Cyber security basics for small businesses

Cyber attacks are not just a problem for large companies. Criminals target small businesses because they assume their defences are weaker. Most attacks can be prevented with straightforward, low-cost measures, using free tools and security features you probably already have.

The five essential security controls

The government's Cyber Essentials scheme identifies five technical controls that protect against the most common cyber attacks. You do not need to be certified to implement these - start with the controls themselves.

Low-cost actions you can take today

Most of these cost nothing except your time. If you use personal information, you must also pay the data protection fee to the Information Commission (formerly the ICO), unless you are exempt.

Protecting against phishing

Most successful attacks start with a phishing email. Train yourself and your staff to spot the warning signs.

Red flags in suspicious emails

• urgent wording, such as "Act now" or "Your account will be closed"
• an unexpected request to click a link, open an attachment or transfer money
• a sender address that does not match the display name, so check the actual address
• poor spelling and grammar, though sophisticated attacks may be well written
• links that go somewhere unexpected, so hover over a link to see where it leads before you click

What to do with suspicious emails

Do not click any links, open attachments or reply. Forward the email to report@phishing.gov.uk, then delete it. If it asks you to do something, check with the sender using contact details you already trust, not by replying.

Training your staff

Your staff are your first line of defence - and your biggest vulnerability. A single click on a malicious link can compromise your entire business.

Free training options

Share the NCSC's free "Top Tips for Staff" resources, send brief monthly reminders about new threats, and send test phishing emails to see who clicks. Many free tools can do this.

Key messages for staff

• Think before you click - if in doubt, do not
• Report suspicious emails immediately (make this easy)
• Never share passwords or give remote access to callers
• Lock computers when leaving your desk
• Use work devices for work only

Securing remote and hybrid working

If your staff work from home or use personal devices, you need additional precautions.

Essential measures for remote work

• Require a virtual private network (VPN) for remote access to company systems.
• Provide work devices where you can, rather than relying on personal ones.
• Remind staff to change the default password on their home router and keep its firmware updated.
• Set devices to lock automatically after a few minutes of inactivity.
• Use approved cloud services with two-step verification rather than USB sticks.

Reporting a personal data breach

If the attack affected personal data, you must report it to the Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. You do not need to report a breach that is unlikely to result in a risk to people's rights and freedoms.

You do not have to wait until you know everything. You can give the information in phases as your investigation goes on. If you report after 72 hours, you must give your reasons for the delay.

If the breach is likely to result in a high risk to the people affected, you must also tell them without undue delay, in clear and plain language.

Keep a record of every personal data breach, including ones you decide not to report: what happened, its effects and what you did about it.

You can also report a cyber incident to the National Cyber Security Centre (NCSC). The NCSC does not pass your report to the Commission, so report any personal data breach separately.

Getting certified (optional but recommended)

Once you have implemented the basic controls, consider formal Cyber Essentials certification. This provides independent verification that your security measures work and is required for some government contracts.

When certification makes sense

Certification is mandatory for government contracts involving personal data or ICT services. Some larger customers require it of their suppliers, and many cyber insurance policies require it or offer a discount for it. Going through the process also helps you find gaps.

For most small businesses, basic Cyber Essentials (around £320 for micro businesses) is sufficient. Cyber Essentials Plus is for businesses handling sensitive data or bidding on higher-risk contracts.

Free resources

The following government resources are free and designed for small businesses:

• the NCSC Cyber Action Plan, an online tool that creates a personalised action plan
• Cyber Aware, a government campaign with practical advice
• NCSC guidance on specific security topics
• Exercise in a Box, free exercises to test how you would respond to an attack