A practical cyber security checklist for UK small businesses
If you do only three things: turn on multi-factor authentication everywhere starting with email, get automated backups running and restore one to prove they work, and let every device and every website dependency update automatically. That covers most of the realistic risk, and costs close to nothing.
The full checklist is below, in seven sections. Each control comes with the evidence a reviewer would ask for, because "we have backups" and "we restored one on 14 June in twenty minutes" are very different claims.
By Lucas Reddington, full-stack developer and AI engineer, Northbytes. Reviewed by Piers Bennett, co-founder, Northbytes, background in law. Last updated .
1. Know what you have
You cannot protect an account you've forgotten. Everything else on this list depends on this one being done first, and it is the step almost everybody skips.
List every account and service the business uses
EvidenceA spreadsheet or document naming each service, who owns it, who has access and what it costs. Include the ones marketing signed up for.
List every domain, and who controls the registrar login
EvidenceRegistrar, renewal date, and the account it sits in. Domains lost at renewal are a surprisingly common cause of business-stopping outages.
Identify where personal data lives
EvidenceWhich systems hold customer or staff data, what kind, and how long it is kept. This is also your starting point for a record of processing under UK GDPR.
Name who is responsible
EvidenceOne person, by name, accountable for security. In a small business that's usually a director, and it does not require them to be technical.
2. Accounts and passwords
Compromised credentials remain the most common way small organisations get breached, and this section is the highest return on effort on the whole page.
Multi-factor authentication on email first, then everything
EvidenceA screenshot of enforcement in the admin console, not a policy saying people should. Email first because it is how every other password gets reset.
A password manager for the whole team
EvidenceTeam licence in place and shared credentials moved into it. This is what makes long unique passwords realistic rather than aspirational.
No shared logins
EvidenceEvery person has their own account. Shared logins make an audit trail meaningless and offboarding impossible.
Admin access limited to who needs it
EvidenceA list of who holds admin rights on each system, reviewed at least twice a year with the reductions recorded.
3. Updates and devices
Most successful attacks on small organisations use known vulnerabilities in software that had a fix available. Automated attacks do not care how small you are.
Automatic updates on laptops, phones and browsers
EvidenceEnabled by default across devices, with a named person checking quarterly that they are still on.
Website and application dependencies kept current
EvidenceDependency scanning enabled on the codebase, or a maintenance plan that explicitly includes it. Ask your provider which it is.
Devices encrypted and screen-locked
EvidenceFileVault or BitLocker on, phone passcodes required. A stolen unencrypted laptop with customer data on it is a reportable breach.
Nothing running past end of support
EvidenceAn inventory of operating systems and platform versions with their end-of-support dates, and a plan for the ones approaching.
4. Backups you have actually tested
This is the control that decides whether an incident is a bad week or the end of the business, and it is the one most often assumed rather than verified.
Automated backups of everything that matters
EvidenceWhat is backed up, how often, and where to. Data in a cloud service still needs its own backup; a sync is not a backup.
At least one copy offline or otherwise isolated
EvidenceRansomware encrypts what it can reach, including connected backup drives and, sometimes, connected cloud storage.
A restore performed and timed
EvidenceA date, who did it, what was restored and how long it took. If you cannot write that sentence, you do not have backups yet.
A stated retention period
EvidenceHow far back you can go. Discovering corruption three weeks after it started is only survivable if the backups reach further than three weeks.
5. Email and your domain
Email is both the most common way in and the most common way your customers get defrauded in your name. Two different problems, both fixed here.
SPF, DKIM and DMARC configured
EvidenceRecords published and DMARC reports being read. Start DMARC in monitoring mode and tighten it once the reports are clean.
Staff know how invoice fraud works
EvidenceA rule that bank-detail changes are verified by phone on a known number, every time, with no exceptions for urgency. This single rule prevents the most expensive thing that happens to small businesses.
Phishing reporting is easy and blameless
EvidenceA known address or button to report to, and a culture where reporting a click gets help rather than a telling-off. Punished mistakes get hidden.
Former staff removed from email the same day
EvidenceAn offboarding checklist with dates completed. Mail forwarded or delegated, access revoked, devices returned.
6. Your website and cloud apps
If you take enquiries, payments or bookings online, the website is part of your attack surface whether or not anyone thinks of it that way.
