In brief: Cyber security for a UK SME starts with knowing which systems, accounts, information and suppliers the business depends on. Protect important accounts and devices, maintain restorable backups, prepare staff, document incident responsibilities and review the controls as the business changes.
Why cyber security matters for UK SMEs
Cyber security is a business-continuity, customer-trust and information-governance issue, not only an IT task. Email, online banking, cloud storage, websites, accounting systems and customer records can all become critical dependencies. A disruption can affect delivery even when no personal data is involved.
The UK Government’s Cyber Security Breaches Survey 2025/2026 reported that 43% of businesses identified a breach or attack in the previous 12 months. The reported rate was 46% for small businesses and 65% for medium businesses. Phishing was the most commonly identified type among businesses, at 38%. These figures describe surveyed organisations and incidents they identified; they do not predict whether a particular SME will be attacked.
The practical response is neither panic nor complacency. It is to identify the business’s most important dependencies, address the most consequential weaknesses and know how to respond when something looks wrong.
Start with what the business needs to protect
List the systems, accounts, devices, information and suppliers whose loss or compromise would interrupt the business. Include email and domain administration, finance, customer and employee information, operational systems, cloud services, websites and supplier portals.
For each dependency, record:
- the business owner and technical contact;
- who has access and why;
- the likely operational impact of disruption;
- how the information or service is backed up or recovered;
- the supplier and escalation route;
- when the arrangement was last reviewed or tested.
This creates a proportionate risk picture. A five-person professional practice and a manufacturer with connected equipment may need different controls, even if both are SMEs.
A practical cyber security checklist for small businesses
1. Protect important accounts
Identify business-critical accounts and make sure each has a named owner. Use passkeys where available or strong, unique passwords held in an appropriate password manager. Enable two-step verification for important accounts that still rely on passwords. Avoid unmanaged shared logins, and keep recovery details under business control.
2. Control access when people join, change roles or leave
Give people only the access they need. Keep an access list for critical systems and remove access promptly when it is no longer required. Include contractors, agencies and suppliers, not only employees. Make access removal part of the onboarding and offboarding process.
3. Keep devices and software supported
Record the devices and software used for business. Apply security updates promptly, replace unsupported products and decide how personal devices may be used. Use the security features already available in the operating system and business applications, then obtain specialist advice where the risk or technical environment requires it.
4. Reduce email and phishing risk
Make it easy for staff to question an unexpected request, payment change or login prompt. Use a second channel to verify sensitive instructions. Provide short, relevant guidance and a clear reporting route. The aim is not to blame someone who reports a mistake; rapid reporting gives the business more time to respond.
5. Maintain backups that can actually be restored
Decide which information and systems the business would need to recover, how quickly and in what order. Keep backups protected from the same incident that could affect the original data, and test restoration. The NCSC response and recovery guidance recommends backing up essential information regularly and checking that it can be restored.
6. Understand suppliers and cloud services
Record which suppliers store information or provide critical systems, what each party is responsible for, how access is protected, how incidents are reported and how data or service can be recovered. A reputable supplier reduces some work but does not remove the business’s responsibility for decisions, access and continuity.
7. Map personal and sensitive information
Know what information the business holds, where it is stored, who can access it and how long it is retained. Apply controls that reflect the sensitivity and likely harm. For personal data, follow current ICO security guidance and obtain qualified advice where required.
8. Prepare an incident response route
Name the people who will coordinate a suspected incident, their deputies and the technical, legal, insurance, supplier and communications contacts they may need. Keep essential contact details somewhere accessible if normal systems are unavailable. The plan should cover detection, escalation, containment decisions, recovery, communications and lessons learned.
9. Turn expectations into a usable policy
Document the rules and responsibilities people need to follow. Keep them specific to the business and review them when systems, suppliers or working practices change. Use the separate guide to creating a cyber security policy for a small business for the policy structure and checklist.
10. Test, review and improve
Check that accounts are protected, access lists are current, updates are applied, backups restore and staff know how to report concerns. Record gaps, owners and target dates. Review after a material system or supplier change and after an incident or exercise.
What should an SME do first?
| Timeframe | Priority actions |
|---|---|
| First seven days | Identify critical accounts and systems; protect email and finance accounts; confirm who to contact; check whether essential backups exist. |
| First 30 days | Review access, devices, updates, suppliers and data locations; test a restore; document incident roles and staff reporting. |
| Ongoing | Review controls, remove obsolete access, practise response, track unresolved risks and reassess after business changes. |
The free NCSC Cyber Action Toolkit gives sole traders and small businesses prioritised actions. Organisations wanting an independently defined baseline can also review the government-backed Cyber Essentials scheme and use an appropriately qualified provider where implementation or certification help is needed.
What to do when you suspect an incident
- Use the reporting route. Contact the person coordinating the response and the relevant technical provider.
- Limit further harm safely. Follow the incident plan and specialist guidance rather than improvising changes that may destroy evidence or worsen disruption.
- Record decisions and facts. Note what was observed, when it happened, affected systems and actions taken.
- Assess notification duties. Not every cyber incident is a reportable personal-data breach. The ICO breach-reporting guidance says organisations must assess the likely risk to people’s rights and freedoms. Where risk is likely, notification is required as soon as possible and, where feasible, within 72 hours.
- Recover and learn. Restore in a controlled order, confirm systems are safe to use and update controls and plans.
Businesses suffering a live attack or significant cyber incident should follow current NCSC and law-enforcement reporting guidance. Obtain technical, legal, regulatory and insurance advice appropriate to the circumstances.
Common cyber security mistakes
- Assuming the business is too small to attract automated attacks or fraud.
- Buying tools before identifying important systems and responsibilities.
- Leaving email, domain, finance or cloud administration under one person’s unmanaged account.
- Keeping backups without testing restoration.
- Treating staff reporting as a disciplinary problem.
- Assuming a cloud or IT supplier owns every security responsibility.
- Using a policy copied from another organisation without making it operational.
- Waiting for an incident before deciding who leads the response.
Frequently asked questions
Do small businesses need cyber security?
Yes. The appropriate controls depend on the systems, information, customers, suppliers and likely impact involved. Small size does not remove operational, contractual or data-protection responsibilities.
What is the difference between this guide and the policy article?
This guide owns the broad risk-and-priorities question. The policy article explains how to document everyday rules, responsibilities and review arrangements. They are related but serve different search intent.
Does every personal-data breach need to be reported within 72 hours?
No. The ICO requires organisations to assess the likely risk to people. Where a risk is likely, the breach must be reported as soon as possible and, where feasible, within 72 hours. Keep a record of the assessment and obtain qualified advice where necessary.
Does G&G provide technical cyber security services?
This article does not claim that G&G supplies technical security implementation, monitoring, certification, incident response or legal advice. Those needs should be handled by appropriately qualified specialists.
How G&G can support the business decision
A G&G Business Review can help an owner identify critical business dependencies, unclear responsibilities, supplier reliance, continuity priorities and actions that need accountable owners. It is a business-management review, not a technical cyber security audit or substitute for regulated advice.
For wider continuity planning, see business resilience and continuity planning for SMEs. The goal is a proportionate plan the business can operate, test and improve.
