Small business cyber security checklist (UK)

By the Grow & Guard editorial team · Last updated · 10 min read

You do not need a big budget to make your business a much harder target. This checklist puts the most effective steps first, drawing on guidance from the UK's National Cyber Security Centre (NCSC).

Ad This page contains affiliate links, marked Ad. If you buy through one we may earn a commission, at no extra cost to you. Commission does not decide our rankings. How we make money and how we rank.

3D illustration of a security shield with a padlock, a key and a password field

The checklist

#StepCost
1Turn on two-factor authentication (2FA) for email, banking and key accountsFree
2Use a password manager and unique passwordsFree to a few pounds a month
3Keep devices and software updated automaticallyFree
4Back up important data, with one copy kept separateFree to low cost
5Protect against malwareOften built in
6Train everyone to spot phishingFree
7Secure your website, domain and hosting loginsFree
8Lock down devices and use encryptionFree
9Control who has access to whatFree
10Be careful on public Wi-FiFree to low cost
11Have a simple plan for when things go wrongFree
12Consider Cyber Essentials certificationFrom £320 + VAT for micro businesses

1. Turn on two-factor authentication

Two-factor authentication (2FA) means a stolen password alone is not enough to get into your account. Start with your email, because whoever controls your email can reset everything else. Then do banking, your domain registrar, hosting, website admin, accounting software and social media. An authenticator app is stronger than text messages.

2. Use a password manager

Every account should have its own long, unique password. A password manager creates and remembers them for you and lets you share logins with staff safely. The NCSC also suggests using three random words for passwords you need to remember. Compare options in our password manager guide.

3. Keep everything updated

Updates fix security holes that attackers actively exploit. Turn on automatic updates for operating systems, browsers, apps and phones, and replace devices that no longer receive updates. If you run WordPress, keep core, themes and plugins updated.

4. Back up your data

Ransomware and accidents both make backups essential. Identify what you could not work without, back it up automatically and keep at least one copy separate from your main systems, for example in a cloud service with version history or on a drive you disconnect after backing up. Test that you can actually restore a file.

5. Protect against malware

Modern Windows and macOS include built-in malware protection; make sure it is switched on. Only install apps from official stores or trusted sources, and do not use pirated software.

6. Spot phishing

Most attacks start with a convincing email, text or call. Warning signs include urgency, unexpected attachments, requests to change bank details and links to login pages. Always verify payment or bank detail changes by phoning a number you already have, not one in the message.

  • Forward suspicious emails to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service.
  • Forward suspicious texts to 7726.

7. Secure your website and domain

  • Use unique passwords and 2FA on your domain registrar, hosting and website admin.
  • Turn on auto-renew for your domain and keep contact details current.
  • Keep daily backups of your website and make sure HTTPS is on.
  • Set up SPF, DKIM and DMARC records so criminals find it harder to send email pretending to be you.

Choosing a host? Backups and security are part of our best web hosting UK comparison.

8. Lock down devices

Use a PIN, password or biometrics on every laptop and phone, turn on device encryption (BitLocker on Windows, FileVault on Mac, which are built in) and set up "find my device" so you can lock or wipe a lost phone.

9. Control access

Give each person their own account rather than sharing logins, only give admin rights to those who need them and remove access promptly when someone leaves. Do not use an admin account for everyday work.

10. Be careful on public Wi-Fi

Most websites now use HTTPS, which protects what you send, but public Wi-Fi can still be risky. Use your phone's hotspot or a reputable VPN for sensitive work on the move. See the best VPN UK you can pay monthly.

11. Plan for when things go wrong

Write down, on one page: who to call (your bank, IT help, hosting company), where backups are, how to reset key accounts and how to tell customers if their data is affected. If personal data is breached, you may need to report it to the ICO within 72 hours. Report fraud and cyber crime to Report Fraud (or Police Scotland on 101 in Scotland).

12. Consider Cyber Essentials

Cyber Essentials is the government-backed certification scheme covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. It shows customers you take security seriously and is required for some public sector contracts. IASME, which delivers the scheme, lists self-assessment certification from £320 plus VAT for organisations with up to 9 employees. The NCSC's free Small Business Guide is a good place to start.

This checklist is general guidance. For more detail, see the NCSC's Small Business Guide and Cyber Aware advice.

Sources we checked

All checked on 1 November 2026. Prices and features change, so confirm on the provider's site before you buy.

Frequently asked questions

What is the most important cyber security step for a small business?
Turning on two-factor authentication for your email and other key accounts, combined with unique passwords from a password manager, stops many of the most common attacks.
How much does Cyber Essentials cost?
IASME lists Cyber Essentials self-assessment from £320 plus VAT for organisations with up to 9 employees, rising with organisation size. Cyber Essentials Plus, which includes a technical audit, costs more.
Where do I report a phishing email in the UK?
Forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726.