Cyber security for small business UK: a 10-step starting plan

If you run a small business, cyber security can feel like another job on top of everything else. The good news is that you do not need a large budget or a full security team to make meaningful progress. Most small businesses reduce their biggest risk by getting the basics right first: protecting accounts, keeping devices updated, backing up important data, and making sure someone is responsible for the day-to-day follow-up.

The aim of this guide is simple. It gives you a 10-step starting plan that focuses on business impact, not technical complexity. If something goes wrong, the real cost is usually not the technical issue itself. It is the downtime, lost sales, recovery work, customer concern, and the time your team spends dealing with the disruption.

Why small businesses need a starting plan

Small businesses are often targeted because they are busy, trusted, and less likely to have formal controls in place. That does not mean every business is facing the same level of risk, but it does mean the basics matter. A simple plan helps you avoid scattered one-off fixes and gives you a clear order of priorities.

What usually goes wrong first

In practice, the first problems are often very ordinary. Someone clicks a fake email link, a password is reused on another site, a laptop is lost, or a supplier account is misused. These incidents can lead to fraud, data loss, or a temporary shutdown of key systems. For many small firms, even a short interruption can affect cash flow and customer confidence.

How to think about risk without overcomplicating it

You do not need a complicated scoring model to start. Ask three questions: what would hurt the business most if it was lost, who could get into it, and how quickly could you recover? That approach keeps the work practical. If you want a more structured way to think about priorities, our guide to defining and documenting risk appetite can help you decide what level of risk your business is willing to accept.

Step 1: Identify your most important business assets

Start by listing the things that matter most to the business. Keep it short and useful. You are not trying to catalogue every file and device. You are trying to understand what would cause the most disruption if it were lost, stolen, or changed.

People, devices, data and accounts

Think in four groups:

• People, especially anyone who handles money, customer data, or admin tasks.
• Devices, such as laptops, phones, tablets, and shared office computers.
• Data, including customer records, finance files, contracts, and backups.
• Accounts, especially email, banking, payroll, cloud services, and admin logins.

For many small businesses, email and banking accounts are the highest-value targets because they can be used to send fake invoices, redirect payments, or reset other passwords.

A simple way to rank what matters most

Use a three-level ranking: high, medium, and low. High means the business would struggle to operate without it for even a day or two. Medium means the business could cope for a short time, but with inconvenience. Low means it is useful, but not critical. This simple ranking helps you decide where to spend time first.

Step 2: List the main threats to your business

Once you know what matters most, think about how it could be attacked or misused. The point is not to predict every possible problem. It is to focus on the most likely and most damaging ones for a small business.

Phishing, stolen passwords and ransomware

Phishing is when someone tries to trick staff into revealing information or opening a harmful link. Stolen passwords can give an attacker access to email, cloud storage, or finance systems. Ransomware is malicious software that can lock files or disrupt systems until a payment is demanded. These are common because they are effective and do not always require advanced technical skill.

Supplier and email compromise risks

Many small businesses rely on suppliers, accountants, agencies, and software providers. If one of those accounts is compromised, the attacker may use that trust to send convincing messages or change payment details. This is why email controls and supplier checks matter. If you want a broader view of how attackers move through an organisation, our article on threat modelling for risk management is a useful next step.

Step 3: Put one person in charge

Security often fails when everyone assumes someone else is dealing with it. A small business does not need a full security department, but it does need a named owner. That person can be a director, office manager, operations lead, or external adviser, depending on the size of the business.

What a named owner should actually do

The owner should keep the basics moving. That means checking that accounts are protected, updates are applied, backups are working, leavers are removed, and incidents are escalated quickly. They should also keep a simple list of key suppliers, system owners, and emergency contacts.

When to bring in outside help

Outside help is worth considering when the business relies heavily on cloud services, handles sensitive data, has limited internal IT support, or has already had a security incident. A consultant can help you prioritise, avoid wasted effort, and turn a vague concern into a manageable plan. If you are also thinking about a more formal security management approach, our ISMS scope definition for small organisations article explains how to keep the scope realistic.

