Start with the basics that stop most attacks: back up your data, keep devices and software updated, turn on multi-factor authentication, use strong unique passwords, train staff to spot phishing and limit admin rights. Then check where you stand with an assessment, and consider Cyber Essentials to prove it.
What are the first steps?
- Back up your important data regularly, and keep at least one copy separate from your main systems.
- Keep everything updated: switch on automatic updates and replace software that no longer gets security fixes.
- Turn on multi-factor authentication for email, cloud services and remote access.
- Use strong, unique passwords, ideally with a password manager.
- Train staff to spot phishing and make it easy to report a suspicious email.
- Limit admin rights to the people who genuinely need them.
- Protect devices with up-to-date anti-malware and encryption on laptops and phones.
- Write a simple incident plan: who to call, and what to do first.
Why do small businesses get attacked?
Most attacks are not targeted. Criminals send phishing emails in bulk and scan the internet for unpatched systems, so any business can be caught. The government's Cyber Security Breaches Survey 2025 found that 43% of UK businesses identified a breach or attack in the previous 12 months, and phishing was the most common type, experienced by 85% of those businesses.
How do you prove your security to clients?
Cyber Essentials is the UK government-backed baseline and a common requirement in supply chains. The same survey found only 3% of businesses hold it, so certification can set you apart. For larger clients, ISO 27001 is the next step.
When should you get outside help?
When you don't know where your biggest risks are, when a client sends a security questionnaire you can't answer, or after a near miss. A cyber security assessment gives you a prioritised plan, so you fix the most important things first.
Frequently asked questions
Information security means protecting the confidentiality, integrity and availability of your business's information, whether it is digital or on paper. Cyber security is the part that protects digital systems and data.
Turning on multi-factor authentication, enabling automatic updates and backing up your data cost little and stop a large share of common attacks.
Often, yes. It covers the basic controls that stop most common attacks, and it is required by many public sector and supply chain contracts.