Small businesses in the UK get targeted because they hold customer data and money, but rarely have dedicated security staff. The fix is simpler than most people think. Use unique passwords with a password manager, switch on multi-factor authentication, keep every device updated, back up your data properly, and teach staff to spot phishing. Here is a 20-step checklist you can work through over a weekend.
Why small businesses get targeted
Cyber criminals are not only after big corporations. A small business often stores customer names, addresses, invoices and bank details in systems protected by a single reused password. Attackers know this. They buy lists of leaked passwords, run automated scans against thousands of small websites at once, and send phishing emails that look like routine supplier invoices.
The good news is that most attacks are opportunistic, not personal. Criminals try the easy doors first. If your business is even slightly harder to break into than the next one, they usually move on. Every step below closes one of those easy doors. Our broader guide to defending your business in the digital age explains the threat landscape in more detail, while this checklist is the hands-on part.
The checklist: protect logins
Logins are the front door. Most breaches start with a stolen or guessed password.
1. Use a password manager for every account. A password manager creates and remembers long, random passwords so you never have to. Popular free options work on phones, laptops and browsers and sync between them. Set one up for each team member.
2. Make every password unique. Reusing one password across accounts is the single most common mistake. When one website gets breached, attackers try that same password everywhere else. With a password manager, unique passwords cost you no extra effort.
3. Switch on multi-factor authentication everywhere it is offered. Multi-factor authentication (MFA) asks for a second proof of identity, usually a code from an app or a text message, after your password. It stops most account takeovers even when a password leaks. Start with email, banking, cloud storage and social media, then work down the list.
4. Use a separate admin account on each computer. Everyday work should run on a standard user account. Keep a separate administrator account for installing software and changing settings. This limits the damage if a malware-laden attachment runs under a normal account.
The checklist: protect devices
Phones and laptops are where your data lives. Treat them as the office safe.
5. Turn on automatic updates for everything. Software updates fix security holes. Switch on automatic updates for your operating system, browser, phone apps and router firmware. If a device no longer receives updates, plan to replace it, because it is now permanently exposed.
6. Use the built-in firewall and antivirus. Modern Windows and Mac systems ship with solid built-in protection, including a firewall and real-time malware scanning. Make sure they are switched on. You do not need to pay for extra antivirus on most small business devices.
7. Switch on device encryption. Encryption scrambles the data on a lost or stolen device so it cannot be read without your password. BitLocker on Windows and FileVault on Mac do this for free. On phones, a strong passcode plus the default encryption is enough.
8. Set up find-and-wipe for lost phones and laptops. Register every device with its find-my-device service (Apple, Google or Microsoft). Test that you can locate and remotely wipe it. If a laptop with customer data goes missing, remote wipe is your safety net.
The checklist: protect data and backups
Ransomware and accidental deletion only hurt when there is no clean copy to restore.
9. Follow the 3-2-1 backup rule. Keep three copies of important data, on two different types of storage, with one copy offsite. A typical small business setup: your live files in cloud storage, a second copy on an external drive at the office, and a third in a different cloud account. Test restoring a file once a quarter.
10. Give people the least access they need. Not everyone needs access to everything. Restrict financial systems, customer databases and admin panels to the people who actually use them. Review permissions twice a year. Fewer accounts with wide access means fewer ways in for attackers.
11. Lock down your cloud accounts. Check who has access to your shared drives, email admin panel and accounting software. Remove old freelancers and ex-staff immediately. Look for sharing links set to “anyone with the link” and change them to named people only.
12. Delete data you no longer need. Old customer records, forgotten spreadsheets and dusty downloads are all liability. UK data protection law also expects you to keep personal data no longer than necessary. Shred or securely delete what you would not want leaked, and empty your deleted-items folders.
The checklist: train your people
Technology stops many attacks, but people stop the ones that get through.
