Small businesses rely on cloud accounts, email, laptops, mobile devices and office networks every day. A single compromised password or unpatched device can interrupt operations, expose customer data and create expensive recovery work. The controls below give Manchester and UK organisations a practical starting point without assuming a large IT team.
1. Secure every important account
Start with email, Microsoft 365 or Google Workspace, banking, website administration and cloud storage. Use a different strong password for every account and store passwords in a reputable password manager. Enable multi-factor authentication wherever it is available, especially for administrators and anyone who can access customer or financial information.
Remove accounts promptly when a staff member or contractor leaves. Give each person only the access required for their work, and keep administrator accounts separate from ordinary day-to-day accounts.
2. Patch devices and software promptly
Turn on automatic security updates for operating systems, browsers, business applications, routers and security tools. Replace products that no longer receive security updates. Keep an inventory of laptops, desktops, phones, servers, network equipment and important cloud services so that nothing is forgotten.
Prioritise updates for internet-facing systems and vulnerabilities known to be actively exploited. If an update cannot be installed immediately, restrict access and document the temporary protection in place.
3. Protect email and train your team
Phishing remains a common route into smaller organisations. Staff should know how to check unexpected payment requests, password-reset messages, shared-document invitations and urgent requests from senior colleagues. Confirm sensitive requests through a second trusted channel rather than replying to the original message.
Run short, regular awareness sessions and make reporting suspicious messages simple. Our guide to phishing awareness for businesses provides a useful starting point.
4. Back up critical data
Identify the information your organisation cannot operate without, including customer records, finance data, project files and website content. Keep backups separate from everyday systems so that ransomware or an administrator mistake cannot destroy every copy.
Use a clear schedule, protect backup accounts with multi-factor authentication, and test restores. A backup is only useful when you can recover the right information within the time your business needs.
5. Strengthen the office and remote network
Change default router and firewall passwords, install firmware updates and disable services you do not use. Place guest Wi-Fi and untrusted smart devices on separate networks from business systems. Use modern Wi-Fi encryption and avoid sharing one permanent password with staff, visitors and contractors.
For remote access, use an approved secure method and restrict it to the people who need it. Review firewall rules and remote-access accounts regularly. DigiUK’s cybersecurity consultancy can help organisations review network exposure, access controls and practical priorities.
6. Use endpoint protection and monitoring
Enable reputable endpoint protection on supported computers and servers. Make sure alerts are reviewed rather than simply installed and forgotten. Keep useful security logs for important accounts, devices and cloud services, and investigate unusual logins, repeated failures or unexpected administrator changes.
Small organisations do not need a complex security operations centre to improve visibility. Begin with alerts from your email platform, firewall, endpoint security and backup service, then define who reviews them and what happens when an alert is credible.
7. Prepare a simple incident response plan
Write down who will make decisions, who will contact technical support, how staff will communicate if email is unavailable, and where clean backups are stored. Include contact details for key suppliers, insurers and relevant reporting routes. Test the plan with a short scenario at least once a year.
If you suspect a compromise, preserve evidence, isolate affected systems where safe, reset exposed credentials from a clean device and obtain appropriate help. Do not wait until an incident to decide who is responsible.
A practical 30-day checklist
- Week 1: inventory important accounts and devices; enable multi-factor authentication for email and administrators.
- Week 2: install outstanding security updates; remove unused accounts and unsupported software.
- Week 3: verify backups and complete a test restore; review firewall, Wi-Fi and remote-access settings.
- Week 4: brief staff on phishing; document incident contacts and test one alert or response scenario.
Build skills inside your organisation
Businesses that want staff to understand threats, networks and defensive controls can review DigiUK’s practical cyber security training in Manchester. Training should support clear business procedures and technical controls rather than replace them.
Official UK guidance
The National Cyber Security Centre publishes a current small organisations guide to cyber security covering email, accounts, devices, backups and spotting attacks. Use that guidance as a baseline and adapt the controls to your systems, risks and regulatory obligations.
Cybersecurity is an ongoing business process. Start with the controls that reduce the most likely risks, assign owners, record what has been completed and review the plan whenever your staff, suppliers or technology change.