> ## Content Index
> Fetch the complete content index at: https://thecyberstories.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Too small to be a target? Five security basics for a small team
- URL: https://thecyberstories.com/security-basics-small-team/
- Published: 2026-11-03T02:42:07.000Z
- Updated: 2026-11-03T02:42:07.000Z
- Description: Small companies often assume attackers only chase big names. Government guidance says otherwise, and the fixes are smaller than most founders expect. Here are five basics a small team can do this month, most of them in minutes.
- Author: Raja Sekhar Thota
- Tags: Enterprise Security, #csv-6ae949ee09b5eaaa55a98df1, #Import 2026-11-03 21:46

Ten people, one shared drive, and a payroll login that three people know. It's how a lot of good small businesses run, right up until a Monday when nobody can open anything.

The common belief is that attackers want banks and big brands. The UK's National Cyber Security Centre has data that says otherwise: [1 in 2 small businesses suffer a cyber incident every year](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security?ref=thecyberstories.com). That's a UK figure, but the logic is global. Automated attacks don't check your headcount.

The better news: the same guidance says [many of its recommendations take as little as 5 minutes](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security?ref=thecyberstories.com).

## 1\. Lock down how people sign in

Our advice: start here, because a stolen login skips every other defence. Begin with email, banking, payroll, social media, and cloud storage. Use passkeys where offered, otherwise strong unique passwords with two-step verification.

## 2\. Back up what you can't work without

Make a copy of [all the data your business needs to operate](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data?ref=thecyberstories.com): invoices, customer records, documents, the website. Then do the step most teams skip, and try restoring a file from it.

Ransomware [can lock your data so you can't reach it](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data?ref=thecyberstories.com). A backup is what turns that from a disaster into an annoying day.

If you back up to a drive, unplug it afterwards. The NCSC warns that [some viruses also affect devices connected to an infected computer](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data?ref=thecyberstories.com).

## 3\. Keep a list of every account

Our advice: one page listing each company account, who owns it, and who can access it. It sounds dull. It's the thing you'll wish you had when someone leaves, or when you're trying to work out what an attacker could reach.

## 4\. Remove access the day someone leaves

Former staff with working logins are a common, quiet risk. Use your account list to switch everything off on their last day, including shared passwords they knew.

## 5\. Make it everyone's job

The NCSC is clear that cyber security is [everyone's business](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security?ref=thecyberstories.com), not one person's side task. Tell your team what a suspicious payment request looks like, and make it normal to double-check an unusual request by phone before paying.

## One afternoon, not a project

None of this needs a security team. Block out an afternoon: secure the five most important accounts, set up and test a backup, and write the account list. That alone puts you ahead of many companies far bigger than yours.

## Sources

- [Small organisations guide to cyber security (UK National Cyber Security Centre)](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security?ref=thecyberstories.com)
- [Backing up your data (UK National Cyber Security Centre)](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data?ref=thecyberstories.com)