Small Business Cyber Security Checklist (UK)

Why small businesses are targets

Criminals do not need to target you personally. Most attacks are automated: phishing emails sent to thousands of addresses, bots trying leaked passwords against Microsoft 365, scanners looking for old WordPress plugins. According to the UK Government's Cyber Security Breaches Survey 2025, 43% of UK businesses reported a cyber breach or attack in the previous 12 months, rising to 65% of medium and 69% of large businesses. Phishing was by far the most common type, affecting 38% of businesses.

The good news is that a short list of basics stops most of it. Work through the checklist below and tick off what you have.

None of these steps needs expensive software. Most are settings in tools you already pay for, such as Microsoft 365 and Windows.

Accounts and passwords

• Turn on MFA for Microsoft 365 or Google Workspace, banking, your website admin, domain registrar, accounting software and social media. Use an authenticator app rather than text messages where possible.
• Use a password manager so every account has a long, unique password.
• Separate admin accounts. Nobody should browse the web or read email while signed in as a global admin.
• Remove leavers on their last day: disable the account, revoke sessions, and reset any shared passwords they knew.
• Block legacy authentication in Microsoft 365, which bypasses MFA. Security Defaults or Conditional Access does this.

Devices and software

• Automatic updates on for Windows, macOS, phones, browsers and Office. Critical updates should be installed within 14 days, which is also a Cyber Essentials requirement.
• No unsupported systems. Windows 10 without Extended Security Updates is out of support; see Windows 10 end of support.
• Antivirus active on every device. Microsoft Defender is fine if it is turned on and reporting.
• Disk encryption on laptops: BitLocker on Windows, FileVault on Mac, so a lost laptop is not a data breach.
• Staff are not local admins on their own PCs.
• Router secured: default password changed, firmware updated, remote admin off.

Email, website and backups

• SPF, DKIM and DMARC are set up on your domain so others cannot easily spoof it. Start DMARC at p=none, check the reports, then move to quarantine or reject. See email security.
• External email warning banners on messages from outside the business.
• Website updated: CMS core, plugins and themes, with unused plugins removed and an SSL certificate in place.
• Backups follow 3-2-1: three copies, two different types of storage, one offsite or offline. Include Microsoft 365 mail and OneDrive, which Microsoft does not back up for you in the way most people assume.
• Test a restore at least every quarter.

People and plans

• Short phishing training for everyone, repeated yearly. Teach staff to check sender addresses and to report, not delete, suspicious emails. See staff security training.
• A payment verification rule: any change of bank details is confirmed by phone on a number you already have.
• A one-page incident plan: who to call, how to disconnect, where backups are. Our ransomware guide is a good starting point.
• Consider Cyber Essentials once the basics are in place; see Cyber Essentials explained.

Finally, write down who is responsible for each item on this list. In many small businesses, security slips not because anyone disagrees with it, but because everyone assumes someone else is checking the backups or removing old accounts.

When to call dijitul support

If you could not tick most of the list, we can do a remote review of Microsoft 365, devices, email records, website and backups, then fix the gaps. One-off work is £45 an hour + VAT. To keep it maintained, the £99 a month + VAT Complete plan covers website updates, backups, monitoring, 3 hours of work a month and helpdesk support for your team. See cyber security support and security audit.

Related