Step 4: Secure your accounts first

If an attacker gets into an email account, they can often do far more damage than by attacking a single device. That is why account protection should come before most other work. Focus first on the accounts that can move money, reset passwords, or access sensitive data.

Use strong passwords and multi-factor authentication

Use unique passwords for every important account. A password manager can help staff create and store them safely. Add multi-factor authentication wherever possible. This means a second check, such as a code or app prompt, is needed in addition to the password. It makes stolen passwords much less useful.

Protect email, banking and admin accounts first

Start with email, banking, payroll, cloud administration, and any account that can create or delete users. These are the accounts that can cause the most harm if compromised. If you only have time to secure a few things this week, start here.

Step 5: Keep devices updated and protected

Unpatched devices and software are a common route into small businesses. Updates can feel inconvenient, but they are usually far less disruptive than dealing with a compromise. The aim is to make updating routine rather than optional.

Automatic updates for laptops, phones and software

Turn on automatic updates for operating systems, browsers, and common business software. Check that laptops and phones are still receiving support from the manufacturer. Old systems that no longer receive updates should be replaced or isolated from important work.

Basic endpoint protection and device lock settings

Make sure every business device has basic protection enabled, such as malware scanning and device encryption. Set screens to lock automatically after a short period of inactivity. This reduces the chance that a lost or unattended device becomes a bigger problem. If you want a plain-English overview of device controls, our guide to endpoint security capabilities is a good companion piece.

Step 6: Back up the data you would hate to lose

Backups are one of the most valuable protections a small business can have, but only if they are done properly. A backup that cannot be restored is not much help when you need it. The goal is to protect the data and systems that would be expensive or impossible to recreate quickly.

What to back up and how often

Prioritise customer records, finance data, contracts, shared documents, and any system that would take time to rebuild. Decide how often the data changes. Some information may need daily backups, while other files can be backed up less often. The more critical the data, the shorter the gap between backups should be.

How to check that a backup can actually be restored

Do not assume a backup works just because it exists. Test a restore on a regular basis. Pick a file, a folder, or a system and confirm that it can be recovered in a usable form. This is one of the simplest ways to avoid a painful surprise during an incident. For a deeper look at recovery planning, see our guide to backup and recovery planning.

Step 7: Reduce the amount of access people have

Many security problems become worse because too many people have too much access. A small business can lower its risk by making access more deliberate. Staff should only have the access they need to do their job, and no more.

Only give access that is needed for the job

Review who can access finance systems, customer records, shared drives, and admin tools. If someone only needs to view information, do not give them edit rights. If they only need access occasionally, consider time-limited access rather than permanent access.

Remove old accounts when staff leave

Leavers are a common weak point. Remove or disable accounts promptly when someone leaves or changes role. Also check for shared accounts, old supplier logins, and forgotten test accounts. These are easy to overlook and can remain open long after they are needed.

Step 8: Set a few clear rules for email and file sharing

Email remains one of the easiest ways for attackers to reach staff. It is also where many business mistakes happen, such as sending the wrong file to the wrong person or approving a payment request without checking it. A few simple rules can reduce those risks without slowing people down.

Spotting suspicious messages and links

Train staff to pause when a message creates pressure, asks for secrecy, or changes payment details. Check the sender carefully, especially if the message is about invoices, bank details, login problems, or urgent approvals. If in doubt, staff should verify the request using a known phone number or trusted contact method, not by replying to the message.

Safe ways to share files with customers and suppliers

Use approved file-sharing tools rather than personal email accounts or ad hoc links. Limit access where possible and remove sharing links when they are no longer needed. If a file contains sensitive information, make sure the recipient really needs it before sending. For businesses that rely on Microsoft 365, our article on logging and monitoring basics for small teams can help you think about visibility as well as prevention.

