The short answer
Most small businesses need the same core protections: multi-factor authentication on email and cloud accounts, automatic security updates, backups kept separate from the network, anti-malware, limited admin rights, staff who can spot phishing and a call-back check before any change to payment details. Cyber Essentials certification then proves the technical basics to customers.
On this page
- What are the biggest cyber threats to small businesses?
- Cyber security tips for small businesses: where to start
- What cyber security does a small business need for its situation?
- Where does Cyber Essentials fit?
- Cyber security checklist for small businesses
- When should a small business add a penetration test or PCI DSS?
- What free help is there with cyber security for small businesses?
- Why Sovereign Secure
- Next step
Effective cyber security for small business owners comes down to a handful of habits: multi-factor authentication on every important account, automatic updates, backups kept away from your network, limited admin rights, staff who know what phishing looks like and a firm rule that nobody changes payment details without a phone call. Those steps stop most of the common attacks small firms face. Certification and testing come after, to prove it to customers and check the riskier parts.
This page is an SME cyber security plan for UK firms. Cyber Essentials is one step in it, not the whole of it. If you want the NCSC’s own framework, which it aims at medium to large organisations with someone dedicated to security, see our guide to the NCSC 10 Steps to Cyber Security.
What are the biggest cyber threats to small businesses?
Phishing comes first. The government’s annual Cyber Security Breaches Survey consistently finds phishing is the most common type of attack businesses report, and it is often the start of something more expensive.
| Threat | How it usually happens | What stops it |
|---|---|---|
| Phishing | An email or text leads to a fake login page or a malicious attachment | Multi-factor authentication, email filtering, staff awareness |
| Invoice fraud and business email compromise | A criminal takes over or imitates a supplier’s or director’s email and asks for a payment to new bank details | A call-back to a known number before any bank detail change |
| Ransomware | Stolen passwords, phishing or unpatched remote access lets an attacker encrypt, and often steal, your data | Updates, MFA on remote access, separate and tested backups |
| Account takeover | Reused or guessed passwords on Microsoft 365, Google Workspace or online banking | MFA, unique passwords and a password manager |
| Lost or stolen devices | A laptop or phone is left on a train | Device encryption, screen locks, remote wipe |
| Website and checkout attacks | Outdated website software, or a skimming script added to a payment page | Updates, a hosted payment page and PCI DSS controls |
Our guide to preventing ransomware goes deeper on the most disruptive of these.
Cyber security tips for small businesses: where to start
Start with email and accounts, because that is where most small-business incidents begin. Then work through these ten tips, roughly in order.
- List what you have. Devices, cloud accounts, the data you hold, who has access and which suppliers can reach your systems. You cannot protect what you do not know about, and a simple cyber security risk assessment then shows which gaps matter most.
- Turn on multi-factor authentication everywhere. Email first, then cloud services, banking, admin accounts and remote access.
- Keep everything updated. Switch on automatic updates and replace software and devices that no longer receive security fixes. Cyber Essentials expects high-risk and critical updates within 14 days of release.
- Back up and test the restore. Keep at least one copy that ransomware on your network cannot reach, and check you can actually get files back.
- Separate admin accounts. Use everyday accounts without admin rights, and keep admin access for the few people and tasks that need it.
- Run a firewall and anti-malware on every device. Built-in tools are fine as long as they are switched on and kept up to date.
- Change default passwords and remove what you do not use. Old accounts, unused software and default settings are easy ways in.
- Verify every payment change. Phone the supplier on a number you already hold before changing bank details, and require a second approver for large payments.
- Train staff briefly and often. Show people what phishing looks like and make it easy, and blame-free, to report a mistake. To check the training is working, our guide explains what a phishing simulation is and how to run one fairly.
- Check suppliers and plan for a bad day. Ask your IT provider and key cloud services how they protect your data, and write a one-page incident response plan: who to call, how to reach your bank and insurer, and when to report a personal data breach to the ICO (without undue delay and, where feasible, within 72 hours if it is reportable).
What cyber security does a small business need for its situation?
The plan above applies to everyone. What you add on top depends on how you trade.
| If you… | You also need |
|---|---|
| Bid for public sector or larger corporate contracts | Cyber Essentials, and sometimes Cyber Essentials Plus |
| Take card payments | PCI DSS compliance, usually validated with a Self-Assessment Questionnaire |
| Hold personal data about customers or staff | Security appropriate to the risk under UK GDPR, and a process for reporting breaches to the ICO |
| Run a website with logins, a customer portal or an app | A penetration test of that application |
| Face detailed security questionnaires from larger customers | Cyber Essentials Plus now, and possibly ISO 27001 later |
If larger customers start asking for ISO 27001, our guide explains what ISO 27001 is and how it differs from Cyber Essentials. Small firms without anyone who owns security sometimes bring in part-time senior help; our guide to the virtual CISO (vCISO) explains how that role works.
Where does Cyber Essentials fit?
