Cyber attacks are not only a concern for large companies. UK small and medium-sized businesses can also face phishing, ransomware, stolen passwords and data breaches—and even a short disruption can affect sales, customer trust and day-to-day operations.
A practical small business cyber security checklist helps you identify the most important risks and take manageable steps to reduce them. You do not need a large IT department to begin: many essential protections involve secure accounts, updated devices, reliable backups and clear staff procedures.
This checklist is designed for UK SMEs, including businesses with remote workers, cloud-based systems and limited IT budgets. Use it to review your current security, assign responsibility and decide what to improve first.
Small Business Cyber Security Checklist
Use the checklist below as a starting point. Mark each item as complete, needs attention or not applicable, then assign an owner and review date.
1. Secure email and business accounts
Email is a common route for phishing, password theft and fraudulent payment requests. Start by protecting the accounts that could expose other systems.
- Turn on multi-factor authentication (MFA) for email, cloud storage, accounting software and other important services.
- Use unique passwords for every business account.
- Store passwords in a reputable password manager rather than spreadsheets or shared documents.
- Remove accounts that are no longer needed.
- Give each employee their own login instead of sharing accounts.
- Review who has administrator access and limit it to people who need it.
- Set up secure account recovery options and keep them current.
MFA adds another step beyond a password, making it harder for an attacker to access an account using stolen credentials. Where available, prefer phishing-resistant options such as passkeys or security keys for high-value accounts.
2. Keep devices and software updated
Out-of-date software can contain security weaknesses that attackers know how to exploit.
- Enable automatic updates for operating systems, browsers and supported applications.
- Replace devices that no longer receive security updates.
- Install updates for routers, firewalls and other network equipment.
- Remove software and browser extensions that staff no longer use.
- Use supported versions of business applications.
- Make sure staff know how to report update errors rather than repeatedly dismissing them.
Create a simple asset list showing the business devices, software and services you use. Include who is responsible for each item and when it was last reviewed.
3. Protect laptops, phones and remote workers
A business device can contain customer information, saved passwords and access to cloud systems. Protect it even when staff work from home or travel.
- Require screen locks and strong device authentication.
- Enable encryption on laptops and mobile devices where supported.
- Use reputable security software and keep it updated.
- Restrict access to business systems from unmanaged devices where practical.
- Set a process for reporting lost or stolen equipment immediately.
- Remove business access when a staff member leaves.
- Avoid using public Wi-Fi for sensitive work unless an appropriate secure connection is in place.
For remote workers, agree how business files should be stored and shared. Staff should not move customer or company data into personal email accounts or unapproved cloud services for convenience.
4. Back up important business data
Backups help your business recover from accidental deletion, equipment failure or ransomware. They are only useful if the data can be restored.
- Identify essential data, such as customer records, financial files, contracts and operational documents.
- Back up important data automatically and regularly.
- Keep at least one backup separate from the main business environment.
- Protect backup accounts with MFA and restricted access.
- Check that backups complete successfully.
- Test restoring files and systems—not just whether a backup exists.
- Document who can access backups and how recovery works.
The right backup schedule depends on how much data your business can afford to lose and how quickly it needs to recover. A small business that processes orders every day may need more frequent backups than one that updates a few files each week.
5. Train staff to recognise common attacks
Security tools cannot prevent every mistake. Staff need to know how to spot suspicious messages and report them quickly.
- Explain how to identify unexpected links, attachments and requests for sensitive information.
- Teach staff to check unusual payment or bank-detail changes through a separate trusted channel.
- Make it easy to report suspicious emails or messages.
- Explain that attackers may impersonate suppliers, managers or customers.
- Provide short, regular security reminders.
- Include new starters in security training.
- Review what happened after a suspicious message or near miss.
Avoid blaming staff for reporting a mistake. A quick report can help the business contain a problem before it spreads.
The NCSC provides free guidance and staff training resources for small businesses, including its Small Business Guide. GOV.UK+1
6. Secure your network and cloud services
Your business network connects devices, systems and information. Review both the office network and the cloud services your staff use.
- Change default administrator passwords on routers and network equipment.
- Use strong Wi-Fi encryption and a secure network password.
- Keep router and firewall software updated.
- Separate guest Wi-Fi from business devices where possible.
- Review sharing permissions in cloud storage.
- Restrict access to sensitive folders and files.
- Check whether old links or external users still have access.
- Review security settings for your website, domain and hosting accounts.
Do not assume that information stored in the cloud is automatically secure. Your provider may protect its infrastructure, but your business still needs to manage accounts, permissions and how data is shared.
7. Protect customer and employee information
UK businesses that handle personal data need to consider data protection as part of cyber security.
- Identify what personal data your business collects and why.
- Limit access to personal information to people who need it.
- Store and share personal data securely.
- Remove or securely dispose of information when it is no longer needed.
