If you run a small business, you may feel that serious cybersecurity is something only larger companies can afford. The reassuring answer is that a great deal of protection comes from how you manage people rather than from what you spend on technology. Most incidents involve a human decision at some point, whether a rushed click, a shared login or an account left open after someone has left. Get the people side right and you deal with much of the risk before you have bought anything.
Start with the people who handle your most important information
You cannot protect everything equally, so begin by thinking about who has access to the information that would cause the most harm if it were lost or misused. That is usually a small group: whoever handles payments, payroll, customer records or your main email accounts. Talk to those people first. Make sure they understand what they are responsible for, the scams most likely to target their role, and who to ask when something looks unusual. A focused conversation with three or four key people is worth more than a generic session with everyone.
Give someone clear ownership
In many small businesses, cybersecurity belongs to everyone, which in practice means it belongs to no one. Name a person who is responsible for keeping an eye on it. This does not need to be a technical specialist and it need not take much time. Their job is to make sure the basics are being followed, to be the person colleagues ask when unsure and to keep the subject on the agenda. Having a named person also means there is somebody to call quickly when something goes wrong, rather than a debate about whose problem it is.
Get joiners, movers and leavers right
Some of the most avoidable risks arise when people join, change roles or leave. A new starter should receive only the access they need, along with a short explanation of your expectations. Someone who moves to a different role should have their old permissions removed rather than simply adding new ones on top. When someone leaves, close their accounts and collect their equipment on their last day, and change any shared passwords they knew.
This costs nothing except a consistent routine, and it matters a good deal. Former employees who retain access, whether through oversight or resentment, are a well-known source of data loss. A simple checklist for each stage, kept alongside your other HR paperwork, makes sure nothing is forgotten.
Put your expectations in writing
Staff cannot follow rules they have never seen, and you will find it difficult to deal fairly with a serious lapse if the expectations were never made clear. Include clear provisions on confidentiality and data protection in your employment contracts, and set out sensible rules in a short handbook or policy. These might cover acceptable use of company equipment and email, whether personal devices can be used for work, how to handle customer information and what to do if something goes wrong.
Be clear, too, about how a breach of these rules would be handled under your disciplinary procedure. Most mistakes are honest ones and are better handled through guidance and support than through sanctions, but deliberate or repeated disregard of the rules is a conduct matter and you should be able to treat it as one. If you plan to monitor staff use of systems, tell them in advance what you will monitor and why, as this raises data protection obligations of its own.
Use the free help that already exists
You do not have to design all this from scratch. The National Cyber Security Centre publishes free guidance written for small organisations, including practical advice for staff and a free training package on cyber security. Its Small Business Guide is written in plain English and is suitable for sharing with your team. It is also worth telling staff about Report Fraud, the national police service for reporting cyber crime and fraud, so they know where to take a scam. Setting aside a little time each month to read a page of the NCSC guidance and pass on the key points costs you nothing but attention.
Spend small amounts where they count
When the budget is tight, prioritise spending that supports your people over anything glamorous. Paying for a password manager so nobody has to memorise or reuse logins, or for a short course for the person you have named as responsible, is money well spent. So is a modest amount of time to work through the government-backed Cyber Essentials requirements, which give you a clear checklist and, if you choose to certify, something to show customers. Setting aside a small, regular sum each year for security, however modest, is better than a large one-off purchase followed by neglect.
Decide in advance who does what when it goes wrong
Even well-run businesses face incidents. What limits the damage is often speed and clarity rather than technical skill. Agree now who makes the decisions, who speaks to staff and customers, and what everyone else should do in the meantime. Make sure your team knows to report a problem straight away and that they will be supported for doing so. Staff who fear blame tend to delay, and delay is what turns a small incident into a big one.
The short version
Protecting a small business does not depend on a large budget. It depends on knowing who has access to what, giving someone ownership, managing people in and out of the business carefully, setting clear written expectations and making use of the free help available. Each of these is a matter of good people management, and each can start this week.
If you need any further advice on ways you can protect your business from cyber threats, do get in touch.