Cyber Security Checklist for Small Business: 10 Steps to Protect Your Data

A cyber attack can disrupt payments, expose customer information and affect everyday operations within minutes. For UK small businesses, a practical cybersecurity checklist for small business can help identify weaknesses before they become costly incidents. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses had experienced a cyber breach or attack during the previous 12 months, with phishing remaining a common threat.

Finsoul Network UK helps businesses review practical security measures covering accounts, devices, business data and staff access. This guide brings together current UK guidance to help small businesses protect important information, reduce common risks and prepare for potential incidents without making cybersecurity unnecessarily complicated for owners and small teams.

10 Steps to Protect Your Small Business Data

Cybersecurity works best when technical controls, staff behaviour and business processes are considered together. The following ten steps give small UK businesses a practical way to review their current arrangements and identify areas that need attention.

1. Identify What Data and Systems Your Business Holds

You cannot protect information properly if you do not know where it is kept or who can access it. Start by listing the systems your business depends on and the personal or commercially sensitive information stored within them.

This can include customer records, employee information, payroll details, financial records, contracts, emails and files stored in cloud services.

List the laptops, desktops, mobiles, servers and cloud systems used for business.
Record where customer, employee and supplier information is stored.
Identify which systems would cause the most disruption if they became unavailable.
Note who has access to sensitive information and business-critical systems.

The ICO advises organisations to understand and catalogue the personal data they process, the purpose for using it and the risks linked to unauthorised access, loss or damage.

A simple spreadsheet can be enough for a small business starting this process.

2. Secure Business Email and Important Online Accounts

Business email is a common route into other systems. If an attacker gains access to an employee’s mailbox, they may find invoices, customer information, password-reset messages and confidential correspondence.

Give priority to email and accounts that can lead to financial or administrative access.

Protect business email with 2-step verification or MFA.
Secure Microsoft 365, Google Workspace, banking, accounting and cloud-storage accounts.
Review account recovery details and remove outdated recovery contacts.
Use passkeys where supported, or strong unique passwords alongside 2-step verification.

The NCSC’s current guidance for small organisations recommends strong, unique passwords and 2-step verification for email accounts where passkeys are not being used.

Start with the accounts that could give an attacker access to several other business services.

3. Use Strong, Unique Passwords and Multi-Factor Authentication (MFA)

Reusing one password across several business services can turn one stolen login into several compromised accounts. Small businesses should also avoid sharing passwords between employees.

A password manager can help staff use different passwords without having to remember each one.

Give every employee their own account rather than sharing logins.
Use long, unique passwords for business services.
Store passwords in a reputable password manager instead of spreadsheets or notes.
Turn on MFA for email, financial services, cloud platforms and administrator accounts.

The latest government survey found that 43% of micro businesses required two-factor authentication, up from 35% in the previous year. Among small businesses, the wider figures still show room for stronger account protection.

For a small business, MFA on email and other high-value accounts is one of the quickest security improvements to make.

4. Keep Devices and Software Secure

A business laptop can contain customer records, saved sessions, emails and access to cloud platforms. If an old operating system or unsupported application has a known security weakness, attackers may have an easier route into the business.

Device security also matters when employees work outside the office.

Install security updates promptly and use supported operating systems and applications.
Keep malware protection and firewalls active on business devices.
Set laptops and mobiles to lock automatically after a period of inactivity.
Encrypt devices that contain sensitive business or personal information where appropriate.

The ICO recommends active management of software vulnerabilities, use of supported software, suitable patching practices and controls over devices that access personal data.

Keep a basic record of business devices and their operating systems so outdated equipment does not get forgotten.

5. Secure Your Network and Remote Working

Office and home working can create different security risks. A business may have staff connecting from home, using cloud applications, accessing company files from mobiles or working from public locations.

The network supporting those activities needs sensible controls rather than relying on employees to make every security decision themselves.

Change the default administrator password on business routers and keep router firmware updated.
Separate guest Wi-Fi from the network used for business devices where possible.
Use approved business devices and secure connections for remote access to company systems.
Review remote-access services and remove connections that are no longer required.

