Most break-ins at small businesses don’t need clever hacking. They need one reused password, one missed update or one convincing email. Each of the steps below closes one of those doors, and most take less than an hour. Do them in order and you’ll be ahead of most businesses your size.
Accounts and passwords
1. Use a password manager. It remembers every password so you don’t have to, and it fills them in only on the real website, which also protects you from fake login pages. Our guide to the password mistakes that get people hacked explains why it matters.
2. Give every account its own password. One password used in many places means one leak opens all of them. With a password manager this costs you nothing.
3. Turn on two-step verification everywhere it’s offered. After your password, the site asks for a second proof that it’s you. An authenticator app or a passkey is stronger than a text message code, so pick those where you can. Start with email, banking and anything that holds client data.
4. Protect your main email account most of all. Whoever gets into your email can reset the password of almost everything else. Give it the strongest protection you have, and consider separate addresses for banking and for shopping, so one leak doesn’t reach everything.
5. One login per person. Shared logins mean you can’t tell who did what, and you can’t remove one person without changing it for everyone.
6. Remove access the day someone leaves. Their email, shared files, software and any accounts they set up. Keep a simple list of what each person has access to, so nothing gets missed.
Devices
7. Keep everything updated, automatically. Your computer’s operating system, your browser, your apps and your phone. Most attacks use holes that already have a fix. Turn on automatic updates and restart when asked.
8. Keep the built-in security switched on. Windows and macOS both include malware protection and a firewall. Make sure they’re on and up to date. Macs need updates and care too.
9. Lock and encrypt every device. A PIN, fingerprint or face to get in, disk encryption switched on, and “find my device” set up, so a laptop left in a taxi is a nuisance rather than a data leak.
Email, links and payments
10. If in doubt, leave it. Don’t open an unexpected attachment or click a link in a message you weren’t expecting, even from someone you know. Go to the website yourself instead.
11. Check any request to pay or change bank details by phone. Call the person on a number you already have, never one in the email. Fake invoices and “our bank details have changed” emails are one of the most common ways small businesses lose money.
12. Protect your email domain. Three settings on your domain, called SPF, DKIM and DMARC, prove your emails really come from you. They make it much harder for someone to send emails pretending to be your business, and they help your real emails land in inboxes. Our email deliverability guide explains them.
13. Don’t save card details on sites you rarely use. Typing your card in again takes a minute. A site that stores it is one more place it can leak from.
Data and backups
14. Back up with the 3-2-1 rule, and test it. Three copies of your data, on two different kinds of storage, one of them somewhere else. Then restore a file now and then to prove it works. A backup you’ve never restored from is a hope, not a backup.
15. Be careful on public Wi-Fi. Most websites now encrypt your connection, but a café network can still be watched or faked. For work, use your phone’s hotspot or a VPN (a service that encrypts everything between your device and the internet).
Your public footprint and your website
16. Keep personal details off public profiles. Your date of birth, home address and phone number help someone pretend to be you, or write an email that sounds just like a colleague. Set social profiles to show those to nobody.
17. Make sure someone keeps your website patched. Your website runs software that needs updates, just like your computer. Ask your developer or host who applies security updates, and how quickly. If the answer is unclear, that’s your answer.
If something goes wrong
Change the password of the affected account from a device you trust, and turn on two-step verification if it wasn’t on. If money or card details are involved, call your bank straight away. Then ask your IT provider to check what else was reached.
The law where you are
Looking after customer data is also a legal duty for most businesses, and the rules depend on where you operate.
- Australia: the Privacy Act 1988 covers most businesses with a turnover above A$3 million, and some smaller ones, such as health providers. Under the Notifiable Data Breaches scheme, a breach likely to cause serious harm must be reported to the Office of the Australian Information Commissioner (OAIC) and to the people affected.
- United Kingdom: the UK GDPR and the Data Protection Act 2018 apply to almost every business that holds personal data. A breach that risks people’s rights must be reported to the Information Commissioner’s Office (ICO) within 72 hours of finding it.
Elsewhere, check your own country’s privacy regulator. This is a summary, not legal advice.
Where to start
Pick the first three steps and do them this week: a password manager, a different password everywhere, and two-step verification on email. They close the most common doors for the least effort.
How many of these does your business already do? Our 20-question Cyber Profile checks your security and access in about five minutes and shows where you stand.
