Cybersecurity for Businesses Without an IT Department

Small businesses are rarely targeted individually. They are caught by automated attacks and by invoice fraud, which means the defences that matter are unglamorous and cheap. Nearly all of the following can be done in a week without specialist help.

In priority order

1. Turn on multi-factor authentication for email first, then banking, then accounting and your domain registrar. Email is the master key — whoever controls it can reset everything else.
2. Use a password manager for the whole team so that reused passwords stop being the weak link.
3. Set up automatic backups with one copy off-site, then restore a file to prove the backup works. An untested backup is a hope.
4. Enable automatic operating system and browser updates on every device, including phones.
5. Agree a payment verification rule: any change to bank details is confirmed by phone to a known number, no exceptions, no matter how urgent the email sounds.
6. Remove admin rights from day-to-day user accounts and keep a separate administrator login.
7. Keep a written list of accounts, who has access and what happens if a key person is unavailable.

Backups: the 3-2-1 rule, simplified

What you do not need to buy yet

• Enterprise security suites sold on fear rather than a stated threat.
• Penetration testing before you have MFA and backups in place.
• A dedicated firewall appliance for a five-person office using cloud services.

Write the one-page incident plan

Decide now, on paper: who is called first, which accounts get locked, where the backups live, how customers are told, and your insurer's claims number. In an incident you will not be thinking clearly, and the plan is what replaces clear thinking. Review it once a year alongside your insurance renewal.

None of this makes you invulnerable. It does move you out of the group that automated attacks succeed against, which is the realistic goal.