Cyber Essentials places firewalls, secure configuration and user access control among its five technical control areas. The current requirements are version 3.3, effective from 27 April 2026.

Remote working should be treated as part of the normal security setup, not as a separate issue.

6. Back Up Your Business Data and Test the Backups

A backup only helps when the business can recover the information it needs. Ransomware, accidental deletion, hardware failure and compromised accounts can all make important files unavailable.

Small businesses should know exactly what gets backed up, where those copies are stored and how restoration would work.

Back up important customer, financial, operational and business files regularly.
Keep backup copies separate from the main systems where possible.
Protect online backup accounts with 2-step verification.
Test restoration so you know the files can actually be recovered.

The NCSC recommends keeping more than one backup and checking that backups contain the required information and can be restored. It also warns that connected storage can be affected by malware, which is why a separate storage copy can be useful.

Do not wait for a ransomware incident to discover that the last usable backup is months old.

7. Train Staff for Phishing Protection and Scam Awareness

Technology cannot prevent every successful scam. Employees may receive a convincing email asking them to change supplier bank details, approve a payment, open an attachment or sign in to a fake Microsoft account.

Phishing remains a major issue for UK businesses, so staff need clear instructions rather than a one-off warning.

Teach employees to check unexpected payment, password and account requests carefully.
Ask staff to verify unusual supplier or bank-detail changes through a separate trusted channel.
Give employees a simple internal method for reporting suspicious emails or messages.
Include phishing awareness when new staff join and refresh training during the year.

The NCSC advises small organisations and their staff to learn how to recognise cyber attacks and understand how suspicious activity should be handled.

Good staff training should make reporting a suspicious message feel like the correct response, not an admission of making a mistake.

8. Control Who Can Access Sensitive Business Data

Not every employee needs access to every file or system. Limiting permissions reduces the damage that can follow from a compromised account, lost device or accidental disclosure.

Access should also change when someone’s job changes or they leave the company.

Give employees access only to the systems and files required for their work.
Keep administrator privileges limited to people who genuinely need them.
Remove accounts and permissions promptly when employees leave.
Review access to payroll, HR, finance, customer and other sensitive records.

The NCSC recommends separate standard and administrator accounts for everyday computer use because an administrator account can give an attacker much greater control after a compromise.

Access reviews can be simple. A quarterly check of users and permissions can reveal accounts that should no longer be active.

9. Check Your Suppliers and Cloud Services

A small business may rely on an accountant, payroll provider, website host, cloud-storage platform, IT company or payment service to handle important information. Security risks can therefore exist outside the business’s own office and devices.

Supplier checks should focus on the information and access each provider receives.

List suppliers that can access personal, financial or commercially sensitive information.
Check what information each provider stores or processes on your behalf.
Review contracts and data-processing arrangements where relevant.
Remove supplier access when a service ends or access is no longer required.

The ICO states that organisations need to manage security risks arising from third-party processors and should select processors that provide sufficient guarantees about their technical and organisational measures.

This is an area worth reviewing because the 2025/2026 government survey found that supplier cyber-risk reviews remain limited among UK businesses.

10. Prepare for a Cyber Attack and Data Breach

Even a well-protected business can experience an incident. The important question is how quickly the business can identify what happened, contain the problem and protect affected information.

A written response plan gives staff something practical to follow when normal business operations are already under pressure.

Name the people responsible for handling a cyber incident and keep their contact details available.
Record the steps for isolating affected accounts, devices or systems.
Assess whether personal data has been accessed, lost, changed or disclosed.
Record the incident and check reporting obligations, including ICO requirements where applicable.

The ICO says the first 72 hours after a personal data breach can be particularly important and provides specific guidance for assessing and responding to breaches. Its current breach guidance is under review following changes introduced by the Data (Use and Access) Act.

For cybercrime or fraud in England, Wales and Northern Ireland, Report Fraud replaced Action Fraud in December 2025. Businesses in Scotland should continue to use Police Scotland’s 101 service.

UK Cyber Security Requirements for Small Businesses

Cyber security is not only an IT matter. UK businesses handling personal information need to consider their data protection responsibilities as well as practical controls for systems and devices.

