Cyber Security Checklist for UK Small Businesses: Cyber Essentials and Beyond

Cyber criminals do not only target banks and household names. For many attackers, a UK firm with twenty staff, a busy finance inbox and a website that has not been updated for a year is a far easier prize. A single convincing email asking accounts to change a supplier’s bank details can cost more than a year’s IT budget, and a ransomware infection can halt deliveries for days.

The good news is that most successful attacks exploit a small number of basic weaknesses. This checklist translates UK guidance, including the National Cyber Security Centre’s Cyber Essentials controls, into practical actions for small and mid-sized businesses, with a 90-day plan and a reminder of your legal duties if something does go wrong.

The threats UK small businesses meet most often

Phishing and credential theft

Emails and texts that imitate Microsoft, a courier, HMRC or a known supplier aim to steal passwords or deliver malware. Stolen credentials are then used to read mailboxes and launch further attacks.

Invoice and payment fraud

Often called business email compromise, this involves criminals intercepting or impersonating email conversations to redirect payments. It relies on persuasion rather than technical skill, which is why process controls matter as much as software.

Ransomware

Malicious software encrypts files and systems, followed by a demand for payment and sometimes a threat to publish stolen data. Unpatched systems and exposed remote access are common entry points.

Website compromise

Outdated content management systems and plugins can be exploited to deface sites, inject spam or skim card details from checkout pages.

Honest mistakes

Not every incident involves a criminal. Emails sent to the wrong recipient, spreadsheets shared publicly by accident and lost laptops are frequent causes of personal data breaches. Good defaults, such as encryption, link-sharing restrictions and delayed sending for external emails, reduce the impact of everyday errors.

Start with Cyber Essentials

Cyber Essentials is a UK government-backed scheme that certifies five technical controls. Even if you do not pursue certification immediately, the controls are an excellent framework:

Control	What it means in practice
Firewalls	Internet-facing devices and services are protected, with unnecessary ports and services closed.
Secure configuration	Default passwords changed, unused software and accounts removed, auto-run features disabled.
User access control	People only have the access they need; administrator accounts are separate and protected by MFA.
Malware protection	Anti-malware is active and up to date, or applications are restricted to approved software.
Security update management	Supported software only, with high and critical security updates applied within 14 days of release.

Cyber Essentials Plus adds independent technical testing. Certification is required for some UK government contracts and is increasingly requested by larger customers in their supply chains.

Checklist part one: people and accounts

• Turn on multi-factor authentication for email, Microsoft 365 or Google Workspace, banking, accounting software and any remote access.
• Provide a business password manager and discourage reuse of passwords across services.
• Use separate administrator accounts that are not used for everyday email or browsing.
• Run a joiners, movers and leavers process so access is granted, changed and removed promptly.
• Give staff short, regular awareness sessions using real examples of phishing and payment fraud.
• Agree a rule that any request to change bank details is verified by phoning a known contact on a number already on file.

A two-minute phone call to confirm a change of bank details is the cheapest fraud control a business will ever implement.

Make the rule easy to follow by writing it into your finance procedures and supplier onboarding forms, and tell suppliers about it so they expect the call. Senior staff should follow it too: criminals often impersonate directors precisely because junior colleagues feel uncomfortable questioning an urgent request from the top.

Checklist part two: devices, software and email

• Keep an inventory of laptops, phones, servers and network equipment, including who is responsible for each.
• Enable automatic updates where possible and replace devices and software that no longer receive security updates.
• Encrypt laptops and mobile devices and enable remote wipe.
• Configure SPF, DKIM and DMARC records for your email domains to make spoofing harder.
• Use your email provider’s built-in filtering and attachment scanning, and review its security dashboard.
• Restrict the installation of unapproved software and browser extensions.

Checklist part three: data, backups and recovery

• Know what important data you hold and where it lives, including in SaaS applications.
• Follow the 3-2-1 approach: three copies, on two types of storage, with one kept offline or immutable.
• Back up cloud services such as Microsoft 365 as well as on-premise systems; provider retention is not a full backup.
• Test restores at least quarterly and record how long recovery takes.
• Apply retention rules so you do not keep personal data longer than necessary.

