CYBER SECURITY
What should a small-business cyber security plan include?
A practical small-business security plan should connect identity, devices, email, networks, backup, user awareness and response preparation rather than relying on one security product.
Protect identities first
Business accounts provide access to email, files, applications and customer information. Multi-factor authentication, appropriate permissions and reliable joiner-leaver processes are important foundations.
Cover the complete working environment
- Identity and multi-factor authentication
- Managed device configuration and endpoint protection
- Email filtering and Microsoft 365 security
- Firewall, Wi-Fi and network controls
- Backup and recovery preparation
- Security awareness for users
- Documented incident contacts and next steps
Prioritise practical improvements
Start with the most important accounts, information and systems. Review the controls already in place, identify material gaps and assign ownership for each improvement.
Security is an ongoing process
Users, devices, suppliers and technology change over time. The security plan should therefore be reviewed as the business environment changes.
RELATED QUESTIONS
Frequently asked questions.
Is antivirus enough for a small business?
Antivirus or endpoint protection is one layer. A practical plan should also consider identity, email, networks, backup, user behaviour and response preparation.
Where should a small business begin?
Begin with important accounts, devices, information and systems, then assess the controls and ownership around each area.