12TH NOVEMBER 2026

Cyber Security Tips for Small Businesses

Cyber Security Tips for Small Businesses

Cyber security tips for small businesses start with everyday accounts and habits, not a long policy.

• Give each person their own login, use a password manager, and turn on multi-factor authentication for email, banking and admin accounts.
• Treat unexpected messages with caution, keep devices and software up to date, and limit who can change important settings.
• Test that you can restore your backups, train staff to spot and report mistakes, and keep a short plan of who to call if something goes wrong.

Cyber Essentials is a useful checklist if you want a structure for this work.

Start with the accounts people use every day

Most incidents we see begin with a guessed, reused or stolen password, usually on email or Microsoft 365. If that mailbox is opened, the rest of the business often follows.

Give every person their own login. Do not share a generic "office" password on a sticky note or in a group chat. Use a password manager so staff can keep long, unique passwords without having to remember each one.

Then turn on multi-factor authentication (MFA) for email, banking, payroll and any cloud admin accounts. A code or prompt on a phone stops a large share of password-only attacks. We have a separate guide to multi-factor authentication if you want the detail.

Treat unexpected messages with caution

Phishing is still the most common way someone gets into a small business. The message may look like a delivery update, a request from a director, or a shared file you were expecting.

A few habits help:

• Check the sender address, not just the display name
• Be wary of urgent requests for money, passwords or codes
• Hover over links before you click, and open known sites by typing the address yourself
• Do not enter a password or MFA code on a page you reached from an unexpected email

If something feels off, call the person on a number you already have. We have also written about a new kind of phishing threat that aims to capture temporary access tokens, so staff should treat unusual sign-in prompts with the same care.

Keep devices and software up to date

Out-of-date laptops, servers and apps are an open door. Attackers look for known flaws that a patch has already fixed.

Turn on automatic updates for Windows or macOS, for browsers, and for the line-of-business software you rely on. That includes routers and firewalls, which are easy to forget once they are in the cupboard.

Replace equipment that can no longer receive security updates. If a machine is still useful for a single offline task, keep it off the main network rather than hoping nothing will happen.

Limit who can change important settings

Not everyone needs to be an administrator. The fewer people who can install software, change bank details or add new users, the less damage a stolen password can do.

Review access when someone changes role, and remove it on the day they leave. That applies to email, shared drives, finance systems and any supplier portals as well as the office network.

If you use Microsoft 365, check who is a global admin and cut that list down to the people who genuinely need it. A second, tightly controlled admin account is safer than doing day-to-day work in an account with full control.

Make sure you can get your files back

Backups only count if you can restore them. Keep copies of important data, and keep at least one copy somewhere that a ransomware attack on the office or a cloud account cannot also encrypt.

Do not assume Microsoft 365 will undo every deletion or encryption for you. It keeps the service running, but restoring mail and files is often still your responsibility. Test a restore every few months so you are not finding out the backup failed at the worst possible moment.

Train people, rather than relying on software alone

Most attacks still try to trick a person, so short, regular training works better than a long session once a year.

Show staff real examples of phishing, explain how MFA prompts can be abused, and make it easy to report a mistake. People should feel they can say "I clicked something I shouldn't have" quickly, because a fast call is much easier to deal with than a quiet delay.

On our Keeping IT Secure page we talk about this as a mix of technology and people. Clear advice and regular training sit alongside the technical controls, not behind them.

Use Cyber Essentials as a checklist

The UK government's Cyber Essentials scheme is a useful checklist for the tips above. It covers the basics: firewalls, secure configuration, access control, malware protection and security updates.

Many customers, insurers and public sector contracts now expect to see it. Bluespires can assess where you stand and guide you through Cyber Essentials certification, including the Plus version if you need the extra testing.

You do not have to wait for a certificate to start, though. Tightening passwords, turning on MFA and patching devices will reduce risk immediately.

Have a simple plan for when something goes wrong

Write down who to call, how you will tell staff and customers, and how you will get email and files back. Keep a copy of that note somewhere you can reach if your systems are down, along with contact details for your IT support, insurer and any key suppliers.

If you think an account has been compromised, change the password from a device you trust, end other sign-in sessions if the service allows it, and get help before you try to tidy up on your own.

How Bluespires can help

Bluespires is based in Witney and supports over 170 companies and over 40 charities. We can help with monitoring, updates, email and endpoint protection, staff awareness, and a review of the gaps.

We start with a Systems and Cyber Security Review, then recommend the tools that fit your setup and budget.

If you would like us to look over your current arrangements, book a free consultation or call 01865 959160