Cyber Security Basics Every Small UK Business Should Have

The five controls that matter

Cyber Essentials sets out a baseline that blocks most commodity attacks. You do not need certification to implement the controls.

• Firewalls configured and default passwords changed
• Secure device configuration with unnecessary services disabled
• Access control — no shared logins, admin rights only where needed
• Malware protection on every endpoint
• Patch management within 14 days for critical updates

Multi-factor authentication is non-negotiable

MFA on email and any cloud accounting or payment system prevents the most common and most costly attack on small businesses: a compromised mailbox used to redirect invoice payments.

Backups you have actually restored

Keep three copies, on two media types, with one offsite or immutable. Then test a restore. A backup nobody has restored from is an assumption, and ransomware finds assumptions.