What cyber security does a small business actually need?
Cyber security can quickly feel like a shopping list. MFA, backups, email protection, antivirus, EDR, Cyber Essentials, staff training. We help you cut through the noise and put the right protection in place for your size, sector and budget.
What cyber security does a small business actually need?
You probably do not need a huge cyber security project. You need the right basics done properly: secure accounts, protected devices, safer email, reliable backups, sensible staff training and a clear plan if something goes wrong.
The short answer
Most small businesses need seven practical layers of protection. These reduce the risks most likely to cause damage: stolen passwords, phishing, ransomware, fake invoices, lost data and days of downtime.
- Multi-factor authentication on important accounts
- Secure and updated devices
- Email protection against phishing and malware
- Reliable backup and recovery
- Strong password management
- Staff awareness training without blame
- A simple incident response plan
Small business cyber security is not about buying every tool on the market.
It is about reducing the risks that are most likely to hurt your business. For most small businesses, that means protecting Microsoft 365 or Google Workspace, locking down accounts, keeping devices updated, backing up important data and helping staff spot scams before damage is done.
Cyber Essentials is a good UK baseline because it gives you a clear set of controls to work towards. It can also help with tenders, supply chain checks, cyber insurance conversations and customer trust.
This page is for you if cyber security feels bigger than your business
Many small business owners know cyber security matters, but they do not always know where to start. You may have antivirus. You may use Microsoft 365. You may have a backup somewhere. The harder question is whether those things would stand up to a real incident.
You want sensible costs
You do not want to waste money on tools you do not need. You want the right protection for your size, risk and budget.
You need proof
You may need Cyber Essentials, cyber insurance evidence, tender support or reassurance for customers and suppliers.
You cannot afford downtime
Lost email, encrypted files, fake invoice fraud or a failed restore can quickly become a business problem.
The small business cyber security checklist
Use this as a simple starting point. You do not have to fix everything at once. Start with the areas that would cause the most damage if they failed.
| What you need | Why it matters | Good starting point |
|---|---|---|
| Multi-factor authentication | Helps stop criminals logging in with stolen passwords. | Turn on MFA for email, banking, accounts software, admin accounts and remote access. |
| Secure devices | Reduces malware, ransomware and unauthorised access. | Keep laptops, desktops and mobiles updated, protected and encrypted where possible. |
| Email protection | Reduces phishing, malware, fake invoices and impersonation attacks. | Use stronger filtering, attachment protection, link protection and domain checks. |
| Microsoft 365 security | Email, OneDrive, SharePoint and Teams often hold your most important data. | Review MFA, sharing, admin roles, risky sign-ins, forwarding rules and mailbox access. |
| Backup and recovery | Helps you recover from deletion, ransomware, compromise or system failure. | Back up Microsoft 365, servers, endpoints and important business data. Test restores. |
| Password management | Stops password reuse, weak passwords and shared spreadsheets. | Use a business password manager and remove access when people leave. |
| Staff awareness | Helps people spot scams, fake invoices and suspicious requests. | Use short, regular training that helps staff feel confident, not blamed. |
| Incident response plan | Reduces panic and delay when something goes wrong. | Write down who to call, what to isolate, how to recover and when to report. |
| Cyber Essentials | Gives you a recognised UK baseline for common cyber risks. | Check the five control areas and fix gaps before applying. |
Why small businesses are targeted
Small businesses are often attacked because they are easier to reach, not because a criminal has carefully chosen them by name.
Many attacks are automated. Criminals scan for weak passwords, missing updates, exposed remote access, poor email security and cloud accounts with no MFA.
If your business holds customer records, staff data, supplier details, payment information or email accounts, it has value.
The real risks are usually practical
A cyber incident is rarely just an IT problem. It can stop invoices going out, delay payroll, disrupt care, damage customer trust and create difficult questions from insurers or regulators.
The aim is not perfection. The aim is to make your business harder to attack and easier to recover.
The seven layers most small businesses should put in place
These are the controls we would look at first for a typical small business using Microsoft 365, cloud apps, laptops and mobile devices.
Protect your accounts
Turn on MFA, remove old accounts, separate admin accounts from everyday accounts and check for suspicious mailbox rules or forwarding.
Secure your devices
Keep devices updated, protected and managed. Know which laptops, phones and tablets can access company data.
Improve email protection
Reduce phishing, malware, impersonation and fake invoice attacks with stronger email security and clear payment checks.
Back up important data
Make sure Microsoft 365, servers, endpoints and key business data can be restored. Test recovery before you need it.
Use a password manager
Replace weak passwords, shared spreadsheets and password reuse with a business password manager.
Train staff without blame
Help people spot phishing, scams, fake invoices and suspicious requests. People are part of the solution.