Cyber Essentials is the government-backed certificate that proves the technical basics are in place. It covers five controls: firewalls, secure configuration, security update management, user access control and malware protection. Those match steps 2, 3, 5, 6 and 7 of the plan. It does not cover backups, staff awareness or payment checks, which is why it is one step rather than the whole plan.
For most small firms it is still the best first certificate, because customers and public sector buyers recognise it. Our honest view of whether Cyber Essentials is worth it covers the benefits and limits, and the Cyber Essentials cost page sets out the packages by company size. Not sure if you are ready? The free Cyber Essentials readiness check takes about five minutes. Sector guides cover the extra questions customers and funders ask: Cyber Essentials for law firms, Cyber Essentials for charities and Cyber Essentials for schools.
Cyber security checklist for small businesses
Use this cyber security checklist to see where you stand. The first ten checks map to the five Cyber Essentials controls, so a business that can tick them is close to certification; the last two cover risks Cyber Essentials does not.
| Check | Cyber Essentials control | Done when |
|---|---|---|
| Firewall switched on for every laptop and desktop | Firewalls | The built-in firewall is on, including on home workers’ devices |
| Router and firewall secured | Firewalls | The default admin password is changed and remote admin is off, or protected by MFA or an IP allow list |
| Default passwords changed on every device | Secure configuration | Routers, printers, storage and new laptops all use unique passwords |
| Unused software and accounts removed | Secure configuration | Old apps, guest accounts and leavers’ logins are gone, and screens lock when left |
| Automatic updates switched on | Security update management | Every device and app updates itself where it can |
| Critical updates installed within 14 days | Security update management | High and critical updates go on within 14 days of release, and nothing runs software its vendor no longer supports |
| MFA on email and every cloud service | User access control | Every user and admin signs in with a second factor |
| Admin rights kept separate | User access control | Everyday accounts have no admin rights, and access is removed when someone leaves |
| Anti-malware on every computer | Malware protection | It is switched on, updates itself and blocks malicious websites |
| Phone and tablet apps from official stores only | Malware protection | Staff install apps only from the Apple App Store or Google Play |
| Backups kept separate and tested | Not covered by Cyber Essentials | At least one copy is out of reach of your network, and a restore has been tried |
| Payment changes verified and staff briefed | Not covered by Cyber Essentials | Bank detail changes need a call-back, and staff know how to report phishing |
For the requirement-by-requirement version, with the evidence an assessor expects, use our Cyber Essentials checklist. Then write the rules down so everyone follows the same ones: our cyber security policy template gives a small business a starting point.
When should a small business add a penetration test or PCI DSS?
Add a penetration test when you run something an attacker can reach and that matters to customers: your own web application, a customer portal, an app or remote access into the office. It is also worth doing when a customer asks for a test report or after major changes. Cyber Essentials Plus includes technical checks, but it is not a penetration test. Our guide to penetration testing for small businesses explains what to test first and how to keep the scope right-sized.
PCI DSS applies as soon as you accept card payments, whatever your size. Most small merchants validate with a Self-Assessment Questionnaire, and the right one depends on whether you use a card terminal, a hosted payment page or your own checkout. Our guide to PCI compliance for small businesses walks through the options.
What free help is there with cyber security for small businesses?
The best free starting point is the National Cyber Security Centre (NCSC), which offers five services to small organisations at no cost:
| Free NCSC service | What it does | Best for |
|---|---|---|
| Cyber Action Toolkit | Personalised guidance, launched in October 2025, that starts with high-impact, low-effort actions and moves through Foundation, Improver and Enhanced levels towards Cyber Essentials | Sole traders and micro businesses starting from scratch |
| Small organisations guide to cyber security | Short, practical steps on backups, devices, accounts and scams (formerly the Small Business Guide), with separate response and recovery advice | Firms with up to 49 employees |
| Check your cyber security | Remote, non-intrusive checks of your website, email security and browser, with no software to install | A quick outside-in health check |
| Early Warning | Email alerts when NCSC and partner threat feeds link your IP addresses or domains to malware, network abuse, vulnerabilities or open ports | Any UK organisation with its own domain or fixed IP addresses |
| Exercise in a Box | Ready-made exercises to rehearse a cyber incident with your team | Testing the one-page plan from step 10 |
Police-backed regional Cyber Resilience Centres also offer free guidance to small businesses. Free tools tell you what to fix, but they do not give customers evidence. When a customer or tender asks for proof, the free Cyber Essentials readiness check shows how close you are to certification.
Why Sovereign Secure
- IASME-licensed Cyber Essentials certification body. We assess and issue both Cyber Essentials and Cyber Essentials Plus certificates, with published prices for Cyber Essentials.
- Penetration testing scoped to what you run, from websites and cloud services to networks and mobile apps.
- PCI SSC Qualified Security Assessor (QSA) company, so card payment questions get an answer from people who assess PCI DSS.
- ISO 27001 certified, and a UK company since 2012, headquartered in Accrington, Lancashire.
Next step
Work through the plan, then take the readiness check to see how close you are to Cyber Essentials. When you are ready, send us your company size through the form below, choosing “First time Cyber Essentials (CE)”, or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
