Insights / Checklist / Cybersecurity and IT resilience
ChecklistCyber security basics for small organisations
You do not need a security department to be hard to attack. A handful of well-chosen controls prevent many common attacks, and this checklist covers them.
Small organisations often assume they are too small to be a target. In practice, many attacks are not targeted at all. Automated tools scan for weak passwords, unpatched systems and inboxes that will open a convincing email. A ten-person firm with a weak sign-in is as easy to find as a large one, and often easier to get into.
The good news is that you do not need a security department to be hard to attack. A handful of well-chosen controls prevent many common attacks. This checklist covers them. Most items can be put in place within a few weeks, with modest cost, using tools you probably already pay for.
Strong sign-in
Stolen or guessed passwords are behind a large share of incidents. Use multi-factor authentication for email, remote access and administrators. A second factor, such as an app on a phone or a hardware key, means a stolen password alone is not enough.
- Multi-factor authentication is switched on for every email account, including shared mailboxes where possible.
- Remote access, such as VPNs and remote desktop, requires multi-factor authentication.
- Administrator accounts use multi-factor authentication and are separate from everyday user accounts.
- Cloud services holding business data, such as accounting, file storage and customer systems, require multi-factor authentication.
- A password manager is provided, so staff can use long, unique passwords without writing them down.
- Accounts are removed or disabled on the day someone leaves.
Patch and back up
Keep software updated and keep tested backups apart from the network. Updates close the holes attackers look for. Backups held separately mean that even if an attack succeeds, you can recover without paying anyone.
- Automatic updates are switched on for operating systems, browsers and common applications on every device.
- Routers, firewalls and other network devices are updated, and default passwords have been changed.
- Devices and software no longer supported by the vendor are replaced or isolated.
- Important data is backed up automatically, including data in cloud services.
- At least one backup copy is kept offline or in a form that cannot be altered from the main network.
- A restore has been tested in the last three months, and it worked.
Train people
Most attacks reach people before they reach systems. Teach staff to spot phishing and report it quickly. The goal is not perfection, which nobody achieves, but a team that pauses before clicking and speaks up early when something looks wrong.
- Everyone receives short security training when they join and a refresher at least once a year.
- Staff know the common warning signs: urgency, unexpected attachments, requests to change bank details and links that do not match the sender.
- There is one simple way to report a suspicious email or message, and reports receive a quick, appreciative response.
- Payment and bank detail changes are always confirmed by phone using a number already on file.
- People who click on something by mistake are encouraged to report it straight away, without blame.
Reward reporting, not perfection
If people fear blame, they hide mistakes, and a quick fix becomes a slow disaster. Thank anyone who reports a suspicious message or an accidental click. Early reports are the most valuable warning a small organisation has.
Be ready if something goes wrong
Even well-protected organisations have incidents. A one-page plan makes the first hours calmer and the damage smaller.
- A one-page incident plan lists who to call: IT support, insurer, bank and any legal or data protection contacts.
- Contact details are stored somewhere available even if email and file storage are down.
- Someone is named to make decisions during an incident, with a deputy.
- You know whether your insurance covers cyber incidents, and what it requires you to do.
Where to begin
If you can only do one thing this month, switch on multi-factor authentication for email and remote access. Then check that backups exist, are separate and can be restored. Those two steps address many of the most common ways small organisations are harmed.
Review the checklist every six months, or after any significant change such as a new system, an office move or a change of IT provider. Many small organisations also find it useful to work towards a recognised baseline certification, which gives an external check and can reassure customers and insurers.
Source: Intelliversal analysis.
