Cybersecurity has a reputation for being complicated, expensive, and full of technobabble and jargon. For small businesses, it doesn't need to be this way, as the majority of attacks against you aren't overly sophisticated. They work instead because a basic control was never switched on or properly configured, nobody checked it, or your team was manipulated into believing something they shouldn't.
This guide covers our set of recommendations that small to medium sized firms should have in place, the questions to ask whoever looks after your technology (both internal and external), and why someone independent should check your setup regularly.
Why small businesses are targeted
Cybercriminals aren't looking for the most valuable target, and are instead focusing on the lowest hanging fruit in large quantities. Small businesses hold a substantial amount of client data (i.e. personally identifiable information), move reasonable amounts of money, but normally don't have a security team reviewing the rules and policies that would normally be put in place at a larger organisation.
Who is actually responsible for your cybersecurity
Business owners, team members, managers, staff: we all are. If client data leaks, your clients, insurer, and potentially regulators (if you're in a regulated industry, of course) will be talking to you, not your IT provider.
Most businesses assume their IT provider "does cybersecurity", which is often true for some of the categories. But maintaining laptops, setting up new staff, and keeping track of your licences and subscriptions is a different job from ensuring that your computer and cloud systems are configured securely, monitored, and kept safe. The person who sets up your systems is also not always the right person to be the one checking them, for the same reason you don't audit your own financial books.
This is one of the main reasons why we recommend two completely segregated roles:
- An IT provider who keeps your technology running.
- A cybersecurity professional who independently checks that your technology is secure, tells you plainly where any gaps might lie, and helps keep people (including vendors) accountable.
If you find that the above roles are from the same entity, ensure that cybersecurity work is a clearly defined, reported part of the service, and that you're still getting a second opinion routinely (annually).
The essentials checklist
Our checklist is defined as the "baseline" that we would recommend our clients have in terms of cybersecurity and technology within their organisation, and it keeps a prime focus on financial services in a regulated environment. For each item in the list below, there should be a named owner in your business who reports on it and is responsible for ensuring it stays safe. Also, every account should have MFA enabled at a minimum.
Identity & access
Who and how users can get in.
- Multi-factor authentication (MFA) on every account. Email, accounting, banking, registrar, website, social media. Use an authenticator app or passkey rather than SMS.
- One account per person, no shared logins. So you know who did what, and can remove one person without locking out everyone.
- Separate admin accounts. Admin rights live on a separate account used only for admin work, never for email or browsing.
- Business password manager. No reused passwords, and no passwords in spreadsheets, notebooks or browsers.
- Single sign-on where possible. Use your Microsoft 365 or Google login as the key to other apps, so turning off one account turns off access everywhere.
- Passkeys or hardware keys for important accounts. The strongest protection against phishing. Start with admins and finance.
Devices
Protect devices that access company data.
- Automatic updates switched on. For the operating system and every app. Most attacks use holes that already have a fix.
- Encryption on every laptop. BitLocker on Windows, FileVault on Mac. A lost laptop is then a hardware cost, not a data breach.
- Devices enrolled in management. So security settings are enforced and a lost or stolen device can be locked or wiped remotely.
- Endpoint protection that's actually monitored. Microsoft Defender is often already in your licence. Confirm it's on and someone is watching the alerts.
- Work and personal kept separate. A dedicated work device, or a clear policy if staff use their own.
Email, domain & data
Where most attacks begin.
- SPF, DKIM and DMARC published. These DNS records stop criminals sending email that looks like it came from your domain.
- Domain in the business's name, auto-renew on, MFA on the registrar. Your domain is the foundation of your email and brand.
- Pause and verify any payment or bank-detail change. Confirm by phone on a number you already have, never via the email asking for it.
- Basic data loss prevention. Simple rules that stop sensitive information like tax file numbers or card numbers leaving by email.
- An AI policy and business-grade AI tools. Staff know what can and can't go into AI tools, and you use AI with proper data protection.
