You do not need a large budget to be much safer than the average small business. Most attacks are opportunistic: stolen passwords, phishing emails and unpatched software. This checklist covers the basics that stop the majority of them.
People and accounts
- Use a password manager and a unique passphrase for every account. Check yours with our Password Exposure Check.
- Turn on multi-factor authentication (an authenticator app is better than SMS) for email, banking, social media and your website admin.
- Limit admin rights. Staff should only access what their job needs, and accounts should be removed the day someone leaves.
- Train your team to spot phishing: unexpected invoices, "urgent" payment requests and fake delivery or bank messages.
Money and fraud
- Verify payment changes by phone. If a supplier "changes bank details" by email, call a known number before paying.
- Protect mobile money. Never share PINs or OTPs, ask your provider about SIM-swap protection, and keep business and personal money in separate accounts.
Devices and data
- Keep everything updated: operating systems, browsers, plugins and your website software.
- Back up regularly and keep one copy offline. Test a restore at least once.
- Encrypt laptops and phones so a lost device is not a data breach.
Website and email
- Secure your email domain with SPF, DKIM and DMARC. Check it with our Email Security Scanner and read the plain-English guide.
- Harden your website: use HTTPS, add security headers and watch for downtime. Test with our SSL analyzer.
- Know your obligations under the Data Protection Act. See our compliance checklist.
Where to start
If twelve items feels like a lot, begin with 1, 2 and 8: a password manager, MFA and tested backups. Then work down the list. If you would like an independent review, talk to Quepath.