reach everything (Device security principles for manufacturers | 7. Minimise the privilege and reach of…).
Practical steps:
- Change default router and firewall admin passwords
- Split guest, staff and device Wi-Fi networks
- Remove old accounts for former staff promptly
Remote devices need the same treatment. If a laptop leaves the office, it should still meet your update and antivirus rules before it reconnects.
Step 5: Train Staff Awareness to Spot Phishing and Social Engineering
Staff awareness training is one of the more useful controls you can put in place. Phishing and social engineering target people, not machines. A short, regular session beats one long annual lecture.
Teach people to:
Schedule a Free Consultation →
- Check the sender address, not just the display name
- Treat urgent payment or password requests as suspicious
- Verify unusual requests by phone, using a number they already have
Run a test email every few months and review who clicked. Our Cybersecurity Training service can arrange staff awareness sessions for your team.
Step 6: Build a Cybersecurity Checklist for Small Businesses and a Policy to Match
A cybersecurity checklist for small businesses turns good intentions into something you can audit. Keep it short enough that someone actually completes it each month. A policy then sets out who does what, and, importantly, how your security practice lines up with your legal duties.
A monthly checklist might include:
- Confirm all updates installed
- Check backup logs show success
- Review new user accounts and permissions
What a Small Business Cyber Security Policy Should Cover
A small business cyber security policy should state, in plain English, who owns IT security, what devices are allowed, how data is stored and shared, and what staff must do if they suspect a breach. Keep it to a few pages. Staff read short policies; they ignore long ones.
A workable policy covers:
- Roles and responsibilities, name a security lead, even if it is a part-time role
- Acceptable use, what staff may do on work devices and which personal devices may connect
- Data handling, where business data may be stored and how it is shared with clients and suppliers
Linking Security Practice to UK Legal Duties
Security good practice and legal obligation are not the same thing, but they overlap. The UK GDPR and the Data Protection Act 2018 require you to process personal data securely, using appropriate technical and organisational measures.
Two points are worth separating:
- Legal obligations, what the law requires of you as a data controller or processor, including security of personal data and, where relevant, breach reporting to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of a reportable breach.
- Good practice, controls such as MFA, patching and staff training that help you meet those obligations but are not themselves specified in law.
Recognised UK guidance can help you structure this. The National Cyber Security Centre (NCSC) publishes practical guidance for small businesses, and Cyber Essentials sets out a baseline of technical controls.
Keep your policy and your completed monthly checklists together. If you ever need to demonstrate that you took security seriously, to a client, an insurer or the ICO, that file is your evidence.
Making the Checklist Stick
A checklist only works if someone owns it. Assign the monthly review to a named person, put a recurring reminder in the calendar, and record the date each check was completed. If a month is missed, note why. That record turns a tick-box exercise into a defensible audit trail, and it gives you something concrete to review when you next update the policy.
The article sets out a monthly checklist and the policy areas that sit alongside it.
| Checklist item | Policy area |
|---|---|
| Confirm all updates installed | Roles and responsibilities |
| Check backup logs show success | Acceptable use |
| Review new user accounts and permissions | Data handling |
| Confirm MFA is on for all key systems | Access control |
| Review any phishing reports from staff | Incident reporting |
| Check that leavers’ accounts are disabled | Review cycle |
| Confirm antivirus definitions are current on all devices | Review cycle |
Step 7: Back Up Data and Write a Small Business Incident Response Plan
Backups protect your data; a small business incident response plan protects your business. You need both. The 3-2-1 rule is a sound default: three copies of your data, on two types of storage, with one copy kept off site or offline. Why Regular Backups Are Essential for Your Business explains why regular backups protect important data and minimise downtime.
Backups That Actually Recover
A backup you have never restored is a guess. Go beyond the 3-2-1 rule with these practices:
- Keep one copy offline or immutable, ransomware increasingly targets connected backups, so a copy that cannot be altered or deleted from the network is your safety net.
- Test restores on a schedule, restore a real file monthly and a full system at least twice a year, and time how long each takes.
- Record your recovery priorities, decide which systems and data must come back first, second and third, so a recovery is not improvised under pressure.
An untested backup is a guess. Restore a real file and a full system from backup at least twice a year, and time how long it takes. That figure tells you how much downtime to plan for. If the restore fails, you have found the problem on a quiet Tuesday rather than during a crisis.
What the Incident Response Plan Should Name
Your incident response plan should name:
- Who spots and reports a suspected incident, and how they report it
- Who decides to isolate systems or call for help
- Who contacts clients, insurers and the regulator if data is exposed
- How you restore service and learn from what happened
Keep a printed copy. If your systems are locked, a plan stored only on them is useless.
Contain, Report, Recover, Learn
A plan is easier to follow if it is broken into four stages:
- Contain, disconnect affected devices from the network, change compromised credentials and preserve logs before wiping anything.
- Report, tell your security lead immediately. If personal data may have been exposed, assess whether the breach is reportable to the ICO; the 72-hour clock starts when you become aware, not when you finish investigating.
- Recover, restore from your tested backups in your agreed priority order, and confirm that systems are clean before reconnecting them.
- Learn, hold a short review after the incident. Record what happened, what worked and what to change, then update the plan and the checklist.
Do not delete logs or rebuild systems before you have captured what happened. Evidence helps with recovery, insurer claims and any regulatory reporting.
Business Continuity Beyond IT
Recovery is not only a technical task. Decide in advance how the business will operate while systems are down: which tasks can be done on paper, which staff can work from a backup device, and how you will tell clients what is happening. A one-page continuity note, kept with the printed incident plan, closes the gap between restoring systems and keeping the business running.
Frequently Asked Questions
How can a small business improve its IT security without a big budget?
Start with the controls that cost nothing but time: turn on multi-factor authentication, install updates promptly, remove unused accounts and set up automatic backups to a separate location. A cybersecurity checklist for small businesses helps you work through these in order of risk rather than buying tools first. Paid antivirus and a password manager are worth the modest outlay, but the free basics close most of the gaps attackers look for.
Do small businesses need multi-factor authentication?
Yes. Stolen or guessed passwords are behind a large share of breaches, and multi-factor authentication for businesses blocks most of those attempts because a password alone is no longer enough. Enable it first on email, then on remote access, finance systems and any cloud service holding client data. Authenticator apps or hardware keys are stronger than text-message codes, which can be intercepted or redirected.
What should an SME do after a cyber attack?
Follow your small business incident response plan: isolate affected devices from the network, preserve logs and evidence, and tell your IT provider immediately. Report the incident to the National Cyber Security Centre and, where personal data is involved, to the Information Commissioner’s Office within 72 hours of becoming aware. Reset credentials from a clean device, restore from a tested backup, and review what failed so the same route is closed.
How often should a small business back up its data?
Daily automatic backups are a sensible baseline for client records, finance data and email, with more frequent snapshots for systems you cannot work without. Keep at least one copy offline or off-site so ransomware cannot encrypt it too. A backup only counts once you have restored from it, so test a full recovery every quarter and record how long it took, since that figure sets your realistic downtime.