13. Teach everyone to spot phishing. Run a short session showing what phishing emails look like: fake sender addresses, lookalike domains, links that do not match, and urgent requests for payments or passwords. Real examples from your own inbox work best.
14. Make reporting easy and blame-free. Staff must feel safe reporting a suspicious email or a clicked link, fast. A single shared inbox or a simple form works. Reward reporting, never punish it. A reported phish in the first minute can save the whole network.
15. Set rules for social media and public Wi-Fi. Agree simple rules: no business logins on public Wi-Fi without a VPN, lock screens when stepping away, and think twice before posting internal details on social media. Attackers gather this information to craft convincing scams.
16. Add and remove accounts the day people join or leave. Create a joiner-and-leaver checklist. When someone leaves, revoke their email, cloud, banking and supplier access the same day. Stale accounts are a classic way back in.
The checklist: plan for the worst
Even well-run businesses get hit. A plan turns panic into procedure.
17. Write a one-page incident plan. It does not need to be long. List the steps: disconnect the affected device, change key passwords, call your IT support, and notify customers if their data is at risk. Print two copies and keep one offsite.
18. Keep a list of who to call. Write down your IT provider, your bank’s fraud line, your insurer and your solicitor. In a crisis you will not want to search for these. Update the list once a year.
19. Consider cyber insurance. Cyber insurance can cover incident response costs, legal advice and lost income after an attack. For a micro business it is often affordable, but read the policy: most require basic protections like MFA and backups, which this checklist already covers.
20. Test your backups and your plan. A backup you have never restored is a hope, not a plan. Once a year, restore a few files and walk one person through the incident plan. You can automate reminders for checks like these so they happen without you remembering.
What it costs (free and cheap options)
Almost everything above is free. Multi-factor authentication, built-in firewalls, device encryption and automatic updates cost nothing. Reputable password managers offer free tiers for small teams. An external hard drive for your second backup copy is a one-off cost of a few dozen pounds.
Where spending helps: a paid password manager plan if the free tier is too limited, cloud storage with versioning, and cyber insurance. Start with the free steps this weekend, then add the paid layers as your budget allows. Security improves in layers, not in one purchase.
UK reporting routes if the worst happens
If your business suffers a cyber attack or fraud, report it to Report Fraud, the UK’s national fraud reporting service (it replaced Action Fraud). You can report online at reportfraud.police.uk or call 0300 123 2040. If money was involved, call your bank immediately; for payment scams you can also call 159, the Stop Scams UK number that connects you to your bank’s fraud team.
Forward suspicious emails to report@phishing.gov.uk and forward scam texts to 7726. The National Cyber Security Centre (NCSC) uses these reports to take down scam sites. If personal data was breached, remember the UK GDPR rule: report serious breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of them.
FAQs
Do I need Cyber Essentials certification?
The NCSC’s Cyber Essentials scheme certifies that a business has basic protections in place. It is not legally required, but it is useful if you bid for contracts, especially with government or larger clients. Working through this checklist gets you most of the way there.
How long does the checklist take?
A sole trader can finish most steps in a weekend. A team of five to ten people will need a few days spread over a week, mainly for the password manager rollout and the phishing session. Do not aim for perfection on day one; every step you complete lowers your risk.
Is the free built-in antivirus good enough?
For most small businesses, yes. The built-in protection in Windows and Mac, combined with automatic updates and MFA, covers the common threats. Paid antivirus adds value only in specific cases, such as central management across many devices.
What is the single most important step?
Unique passwords plus multi-factor authentication on your email and banking accounts. These two steps block the most common attack paths: stolen credentials and phishing. Everything else in the checklist builds on top of them.
The bottom line
Cybersecurity for a small UK business is not about expensive tools or specialist staff. It is about doing the basics well: strong unique logins, updated and encrypted devices, real backups, trained people and a simple plan. Work through these 20 steps one by one, and your business becomes a much harder target. The criminals will look elsewhere.
