Cyber security is a major concern for small businesses in the UK, but it can often feel overwhelming.

This guide is designed to provide you with a clear, jargon-free and actionable roadmap to protect your business. You do not need a large budget or a dedicated IT team to get started.

---

Step 1: Understand the Threats

Before you can defend against cyber threats, you need to understand what they are. Here are the most common threats to UK small businesses:

• Phishing: This is when an attacker pretends to be a trusted source in an email or message to trick you or your employees into giving up sensitive information, such as passwords or credit card details.
• Ransomware: This is a type of malware that locks down your computers or files and demands a payment in exchange for their release.
• Malware: This is a catch-all term for any malicious software, including viruses, trojans and spyware, that can damage your systems or steal your data.
• Data Breaches: This occurs when an attacker gains unauthorised access to your customer data, employee records or other confidential information.

Step 2: Implement Key Defences

These are the most critical, immediate actions you can take to protect your business.

• Use Strong Passwords and a Password Manager: Do not reuse passwords across multiple sites. Use a reputable password manager to generate and store complex, unique passwords for every account.
• Implement Multi-Factor Authentication (MFA): This is one of the single most effective ways to prevent unauthorised access. MFA requires a second form of verification, such as a code from a phone app, in addition to a password. You should enable it on all of your accounts that support it.
• Conduct Regular Backups: Your data is your most valuable asset. Back up your files regularly to a secure, external location, such as a cloud service or an external hard drive. The backups should be kept separate from your main network to prevent them from being compromised by ransomware.
• Update All Software: Keep all your software, including your operating system, web browser and applications, up to date. Updates often include security patches that fix vulnerabilities that attackers could exploit.
• Set Up a Firewall: A firewall acts as a barrier between your network and the internet, blocking suspicious traffic. Your router likely has a built-in firewall, but you should ensure it is correctly configured and that all devices on your network are protected.

Step 3: Train Your Employees

Your employees are your first line of defence. An attack is often successful because an employee clicks a malicious link or falls for a social engineering scam.

• Provide Basic Training: Teach your team how to spot a phishing email, a suspicious link or an unusual phone call. Explain what to do when they see something suspicious (e.g., forward it to a designated person or IT support).
• Use a Phishing Simulation Service: Consider using a service that sends fake phishing emails to your employees. This is an effective way to test their awareness and provide a realistic learning experience.
• Create a Security Policy: Establish a simple, clear policy that outlines your company’s rules for password usage, data handling and internet use.

Step 4: Proactive Security Testing

Even with the right defences in place, you may have hidden vulnerabilities you are unaware of. This is where ethical hacking becomes essential.

An ethical hacker, or penetration tester, simulates a cyber attack on your systems to find weaknesses before a malicious actor does. They will provide you with a detailed report on your vulnerabilities and give you a roadmap for how to fix them. A basic assessment can identify simple configuration errors that could put your business at risk.

Cyber Security Checklist for UK SMEs

• Passwords: Are all your passwords unique and complex? Are you using a password manager?
• MFA: Is MFA enabled on all of your accounts?
• Backups: Are your backups automated and stored securely? Have you ever tested a restoration?
• Updates: Are all your operating systems and software kept up to date?
• Employee Training: Have you trained your employees to recognise cyber threats?
• Proactive Testing: Have you had a security assessment or a penetration test?
• Data Protection: Are you complying with UK data regulations, such as the UK General Data Protection Regulation (GDPR)?