Small Business Security You Can Fix in One Afternoon

Attacks on small businesses are rarely sophisticated. They are reused passwords, an invoice email that looked right, and a backup nobody had tested. All three are fixable in an afternoon and cost close to nothing.

The six changes, in order

1. Turn on two-step sign-in for email, banking and accounting first. Email is the master key: whoever holds it can reset everything else.
2. Put every password in a password manager and stop reusing any of them. One strong password you remember, for the manager itself.
3. Set up an automatic backup that keeps a copy somewhere your computer cannot reach, then restore one file from it to prove it works.
4. Give each person their own account. Shared logins make it impossible to know who did what, or to remove access when someone leaves.
5. Adopt one payment rule: no change to bank details is ever accepted by email alone. Phone a known number and confirm.
6. Let devices install security updates automatically, including phones used for work email.

What this protects against

What to skip for now

You do not need a security consultant, a monitoring subscription or a certification to be meaningfully safer. Do the six items above, write down who has access to what, and revisit the list every six months.