HTTPS everywhere, with certificates auto-renewing
EvidenceNo mixed content, no expiry surprises. Certificate expiry is an avoidable outage that still happens constantly.
Admin interfaces protected
EvidenceStrong unique credentials, MFA where the platform supports it, and no default usernames. Admin panels are scanned for continuously.
Access control checked on the server, not just hidden in the UI
EvidenceSomeone has confirmed that changing an ID in a URL does not show another customer's data. This is the single most common serious flaw in small business applications.
Third-party scripts reviewed
EvidenceA list of what runs on your pages and why. Every tag you add can read what your users type, and old marketing tags are rarely removed.
7. When it goes wrong
Deciding all this during an incident, at speed, under stress, is how small problems become large ones. Half an hour spent now is worth it.
A written incident plan, one page
EvidenceWho to call, what to isolate, who decides, who tells customers. One page that a stressed person can follow, not a manual nobody opens.
Know your reporting obligations
EvidencePersonal data breaches meeting the threshold must be reported to the ICO within 72 hours of becoming aware. Know who makes that call before you need to.
Contact details available offline
EvidencePrinted or on a phone. If the incident is that you have lost access to your systems, a plan stored inside them is not much use.
Log enough to reconstruct events
EvidenceSign-in and admin action logs kept for a defined period. Without them, the honest answer to "what did they access" is that you cannot say, which is itself a problem.
What this checklist is not
It is not a certification. Cyber Essentials is a scheme run under the NCSC and certified by accredited bodies; we are not one of them, and the controls here overlapping with it does not make you certified.
It is not legal advice. Where it mentions UK GDPR obligations, the ICO's own guidance is linked in the sources and is the authoritative source. For a formal opinion about your obligations, you need a solicitor advising you.
And it is not a substitute for someone looking at your actual systems. A checklist catches the categories; a review catches the specific thing wrong with your specific setup, which is usually something that no generic list could have predicted. If you want that, our website security audit is the fixed-price version for one site, and security reviews covers the wider picture.
Common questions
Where should a small business start with cyber security?
Three things, in this order, and they cover most of the realistic risk. Turn on multi-factor authentication everywhere, starting with email, because compromised credentials are the most common route in. Get automated backups working and actually restore one to prove it. Turn on automatic updates on every device and make sure your website's dependencies are being patched too. If you do nothing else on this page, do those three, and they cost almost nothing.
Do we need Cyber Essentials?
Only you can decide, but the common reason is commercial: some public sector contracts and some insurers require it, so if you are bidding for that work it stops being optional. Beyond that, it is a reasonable external check that the basics are in place. Certification is issued by accredited bodies under the NCSC scheme, which is not something we provide, and we will point you to the scheme rather than imply we can certify you. The controls it covers overlap heavily with this checklist.
How often should we review this?
Twice a year for the whole list, and immediately whenever someone joins or leaves, you adopt a new system, or you have an incident or a near miss. Put both reviews in the calendar with a named owner, because security work that depends on somebody remembering is security work that stops after the first enthusiastic month.
We're tiny. Are we really a target?
Not personally, and that is exactly the point. Most attacks on small organisations are automated: software scans the whole internet for known vulnerabilities and weak credentials and exploits whatever answers. It does not know or care how many people work for you. Being small does not make you invisible, it usually just means less support and a lower chance of noticing quickly.
Is this checklist enough on its own?
It covers the controls that address most realistic risk for a small UK organisation, which is a genuinely high proportion. What it is not is a certification, a formal audit, or legal advice, and it does not replace someone looking at your specific systems. If you hold sensitive data, operate in a regulated sector, or something on this list turned up an answer you did not like, that is the point to get a review of your actual setup.
Sources
Figures quoted from outside Northbytes come from these sources, checked on 26 July 2026. Our own prices are our published rates.
Read next
How much does a website security audit cost?
Four different services wear the word audit, which is why quotes vary twentyfold. What each buys, our own scope, and a sample finding.
How much does website maintenance cost?
Why hosting and maintenance are not the same product, the four price bands, six exclusions to read for, and our £45 plan itemised.
Google Workspace migration checklist
Four phases across two weeks: inventory, prepare, cut over, verify. Including the two steps people skip and how to roll back.
Want someone to check your actual setup?
Tell us what you run and what worries you. The first conversation is free and confidential, and we'll be straight about whether you need a review or just the three things at the top of this page.
Get a free quote