Resilience
- Automated, separate backups of email and files. Microsoft and Google protect the platform, not your data. Set and forget, not a USB drive.
- Restores tested at least yearly. Prove you can actually get data back, and know how long it takes.
- An incident response plan, even one page. Who to call, what to do first, and how to reach your insurer.
- Cyber insurance that matches reality. A dedicated policy, ideally with incident response, and controls that match what you declared.
- Quarterly clean-up. Remove old accounts, leftover access and unapproved apps every few months.
Suppliers & oversight
- A named IT provider with an agreed response time. Everyone knows who to call and how fast to expect help.
- A supplier register. Every supplier, the account owner, the renewal date and the cost. Reviewed once a year.
- Admin access to everything held by the business. You (or a trusted second person) can get into every system without asking a supplier.
- An independent security review at least once a year. Someone other than the person who built it checks that it's secure.
Questions to ask your IT provider/internal IT team
- Who has admin access to our systems, and how is it protected?
Expect a list of named accounts with MFA, not "we all use the admin login". - If you disappeared tomorrow, could we get into everything?
The business should hold break-glass admin access to every system. - Is MFA enforced for every user, and how do you know?
Enforced through policy and reported on, not "we asked people to set it up". - How quickly are security updates applied to our devices?
Ideally within 14 days for most updates, and faster for critical ones. Ask for the report. - What's our Microsoft Secure Score, and what's stopping it going higher?
A real number and a reason, not a shrug. - How are our emails and files backed up, and when did you last test a restore?
Separate from Microsoft or Google, with a date for the last test. - Who monitors security alerts, and what happens out of hours?
Alerts that nobody reads don't protect anyone. - Are SPF, DKIM and DMARC set up on our domain, and what's the DMARC policy?
Ideally quarantine or reject, not left on "none" indefinitely. - Is security in our contract, or just support?
Many support agreements cover fixing things, not securing them. Know which you have. - Would you welcome an independent review of our setup?
A good provider says yes. Their work should stand up to a second opinion.
Questions to ask your other suppliers
- Does your product support MFA or single sign-on, and can we enforce it?
- Where is our data stored, and is it kept in Australia?
- Can we export all of our data if we leave, and in what format?
- Do you hold a security certification (such as ISO 27001 or SOC 2), and can we see it?
- How and how quickly will you tell us if you have a breach that affects our data?
- Who in your company can access our data, and is that access logged?
Record the answers in your supplier register. If a supplier can't answer the basics, think hard about what you're trusting them with.
Why you need an independent check
The pace at which the cybersecurity industry is changing is growing exponentially, meaning that each day, the actions carried out yesterday to keep you safe are less relevant. Cybersecurity is now, more than ever, an evolving, continuous, cyclical endeavour requiring regular, and oftentimes independent, reviews to ensure protection. At the bare minimum, we recommend an annual IT audit for most businesses, with firms that hold sensitive or confidential data (finance, health and legal industries) completing one quarterly or better.
Independent reviews should give you:
- A layman's picture of where you stand, with metrics indicating the positive, neutral, or negative cybersecurity standing of the business.
- A prioritised list of fixes and changes, most important first, with any business impacts outlined.
- Documented evidence of self-improvement.
- Somebody to translate business requirements into technology solutions, and vice versa.
Where to start this week
A few simple takeaways can go quite far to ensure that your data remains safe.
- Check to ensure that MFA is on for email, banking, accounting, and your domain registrar.
- Find out who controls your domain name (such as GoDaddy, Cloudflare, Asia Registry, etc.), social platforms (Meta, WhatsApp, Google, etc.), and every admin account.
- Communicate with your team, especially finance and accounting teams, that any request to change bank account details must be approved via the phone or in person, without exception.
- Ask your IT provider the 10 questions above to gauge how compliant they themselves are.
- Book an independent review of your setup.