Step 9: Prepare a simple incident response plan

When something goes wrong, people lose time because they are trying to work out what to do first. A short incident response plan removes that uncertainty. It does not need to be long or formal. It just needs to be clear enough that someone can use it under pressure.

Who to call and what to do in the first hour

Write down the key contacts: the internal owner, IT support, your email or cloud provider, your bank, and any external adviser you would call for help. Decide in advance who can approve urgent actions such as disabling accounts, isolating devices, or contacting customers. The first hour should focus on containing the issue, preserving evidence, and stopping further damage.

What information to keep if something goes wrong

Keep a simple incident log. Record when the issue was noticed, who reported it, what systems were affected, what actions were taken, and who was informed. This helps with recovery, insurance discussions, and any later investigation. It also makes it easier to learn from the event rather than repeat it.

Step 10: Review your basics every quarter

Security is not a one-time project. Staff change, suppliers change, software changes, and the business changes. A quarterly review keeps the basics from drifting out of date.

A short checklist for ongoing maintenance

Every quarter, check that:

• Important accounts still have multi-factor authentication turned on.
• Devices are still receiving updates.
• Backups are running and restores are tested.
• Leavers have been removed.
• Key contacts and suppliers are still correct.
• Any recent incidents have been recorded and reviewed.

When to improve, outsource or formalise your controls

If the same issues keep coming back, or if the business is growing quickly, it may be time to formalise your approach. That could mean clearer policies, better documentation, or outside support to help you build a more consistent security baseline. If you are aiming for a recognised control framework, our guide to Cyber Essentials explained for small businesses is a sensible place to understand how a basic scheme fits into the picture.

Where Cyber Essentials fits into the picture

For many UK small businesses, a starting plan like this overlaps with the practical controls expected in common baseline schemes. That is useful because it means you are not doing work twice. The same actions that reduce day-to-day risk also help show that you have taken sensible steps to protect the business.

How this starting plan supports common baseline controls

The ten steps above support the essentials: secure accounts, protected devices, reliable backups, controlled access, and a basic incident response process. Those are the foundations that make later improvements easier. If you build them first, any future security work is usually cheaper and less disruptive.

When a formal scheme may be worth considering

A formal scheme may be worth considering if customers ask for it, if you handle sensitive information, or if you want a clearer way to demonstrate that your controls are in place. It should be treated as part of a wider improvement plan, not as the end goal on its own.

A practical 30-day action plan for busy owners

If you want to get started without turning this into a major project, break the work into three short phases. The aim is progress, not perfection.

What to do this week, this month and next

This week, identify your most important accounts and turn on multi-factor authentication for them. This month, check backups and test one restore. Also remove any obvious old accounts and make sure devices are updating automatically. Next month, write a one-page incident response plan and agree who owns it. After that, review the list every quarter.

How to make progress without a full security team

Keep the plan short, assign one owner, and review it in normal management meetings. Use simple checklists rather than long policies. If you need help turning the basics into a workable plan for your business, a consultant can provide practical support without overcomplicating the process. The right approach is usually steady improvement, not a big one-off programme.

For many small businesses, the biggest gains come from a handful of sensible actions done consistently. Protect the accounts that matter most, keep devices updated, back up the data you rely on, and make sure someone is accountable. That alone will put you in a much stronger position than most businesses that wait until after an incident to act.

Frequently asked questions

What are the 10 steps to cyber security?

For a small business, a practical 10-step plan is: identify important assets, list the main threats, name one owner, secure accounts, keep devices updated, back up important data, reduce access, set email and file-sharing rules, prepare an incident plan, and review everything every quarter.

What should a small business do first if it has no cyber security in place?

Start with the highest-risk accounts, especially email and banking, and turn on multi-factor authentication. Then check that devices update automatically and that you have a backup you can restore. Those three actions usually reduce the most immediate business risk.