A fraudulent Microsoft 365 sign-in page can look convincing enough to catch a busy director between meetings. One password entered in haste can give an attacker access to email, invoices, contacts and sensitive files. This SME cyber security guide focuses on the practical controls that make that scenario far less likely – and help your business recover if something still goes wrong.

For a business with 10 to 350 staff, cyber security is not about buying every available tool. It is about reducing the risks most likely to interrupt operations, cost money or damage client trust. The right approach is proportionate, clearly owned and tested in real working conditions.

Start with the risks that could stop the business

A useful starting point is to identify what would cause the greatest disruption if it were unavailable, altered or exposed. For an accountant, that may be client financial records and email correspondence. For a solicitor, it may be case files, document access and confidential communications. For a charity, it may be donor data and the systems that support service delivery.

Most SMEs face a familiar set of threats: phishing emails, stolen passwords, ransomware, fraudulent payment requests, lost devices and suppliers with compromised accounts. Cyber criminals often target smaller firms precisely because their controls can be inconsistent, not because they are unimportant.

Avoid treating risk assessment as a document created for a tender and then forgotten. Review it when you introduce a new cloud system, change how people work, open a new site or take on a supplier that handles sensitive information. Security should follow the way your business actually operates.

SME cyber security guide: get the foundations right

The strongest security improvements are usually the least glamorous. They are also the controls that prevent a minor error becoming a major incident.

Protect every account, especially email

Email remains the front door for many attacks. It is where password resets arrive, invoices are discussed and impersonation attempts begin. Multi-factor authentication should be enabled for Microsoft 365, remote access, finance platforms and any system holding business or personal data.

Authentication apps or security keys generally provide better protection than text messages, although SMS is still preferable to a password alone. Multi-factor authentication can feel inconvenient at first, particularly for staff who use several systems, but that small amount of friction is far cheaper than recovering a compromised account.

Use unique passwords and a reputable password manager. Shared logins may seem convenient for a small team, but they remove accountability and make it difficult to revoke access when someone leaves. Each person should have their own account with access limited to what they need.

Administrative accounts deserve special treatment. Keep the number of global administrators low, use separate accounts for admin work where practical, and review privileged access regularly. An attacker who gains a standard user account is a problem. An attacker who gains a global admin account can become a business-wide crisis.

Keep devices managed and up to date

Laptops, desktops and mobile phones need more than antivirus software. They should be centrally managed so security updates, encryption, screen locks and approved software can be applied consistently. If a device is lost or stolen, the business should be able to remove company data without waiting for it to reappear.

Patch management matters because criminals routinely exploit known weaknesses. Delaying updates can occasionally be sensible for specialist software or older line-of-business systems, but it should be a conscious decision with compensating controls, not an accidental backlog. Test important updates where possible, then apply them promptly.

Endpoint detection and response adds visibility beyond traditional antivirus. It can identify suspicious activity, isolate a device and provide the information needed to investigate an incident. The right product depends on your environment, but someone must be responsible for reviewing alerts. Security software that nobody monitors is not a complete service.

Filter email and verify payments

Good email filtering reduces the number of malicious messages that reach staff, but it will not catch everything. Configure anti-phishing and impersonation protection, block risky attachments where appropriate, and ensure domain settings help prevent others from spoofing your company email address.

For payment changes, a simple process is often more effective than another piece of technology. If a supplier emails revised bank details, verify them using a known telephone number or an established contact method. Do not use the number contained in the email requesting the change. The same rule applies to urgent requests appearing to come from directors or finance colleagues.

Make backups recoverable, not just present

Ransomware is designed to make data unavailable. It may encrypt files, delete accessible backups or steal information before making a demand. A backup strategy must therefore be designed for recovery, not simply for ticking a box.

Keep more than one copy of important data, with at least one copy protected from normal user and administrator access. Cloud services such as Microsoft 365 provide valuable resilience, but they are not a substitute for a dedicated backup policy. Deleted files, malicious changes and retention issues can still create a serious problem.

Back up servers, cloud data, finance systems, critical databases and configuration information. Also consider what would be needed to rebuild operations: network settings, supplier contacts, licence details and process documents. A clean backup is only useful if you know where it is and can restore it within the time the business can tolerate.

Test restores on a schedule. Restore a file, a mailbox and, where relevant, a system or virtual machine. Record how long each process takes and what was missing. A recovery test often exposes gaps that a backup report will never show.

Turn staff awareness into safer habits

People should not be treated as the weakest link. They are often the first line of defence when they know what to look for and feel comfortable reporting a concern.

Training works best when it is short, regular and relevant to real situations. Show staff how to spot suspicious sign-in prompts, unexpected attachments, unusual invoice requests and messages that create false urgency. Explain what to do next: stop, report it promptly and avoid trying to investigate alone.

There is a balance to strike. Excessive simulated phishing tests can create frustration or embarrassment, particularly if they are used to name and shame people. Use them to identify training needs and improve reporting, not to catch staff out. The aim is a culture where someone can say, “I think I clicked something”, quickly enough for the issue to be contained.

Clear joiner, mover and leaver processes matter too. New starters need appropriate access from day one. Changes in role should trigger an access review. When someone leaves, accounts, devices, forwarding rules and third-party access should be dealt with promptly.

Prepare for the incident before it happens

A calm, documented response can significantly reduce the cost of an incident. Your plan does not need to be a large manual, but it should state who makes decisions, who contacts IT support, how affected systems are isolated and how staff, customers and regulators will be kept informed where necessary.

Keep key contacts available outside your normal systems. If email is unavailable, teams still need a way to coordinate. Decide in advance who can authorise emergency expenditure, communicate with insurers and approve external messaging.

If you suspect an account or device has been compromised, act quickly. Disconnect the affected device from the network if safe to do so, report the issue to your IT team, preserve relevant information and change credentials through a trusted device where advised. Avoid wiping or restarting systems without guidance, as this can remove evidence needed to understand what happened.

For organisations handling personal data, an incident may also require a formal assessment under UK data protection law. This is another reason to keep records of systems, data types, access rights and security decisions.

Give cyber security clear ownership

Technology, policies and training only work when somebody owns the outcome. In smaller organisations, this may be a director supported by an internal IT lead or managed IT provider. What matters is that responsibilities are understood: who reviews security alerts, checks backups, approves access, manages updates and reports risk to the board or leadership team.

External support can provide specialist tools and monitoring without the cost of building a large in-house function. However, outsourcing does not remove the need for business decisions. Your provider can advise on technical risk, but leadership still needs to set priorities, approve investment and make sure security supports the organisation’s goals.

Cyber Essentials can offer a useful framework for many UK SMEs, especially where customers or contracts expect demonstrable controls. It is not a guarantee against attack, but working towards its requirements can bring useful discipline to device management, access control, patching and malware protection.

The most useful next step is not a long shopping list. Pick the highest-risk gap, assign an owner and set a date to check that it is genuinely fixed. A business that can detect a problem, keep working and recover its data is in a far stronger position than one that simply owns more security products.