UK GDPR

Businesses processing personal data must use appropriate technical and organisational measures based on the risks involved. The ICO also expects businesses to review their security measures and their ability to restore access to personal data after an incident.

Data Breach Records

A personal data breach should be assessed promptly to determine the appropriate response and any reporting requirement. The ICO has specific guidance for the first 72 hours following a breach.

Encryption

Data protection law does not require every piece of personal information to be encrypted, but the ICO identifies encryption as an appropriate security measure depending on the risks and circumstances.

Cyber Essentials

The scheme provides a recognised baseline for common technical security controls. Its current version, 3.3, covers firewalls, secure configuration, security update management, user access control and malware protection.

Security Policies

A small business should have practical rules covering areas such as account access, devices, passwords, data handling, backups and incident reporting. The latest government survey found that 52% of small businesses had a formal cyber security policy, while 44% had a business continuity plan covering cyber security.

Supplier Security

If another organisation processes personal data for your business, its security arrangements need to be considered as part of your wider data protection responsibilities.

The right controls depend on the type of business, the information it handles and the risks it faces. UK GDPR does not prescribe one identical security setup for every organisation.

How Often Should a Small Business Review Cyber Security?

A small business should review cyber security regularly rather than waiting for an incident.

Monthly Checks

A monthly check can cover software updates, user accounts, backup status, security alerts and devices that are no longer in use.

Quarterly Reviews

Every quarter, review employee access, supplier permissions, backup restoration and staff awareness.

Annual Reviews

At least once a year, review the business’s cyber risk assessment, security policy, incident response arrangements and important suppliers.

Reviews After Major Changes

A review should also take place after a major change, such as moving to a new cloud platform, opening another office, changing IT providers or introducing a new system that stores personal data. The 2025/2026 government survey found that only 41% of small businesses carried out cyber security risk assessments, showing why regular reviews deserve a place in routine business management.

What Should a Small Business Do First If Its Cyber Security Is Weak?

If your current security arrangements are limited, start with the controls that protect the accounts and information your business depends on every day. A practical order is:

Turn on multi-factor authentication: Start with business email, Microsoft 365 or Google Workspace, banking, accounting and administrator accounts.
Update devices and software: Replace unsupported systems and apply available security updates.
Back up important data: Cover financial records, customer information, contracts, operational files and other business-critical information.
Secure email: Check passwords, recovery details and suspicious login alerts.
Remove unnecessary access: Close old accounts and reduce administrator permissions.
Train staff: Focus on phishing, payment fraud, suspicious links and reporting procedures.
Test recovery: Restore selected files from your backups to confirm they are usable.
Write an incident plan: Record who should be contacted, what systems may need to be isolated and how a personal data breach will be assessed.

These steps give a small business a practical starting point without requiring a large IT department.

Conclusion

A strong cybersecurity checklist for small business is not a document that gets completed once and forgotten. It should form part of normal business management, particularly as companies add cloud services, remote workers, new employees and third-party providers. From securing email and using MFA to testing backups and preparing for a data breach, each step helps reduce avoidable security risks.

Finsoul Network UK can help businesses review their current cyber security arrangements, understand areas that need attention and build practical processes around their technology and business data.

Need Help Reviewing Your Business Cyber Security With Finsoul Network UK?

If your business is unsure where its current security arrangements stand, a structured review can help identify gaps across accounts, devices, data, staff access, suppliers and incident planning. Finsoul Network UK can provide guidance based on your business setup and the type of information you handle, helping you decide which security measures should be addressed first.

FAQs

What should a cybersecurity checklist for small business include?

It should cover passwords, MFA, devices, updates, backups, staff training, access controls, suppliers and incident response.

How can a small business improve phishing protection?

Train staff to check unexpected links, attachments, payment requests and login messages before taking action.

Is cyber security certification mandatory for small businesses in the UK?

No. Government-backed certification is not legally required for every small business, although some contracts or customers may require it.

What should a business do after a cyber attack?

Contain the incident, secure affected accounts and systems, record what happened and assess whether personal data was involved.

How often should a small business check its cyber security?

Basic checks should be carried out regularly, with broader security reviews at least annually and after major business or technology changes.