Start with business-critical systems
List the services that keep sales, delivery, finance and customer communication moving. For many small businesses this includes Microsoft 365, line-of-business software, banking, payroll, internet connectivity and supplier portals.
Protect identity
Require multi-factor authentication for every user and administrator. Remove shared accounts, review forwarding rules and keep privileged access separate from day-to-day accounts.
Prove recovery
Use independent Microsoft 365 backup where the business risk justifies it. Document retention, recovery times and who is authorised to restore data. Test representative mailbox and file restores.
Manage endpoints and response
Know every business device, keep it updated and encrypted, and use EDR. Where the business operates outside support hours or cannot tolerate delayed investigation, add MDR.
Control email and payments
Use advanced filtering, domain authentication and a human verification process for bank-detail or payment changes. Train staff to report suspicious messages quickly.
Prepare for an incident
Write a short response plan with named decision makers, suppliers, insurer details, legal and communications contacts. Exercise it before a real event.