Cyber security
Small business cyber security: a realistic first-year plan
Small businesses are attacked opportunistically and at scale, not because anyone chose them. That is good news, because opportunistic attacks are defeated by baseline controls rather than by expensive tooling. A realistic first year is roughly: enforce MFA and remove dormant accounts in week one; get backup, patching and a payment verification procedure in place in the first quarter; add certification, staff awareness and a written incident plan across the rest of the year. Most of it is free or already included in what you pay Microsoft.
Key facts
- Most attacks on small businesses are automated and untargeted — they find weak configuration, not chosen victims.
- Credential-based attacks dominate; MFA is the single highest-impact control available.
- Payment diversion fraud is typically the largest direct financial loss for a small business.
- Cyber insurers increasingly require MFA, tested backups and patching as conditions of cover.
- Unsupported software is both a common breach route and an automatic Cyber Essentials failure.
- The NCSC publishes free, credible small business guidance — you do not need to buy a framework.
- An incident plan that fits on one page and exists beats a thorough one that does not.
Week one: the controls that pay for themselves immediately
Enforce multi-factor authentication on every account, with no exemptions for directors. If your plan does not include Conditional Access, Security Defaults gives you baseline MFA free. This one change removes the large majority of automated account compromise risk.
Then audit accounts. Export your user list, compare it against who actually works there, and disable everything that does not match. Check how many Global Administrators you have and reduce it. Create a dedicated administrative account so the owner is not reading email from an account that can delete the company.
Finally, write and circulate the payment verification rule: any change of bank details is confirmed by voice on a number already held on file, no exceptions, and nobody will be criticised for delaying a payment to make that call. That paragraph prevents the single largest realistic loss a small business faces.
First quarter: the things that take real effort
Sort out backup. Establish what Microsoft's retention windows actually give you, decide whether a third-party Microsoft 365 backup is warranted, and — whichever you choose — perform one test restore and write down what happened. A backup nobody has restored from is an assumption.
Sort out patching. Every device in the business needs to be on supported software and receiving updates, including phones used for work email and the laptop belonging to the person who works two days a week. Unsupported software is the most common route in and the most common certification failure.
Publish SPF, DKIM and DMARC if you have not, and start the staged move toward enforcement. Block automatic external forwarding in Microsoft 365, and turn on alerts for new inbox forwarding rules.
- Decide and implement your backup position; run one real test restore
- Bring every device onto supported, patched software
- Publish email authentication and begin the move to enforcement
- Block external forwarding and alert on new inbox rules
- Document the leaver process and use it every time
Rest of the year: proof, people and planning
Consider Cyber Essentials. Even if you never intend to show the certificate to anyone, the self-assessment is an efficient way to find the gaps you have not thought about, and it frequently improves insurance terms.
Do something about staff awareness — but choose the effective version. Annual compliance training that everyone clicks through changes nothing. What works is short, specific and recurring: a five-minute message about the actual phishing attempt someone received last week, and a culture where reporting a mistake is welcomed rather than punished. The most valuable security asset in a small business is an employee who feels able to say 'I think I just clicked something' within thirty seconds rather than hoping it was fine.
Write a one-page incident plan. Who to call, in what order, with what phone numbers — bank fraud line, insurer, IT support, ICO reporting route, key clients. Keep a printed copy, because an incident that takes out Microsoft 365 also takes out the document describing what to do about it.
What to ignore
Small businesses waste money on security products that solve problems they do not have while leaving basics undone. A dark web monitoring subscription is not a substitute for MFA. A security awareness platform with gamified leaderboards is not a substitute for a payment verification procedure. Endpoint tooling nobody monitors produces alerts nobody reads.
The hierarchy is uncomfortable but consistent: identity first, then backup, then patching, then process, then tooling. Anything sold to you before identity and backup are sorted is being sold in the wrong order.
Cyber insurance, and what it now expects
Cyber insurance is increasingly worth having for a small business, and increasingly conditional. Insurers commonly ask about MFA coverage, backup and restore testing, patching cadence, endpoint protection and payment verification procedures — and answering optimistically on a proposal form is a good way to have a claim reduced later.
Read the conditions as a checklist rather than paperwork. They are a reasonable proxy for what the industry has learned actually causes losses, and aligning to them is a defensible way to prioritise when you have no security specialist to advise you.
What businesses most often get wrong
- Buying security products before enforcing MFA and sorting backup
- Assuming the business is too small to be targeted — most attacks never chose you
- Annual click-through training instead of short, specific, recurring reminders
- Punishing the person who reports a mistake, guaranteeing the next one stays hidden
- Answering cyber insurance questions optimistically and discovering the gap at claim time
- Keeping the incident plan only in the system the incident has taken down
Where AlwaysOnIT fits — and doesn't
We help with the Microsoft 365 and account-level parts of this plan, in chat, whenever you need them — MFA, account hygiene, leaver actions, email authentication diagnosis, phishing triage. We are explicitly not a security operations centre: no continuous monitoring, no threat hunting, no forensic investigation, no penetration testing. Several items on this page are outside what we do, and we would rather list them than let you assume they are covered.
Frequently asked questions
Small business cyber security — common questions
What should a small business do first for cyber security?
Enforce multi-factor authentication on every account with no exemptions, disable accounts belonging to people who have left, reduce the number of Global Administrators and stop using an administrative account for daily email, and write a rule that all bank detail changes are verified by voice on a number already held on file. That is a week's work and covers the majority of realistic risk.
Are small businesses really targeted by cyber attacks?
Mostly they are not targeted at all — they are found. The dominant attacks are automated, scanning for exposed services, testing credentials from unrelated breaches, and sending phishing at scale. Nobody chose you, which is why baseline configuration defeats most of it.
How much should a small business spend on cyber security?
Less than most vendors suggest, at first. The highest-impact controls — MFA, account hygiene, administrative separation, payment verification, email authentication — are free or already included in Microsoft 365. The first genuine spending decisions are usually third-party backup and, if you hold lower-tier licences, endpoint protection.
What does cyber insurance require from a small business?
Commonly multi-factor authentication across accounts, backups that are tested and held separately, a defined patching cadence, endpoint protection and documented payment verification procedures. Requirements vary by insurer, and answering a proposal form optimistically risks a reduced payout, so treat the questions as a control checklist rather than paperwork.
Does a small business need a written incident response plan?
Yes, and one page is enough: who to call in what order, with phone numbers for the bank's fraud line, your insurer, IT support and the ICO reporting route, plus who tells staff and clients. Keep a printed copy — an incident that takes out your systems also takes out the plan stored inside them.
Read next
Cyber Essentials: what it requires and whether it is worth it
The five Cyber Essentials controls explained plainly, the difference from Cyber Essentials Plus, what certification costs in effort, and where small businesses usually fail.
Business email compromise: how the invoice fraud actually works
How business email compromise and invoice redirection fraud work in practice, the warning signs, the controls that stop it, and what to do in the first hour.
Backup strategy for cloud-first businesses: what Microsoft does not do
Why Microsoft 365 retention is not a backup, the 3-2-1 rule applied to cloud data, realistic recovery objectives, and why an untested backup is not a backup.
Get started
Open a chat. The AI picks up before the second ring — every time.
No onboarding calls. No sales process. Connect your devices and start raising tickets in under ten minutes.