In short
- ✓Turn on multi-factor authentication for email and every important online account.
- ✓Install security updates quickly: Cyber Essentials now requires high-risk and critical updates within 14 days.
- ✓Keep at least one backup that ransomware can't reach, and test that you can restore it.
- ✓Train staff to spot phishing and make it easy to report mistakes straight away.
- ✓Get Cyber Essentials to prove the basics to customers and insurers.
Why small businesses are targeted
In the government's latest Cyber Security Breaches Survey, 43% of UK businesses reported a breach or attack in the previous 12 months, including 42% of micro businesses and 46% of small businesses. Phishing was the most common attack. Criminals rarely pick on a business because of who it is; they look for easy targets, which is why getting the basics right stops most attacks.
This checklist follows the National Cyber Security Centre's guidance for small organisations, which focuses on securing email and online accounts, protecting devices, backing up data and spotting attacks, plus the five Cyber Essentials controls.
The 10-step checklist
- Turn on multi-factor authentication (MFA) for email, Microsoft 365 or Google Workspace, banking, accounting software and your website admin. From April 2026, Cyber Essentials fails any organisation that doesn't use MFA on cloud services where it's available.
- Use strong, unique passwords stored in a password manager, and never share logins between staff.
- Keep separate admin accounts and only use them for admin tasks, not day-to-day email and browsing.
- Install updates promptly on computers, phones, routers and software. High-risk and critical updates must be applied within 14 days for Cyber Essentials.
- Replace devices and software that no longer receive security updates.
- Run anti-malware protection on every computer, and only install apps from trusted sources.
- Keep a firewall switched on and change default passwords on your router and other devices.
- Back up important data regularly, keep a copy offline or immutable so ransomware can't delete it, and test restoring it.
- Set up SPF, DKIM and DMARC on your email domain, and agree a call-back rule before anyone changes bank details or pays a new account.
- Train staff to recognise phishing and make it easy and blame-free to report anything suspicious.
Get it independently checked
Once these basics are in place, Cyber Essentials certification proves it. It's backed by the NCSC, required for many government contracts and increasingly asked for by larger customers. If you're not sure where you stand, a short cyber security audit will show you which of these steps you've already covered and which matter most for your business.
Questions
What is the most important cyber security step for a small business?
Turning on multi-factor authentication for email and cloud accounts. It blocks the majority of account takeover attempts and is now mandatory for Cyber Essentials.
Do small businesses really get hacked?
Yes. The government's latest survey found 42% of micro businesses and 46% of small businesses reported a breach or attack in the previous year.