How to Protect a Small Business from Cyber Attacks: 12 Essential Controls
Most cyber attacks on small businesses exploit simple weaknesses: stolen passwords, phishing emails, unpatched software and missing backups. Turning on multi-factor authentication, keeping software updated, limiting who can access what, training staff to spot phishing, and keeping tested offline backups prevents the majority of common incidents. The 12 controls below are listed in the order we'd implement them.
Why small businesses are targeted
Attackers rarely pick targets by size. They use automated tools to look for weaknesses anywhere: exposed logins, reused passwords, out-of-date software. Smaller businesses often have fewer protections, so they're easier to get into. Every business holds something worth stealing or disrupting: customer data, bank access, payroll, or simply the ability to operate.
The goal isn't to become impossible to attack. It's to stop being an easy target, and to recover fast if something goes wrong.
The 12 controls
Priority 1: do these this month
1. Multi-factor authentication (MFA) everywhere Turn on MFA for email, banking, accounting, cloud storage and admin accounts. MFA means a stolen password alone isn't enough to log in. Prefer an authenticator app over SMS codes.
2. A password manager Give every staff member a business password manager so they can use unique, strong passwords without memorising them.
3. Backups you've actually restored Back up critical data automatically, keep at least one copy offline or immutable (it can't be changed or deleted), and test a restore. Untested backups often fail when you need them.
4. Automatic updates Turn on automatic updates for operating systems, browsers and business applications. Replace devices that no longer receive security updates.
Priority 2: within three months
5. Least-privilege access Staff should only have access to what their role needs. Remove admin rights from everyday accounts. Remove access the same day someone leaves.
6. Secure email configuration Set up SPF, DKIM and DMARC on your domain to make it harder for attackers to impersonate you, and turn on your email provider's advanced phishing protection. See Microsoft 365 and Google Workspace security settings.
7. Phishing awareness training Short, regular training with realistic examples. Teach one rule above all: verify any request involving money or credentials through a second channel. See business email compromise.
8. Device protection Endpoint protection (modern antivirus) on every laptop and phone used for work, full-disk encryption, and the ability to wipe lost devices remotely.
Priority 3: within six months
9. Know what you have Keep an inventory of devices, software, cloud services and where sensitive data lives. You can't protect what you don't know about.
10. Secure your website and cloud services Keep CMS platforms and plugins updated, use a web application firewall, and review cloud storage sharing settings. Publicly shared links are a frequent cause of leaks.
11. An incident response plan A one-page plan: who to call, how to isolate affected systems, how to preserve evidence, and who must be notified. In Nigeria, that may include the NDPC within 72 hours for personal-data breaches, and ngCERT for cyber incidents. See our NDPA compliance checklist.
12. Review regularly Review these controls at least annually, and whenever you add new systems, offices or significant numbers of staff. A cybersecurity risk assessment is the structured way to do it.
Quick self-check
| Control | In place? |
|---|---|
| MFA on email and banking | ☐ |
| Password manager | ☐ |
| Tested offline backup | ☐ |
| Automatic updates | ☐ |
| No everyday admin accounts | ☐ |
| SPF/DKIM/DMARC configured | ☐ |
| Phishing training in the last 12 months | ☐ |
| Incident response plan written | ☐ |
Fewer than six ticks? Start with Priority 1. Or use our cybersecurity readiness self-assessment for a scored view.
Frequently asked questions
What is the most important cybersecurity measure for a small business?
Multi-factor authentication on email and financial accounts. Compromised email accounts are behind a large share of fraud and data breaches, and MFA blocks most password-based attacks.
How much should a small business spend on cybersecurity?
There's no universal figure. Many of the most effective controls, including MFA, updates, backups and security settings, cost little or nothing beyond time. Spend first on the gaps a risk assessment shows are most likely to hurt you.
Do small businesses need cyber insurance?
Cyber insurance can cover the costs of responding to and recovering from an incident, but insurers increasingly require basic controls such as MFA and backups before they'll offer cover. Put the controls in place first.
What should I do if I think we've been hacked?
Disconnect affected devices from the network, don't delete anything, change passwords from a clean device, contact your IT or security provider, and check whether you have legal reporting duties.
Not sure where your business stands?
We'll review your setup and give you a plain-English list of what to fix first. Strengthen your digital security →