Cybersecurity for Small and Medium Businesses: The Non-Negotiable Minimum

"We're a small company, nobody will target us" — that is exactly the mindset attackers rely on. Six simple, low-cost practices that protect your business from most common attacks.

As companies move to cloud email, e-invoicing and remote work, every company — whatever its size — has become a digital company. And that means it has become a target. Most attacks today are not carefully aimed at one company; they are broad automated campaigns looking for any open door: a weak password, an unpatched system, or an employee who clicked a fake link.

The good news is that closing most of these doors needs neither a huge budget nor a specialist team — just discipline in six basic practices.

Six simple practices that close the doors most common attacks come through.

1. Two-factor authentication on every important account

Passwords get stolen, guessed and leaked. Two-factor authentication — a code from a phone app on top of the password — means a stolen password alone is not enough. Turn it on now for email, bank accounts, accounting systems, website dashboards and official social media accounts.

2. Separate, tested backups

Ransomware encrypts a company's files and demands payment to unlock them. The most effective protection is a backup that is separate from the main network, updated automatically, and tested by restoring it regularly. A backup you have never restored is just a hope.

3. Automatic updates

Many attacks exploit known vulnerabilities that were patched months ago. Turn on automatic updates for operating systems, browsers and applications — and do not forget network devices, printers, websites and their plugins.

4. Least privilege

Not every employee needs admin rights on their device, or access to every company file. Give each person only what their job requires, revoke leavers' access on the day they leave, and review the user list every three months.

5. Team awareness

Phishing is the most-used door: an email that looks like it is from the bank, from the CEO urgently requesting a transfer, or from a supplier asking to change their bank details. Train your team on one simple rule: any request for money or login details is verified through another channel — a phone call to the known number, not the number in the message.

An attacker doesn't need to break into your systems if they can convince one of your employees to open the door for them.

6. An incident response plan

When an incident happens, precious hours are lost asking "what do we do now?". One page written in advance is enough to begin with:

• Who do we call first, inside and outside the company?
• How do we isolate the affected device or account?
• How do we restore operations from the backup?
• When and how do we inform customers and the authorities if personal data may be affected?

What comes after the minimum?

Once these six practices are in place, a company can move to more advanced steps depending on its size and the nature of its data: a team password manager, encryption on laptops and phones, periodic security assessments by a specialist, and a review of its compliance with personal data protection laws in the countries where it operates.

Conclusion

Cybersecurity is not a product you buy once; it is a habit you practise every day. Small and medium businesses don't have to solve everything at once — closing the obvious doors is enough to start, because most attackers look for the easiest target and move on.