Ten people, one shared drive, and a payroll login that three people know. It's how a lot of good small businesses run, right up until a Monday when nobody can open anything.
The common belief is that attackers want banks and big brands. The UK's National Cyber Security Centre has data that says otherwise: 1 in 2 small businesses suffer a cyber incident every year. That's a UK figure, but the logic is global. Automated attacks don't check your headcount.
The better news: the same guidance says many of its recommendations take as little as 5 minutes.
1. Lock down how people sign in
Our advice: start here, because a stolen login skips every other defence. Begin with email, banking, payroll, social media, and cloud storage. Use passkeys where offered, otherwise strong unique passwords with two-step verification.
2. Back up what you can't work without
Make a copy of all the data your business needs to operate: invoices, customer records, documents, the website. Then do the step most teams skip, and try restoring a file from it.
Ransomware can lock your data so you can't reach it. A backup is what turns that from a disaster into an annoying day.
If you back up to a drive, unplug it afterwards. The NCSC warns that some viruses also affect devices connected to an infected computer.
3. Keep a list of every account
Our advice: one page listing each company account, who owns it, and who can access it. It sounds dull. It's the thing you'll wish you had when someone leaves, or when you're trying to work out what an attacker could reach.
4. Remove access the day someone leaves
Former staff with working logins are a common, quiet risk. Use your account list to switch everything off on their last day, including shared passwords they knew.
5. Make it everyone's job
The NCSC is clear that cyber security is everyone's business, not one person's side task. Tell your team what a suspicious payment request looks like, and make it normal to double-check an unusual request by phone before paying.
One afternoon, not a project
None of this needs a security team. Block out an afternoon: secure the five most important accounts, set up and test a backup, and write the account list. That alone puts you ahead of many companies far bigger than yours.