This article sets out a realistic baseline for small businesses that do not have a large IT team. The goal is to stop the most common attacks quickly and with limited complexity.
1. Strong authentication for critical systems
Any system that exposes remote access needs stronger protection than a simple password. At a minimum:
- Use multi factor authentication (MFA) for email, VPN, cloud management portals, and remote access tools.
- Remove shared admin logins and give named accounts to each administrator.
- Use a password manager rather than reusing passwords across services.
2. Patch management that actually runs on a schedule
Unpatched systems are still one of the easiest ways for attackers to get in. You don’t need an enterprise platform, but you do need a routine:
- Keep operating systems and browsers updated on servers, laptops, and desktops.
- Apply updates to core business applications and plugins, especially on public facing websites.
- Set a fixed monthly patch window and stick to it.
3. Reliable backups that are separated from production
Ransomware and accidental deletion are still common. Without working backups, recovery is slow, stressful, and expensive. A small organisation should:
- Back up key servers and data at least daily.
- Store at least one backup copy offsite or in a separate cloud account.
- Test restore procedures quarterly so you know they actually work.
4. Access control that reflects real roles
Many small teams grow organically. Over time, staff accumulate access they no longer need. This increases risk with no benefit. You should:
- Review privileged accounts and remove old or unused ones.
- Apply least privilege – staff should have the minimum access required for their role.
- Remove ex staff accounts promptly and revoke any third party access when contracts end.
5. Basic endpoint protection and safe configuration
Company laptops and desktops remain a frequent entry point. Minimum controls include:
- Current anti malware or endpoint protection on all managed devices.
- Disk encryption enabled on laptops that leave the office.
- Locked down local admin rights so staff cannot install arbitrary software.
6. Email and web protection
Many attacks still arrive by email. Well configured email security will block a significant portion of malicious messages before staff ever see them:
- Use modern email filtering with phishing and malware detection.
- Enable DMARC, SPF, and DKIM to reduce spoofing of your domain.
- Consider web filtering to block known malicious sites and risky categories.
7. Simple awareness for staff
You do not need slick training campaigns. Staff simply need to understand the basics:
- How to recognise suspicious emails or messages.
- How to report something unusual quickly.
- What they are allowed to store and send using personal devices or cloud accounts.
Putting it all together
These controls form a realistic starting point for most small organisations. They are also aligned with the early stages of the KW Cybersecurity Baseline Security Sprint, which focuses on implementation rather than theory.
Next step: If you want these controls implemented in a structured 30 day programme, consider booking a short discovery call to see whether the Baseline Security Sprint is a fit for your organisation.