Prepare for incidents
Have a short plan that explains who to call, what to isolate, how to reset passwords and how to recover.
What should you do first?
If you are starting from scratch, do not try to fix everything in one go. Start with the controls that reduce the most common and costly risks.
Turn on MFA
Start with Microsoft 365, Google Workspace, banking, accounts software, admin portals and remote access.
Review Microsoft 365 or Google Workspace
Check account security, admin access, mailbox forwarding, file sharing and risky sign-ins.
Check your backups
Confirm what is backed up, where it is stored, who can access it and how quickly it can be restored.
Update and protect devices
Make sure devices are supported, patched, protected and not using unnecessary admin rights.
Sort passwords and leavers
Remove unused accounts, stop shared passwords and make it easier to give and remove access safely.
Prepare for Cyber Essentials
Use Cyber Essentials as a clear baseline. It helps you find gaps before customers, insurers or tenders ask awkward questions.
Where Cyber Essentials fits
Cyber Essentials is a sensible starting point for many UK small businesses. It focuses on five practical control areas: firewalls, secure configuration, user access control, malware protection and security updates.
It is not the whole answer, but it gives your business a recognised baseline. It can also help with tenders, customer reassurance, supply chain checks and cyber insurance conversations.
What small businesses usually do not need
Most small businesses do not need a large enterprise security project on day one.
- A pile of reports nobody has time to read
- A complex security platform with no one watching it
- Policies copied from a much larger organisation
- A one-off audit with no help to fix the gaps
- Scare tactics dressed up as advice
What you do need
You need a clear view of your risks, a practical order of work and support from someone who can explain what matters in plain English.
A five-person business does not need the same setup as a national firm. It still needs strong basics.
Small business cyber security in Chesterfield, Derbyshire, Sheffield and South Yorkshire
Black Swan Cyber Security Solutions is based in Chesterfield and supports small businesses across Derbyshire, Sheffield, South Yorkshire, Worksop, North Nottinghamshire and the wider UK.
Many of the businesses we speak to are not looking for a huge cyber security project. They want to know what matters, what can wait, what helps with Cyber Essentials or insurance, and what will reduce the chance of a costly incident.
We help you put the right controls in place for your size, sector and budget, including Microsoft 365 security, managed endpoint protection, backup, staff awareness training and Cyber Essentials support.
How Black Swan Cyber Security Solutions can help
We help small businesses put practical cyber security in place without making it feel bigger than the business itself.
Cyber Essentials support
We help you understand the questions, fix the gaps and prepare for certification with less stress.
Microsoft 365 security
We review accounts, MFA, admin access, risky sign-ins, sharing, mailbox rules and common weak spots.
Backup and recovery
We help protect Microsoft 365, servers, endpoints and business-critical data so recovery is realistic.
Managed endpoint protection
We help protect laptops, desktops and servers with managed security that is watched and maintained.
Password management
We help move passwords out of spreadsheets, browsers and shared notes into a safer business password manager.
Incident planning
We help you create a practical plan so your business knows what to do if something goes wrong.
Useful next steps
If you want to dig deeper, these pages explain some of the most common small business cyber security decisions.
Small business cyber security FAQs
Does a small business really need cyber security?
Yes. Small businesses use email, cloud apps, online banking, customer records and supplier systems. Those are all useful to criminals. Cyber security helps reduce the chance of account compromise, ransomware, fraud and data loss.
Is antivirus enough for a small business?
Antivirus is useful, but it is not enough on its own. Most small businesses also need MFA, secure email, patching, backup, password management, staff awareness and a plan for incidents.
Is Cyber Essentials enough?
Cyber Essentials is a strong baseline, but it is not a full cyber security programme. It helps with common technical risks, but you may still need better email protection, Microsoft 365 backup, staff training, incident planning and managed monitoring.
Do I need Microsoft 365 backup?
If your business relies on Exchange, OneDrive, SharePoint or Teams, separate backup is worth considering. Microsoft keeps the service running, but you are still responsible for recovering from accidental deletion, malicious changes, ransomware, sync issues and account compromise.
What should I fix first?
Start with MFA, Microsoft 365 or Google Workspace security, backup, device updates, password management and staff awareness. These reduce many of the most common small business cyber risks.
Can Black Swan help if we do not have in-house IT?
Yes. We work with small businesses that do not have a dedicated IT or cyber security team. We help you understand what matters, what can wait and what to fix first.
Not sure what your business actually needs?
Book a free cyber review. We will help you understand what you already have, where the gaps are and what makes sense for your size, sector and budget.
Black Swan Cyber Security Solutions is based in Chesterfield and supports small businesses across Derbyshire, Sheffield, South Yorkshire, Worksop, North Nottinghamshire and the wider UK.