- Review the security arrangements of suppliers that process personal data.
- Keep a record of personal data breaches and how they were assessed.
- Make sure someone is responsible for handling data protection incidents.
If a personal data breach occurs, assess the risk to people promptly. Under UK GDPR, a breach that is reportable to the Information Commissioner’s Office (ICO) must generally be reported without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to create a high risk to individuals, they may also need to be informed without undue delay. Not every incident is reportable, so document the assessment and follow the ICO’s guidance. ICO+1
8. Prepare an incident response plan
A written plan helps staff act quickly if a business account is compromised, data is lost or systems become unavailable.
- Name the person responsible for coordinating a cyber incident.
- Keep contact details for your IT support provider, key suppliers and relevant insurers.
- Explain how staff should report a suspected incident.
- Identify which systems and data are most important to restore.
- Record how to isolate affected devices or accounts safely.
- Include a process for assessing possible personal data breaches.
- Keep a copy of the plan somewhere accessible if business systems are unavailable.
- Test the plan with a short discussion or exercise.
The NCSC’s Incident Management guidance can help businesses prepare for and respond to cyber incidents.
What Should a Small Business Do First?
If your business has limited time or budget, prioritise controls that protect the most important accounts and data.
| Priority | Action | Why it matters |
|---|---|---|
| First | Enable MFA on email and critical accounts | Reduces the risk from stolen passwords |
| First | Update devices and software | Fixes known security weaknesses |
| First | Set up and test backups | Supports recovery after data loss or ransomware |
| Next | Review staff access and administrator accounts | Limits what an attacker or former employee can access |
| Next | Train staff to spot phishing and payment fraud | Helps prevent common social-engineering attacks |
| Next | Write an incident response plan | Makes it easier to act quickly |
| Ongoing | Review suppliers, permissions and security settings | Helps maintain protection as the business changes |
The NCSC’s free Cyber Action Toolkit can help UK organisations identify practical improvements without needing specialist cyber security knowledge. National Cyber Security Centre
Should Your Business Get Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme designed to help organisations protect themselves against common cyber threats. It focuses on five technical control areas, including secure configuration, access control, malware protection, security update management and firewalls.
It may be worth considering if your business:
- Handles sensitive customer or commercial information.
- Works with larger organisations that ask suppliers about cyber security.
- Wants a structured baseline for reviewing its controls.
- Needs to demonstrate a level of cyber security assurance to customers or partners.
Cyber Essentials Plus includes the same core controls but adds independent technical testing. Certification is not a substitute for ongoing security management, staff awareness or a tested recovery plan. Check the NCSC’s current Cyber Essentials information for requirements and pricing before applying. National Cyber Security Centre+1
How Often Should You Review Your Cyber Security?
A checklist is most useful when it becomes part of normal business operations.
A simple review schedule could look like this:
- Monthly: Check updates, backup results, security alerts and unusual account activity.
- Quarterly: Review user access, cloud sharing permissions, staff awareness and incident contacts.
- When staff leave: Remove accounts and revoke access promptly.
- When systems change: Review security before adopting new software, devices or suppliers.
- After an incident: Update procedures based on what happened and what could be improved.
Assign responsibility for each task. In a small business, one person may coordinate the review while an external IT provider handles technical work.
Frequently Asked Questions
What is the most important cybersecurity step for a small business?
Start by enabling multi-factor authentication on business email and other critical accounts, keeping software updated and ensuring important data is backed up and recoverable. These measures address several common routes to account compromise and disruption.
Does a small business need cyber security software?
Most businesses should use appropriate security protection on their devices, alongside updates, access controls and secure configuration. The right solution depends on the systems used and the level of risk; software alone cannot protect against every threat.
Can a small business improve cyber security without an IT team?
Yes. Many essential steps—such as enabling MFA, updating software, reviewing access and training staff—can be managed internally. For more complex systems, a qualified IT or cyber security provider can help assess risks and implement controls.
What should a business do if it suspects a cyber attack?
Report it immediately to the person responsible, follow the incident response plan and seek technical support. Preserve relevant information, secure affected accounts and assess whether personal data has been compromised. Use the appropriate official reporting channels and do not delay a required ICO notification while waiting for every detail.
Is Cyber Essentials compulsory for every UK SME?
No. It is not a universal legal requirement for all small businesses. However, some contracts or supply-chain requirements may ask for certification, so check the terms relevant to your organisation.
Final Takeaway
A small business cyber security checklist gives UK SMEs a practical way to protect accounts, devices, data and daily operations. Start with MFA, updates, tested backups and staff awareness, then build a routine for reviewing access, suppliers and incident plans.
You do not need to complete every item in one day. Assign an owner, tackle the highest-risk gaps first and review your progress regularly. That turns cyber security from a one-off task into a manageable part of running the business.