When you test a restore, time it and write down the steps. In a real incident people are under pressure, and a short, tested procedure makes the difference between losing an afternoon and losing a week. Check that you can restore individual files, whole mailboxes and complete systems, because each needs a slightly different process. Finally, confirm that backup alerts actually reach someone: failed backups that nobody notices are one of the most common findings in small-business security reviews.

Checklist part four: websites, cloud services and suppliers

• Keep website platforms, themes and plugins updated, and remove anything unused.
• Protect admin logins with MFA, limit login attempts and use a web application firewall.
• Serve the site over HTTPS only and add security headers.
• Review cloud accounts for public storage buckets, unused keys and overly broad permissions.
• List suppliers with access to your systems or data, check their security arrangements and ensure contracts include data processing terms.

Give suppliers individual, named accounts rather than shared logins, limit their access to what they need, and review it at least twice a year. Remove access promptly when a contract ends. If a supplier manages your IT or website, ask how they protect their own administrator accounts, because a compromise at their end can quickly become a compromise at yours.

Our web development and cloud and DevOps teams can audit these areas and fix the gaps, working from London in UK hours with support from the wider engineering team of Creensight Private Limited in India for out-of-hours monitoring.

Securing remote and hybrid working

Many UK teams now split their week between home, office and client sites, which moves the security perimeter to every laptop and phone. A few measures make a disproportionate difference:

• Manage company devices centrally, for example with Microsoft Intune or a similar tool, so updates, encryption and screen locks are enforced rather than requested.
• Decide whether personal devices may access company data and, if so, under what conditions; many firms allow email and Teams on personal phones but block downloads of files.
• Replace old VPN appliances or exposed remote desktop services with modern, MFA-protected access, and keep whatever remains fully patched.
• Remind staff to treat public Wi-Fi with care and to lock screens in shared spaces such as trains and coworking venues.
• Make it easy to report a lost device immediately, with no blame attached, so it can be wiped quickly.

Home routers and printers are rarely managed by the business, so design on the assumption that the home network is untrusted: encrypted connections, strong device security and cloud services that check identity on every sign-in.

Your legal duties if an incident happens

Reporting personal data breaches

Under UK GDPR, if a breach of personal data is likely to result in a risk to people’s rights and freedoms, you must report it to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk to individuals is high, you must also tell the affected people. Keep an internal record of all breaches, including those you decide not to report.

Reporting crime and getting help

Fraud and cyber crime in England, Wales and Northern Ireland can be reported to Action Fraud; in Scotland, contact Police Scotland. The NCSC publishes incident response guidance for small organisations, and your cyber insurer, if you have one, will usually have a helpline you should call early.

Prepare a one-page incident plan

Write down who decides what, how to contact IT support and your insurer out of hours, how to isolate affected systems, and how you will communicate with staff and customers. Rehearse it once a year.

A useful rehearsal format is a one-hour tabletop exercise: a facilitator describes a realistic scenario, such as the finance mailbox being taken over on a Friday afternoon, and the team talks through what they would do minute by minute. These sessions regularly uncover practical gaps, such as nobody knowing the password to the domain registrar, or the only copy of the incident plan being stored on the system that has been encrypted. Keep a printed copy of key contacts somewhere safe offline.

A prioritised 90-day plan

Timeframe	Actions
Days 1–30	MFA everywhere it is available; payment verification rule; check backups exist and test one restore; update or remove unsupported software.
Days 31–60	Password manager roll-out; SPF/DKIM/DMARC; device encryption; staff awareness session; website and plugin updates.
Days 61–90	Supplier review; incident response plan; access review of admin accounts; Cyber Essentials self-assessment and certification.

Frequently asked questions

Is Cyber Essentials worth it for a small business?

For most SMEs, yes. The controls are practical and affordable, certification demonstrates good practice to customers, and it is required for some public sector work.

Do we need a full-time security person?

Rarely at SME scale. A combination of good defaults, a managed IT or development partner and periodic reviews is usually sufficient.

How often should we test our backups?

At least quarterly for critical systems, and after any major change to your infrastructure.

Can you check our website’s security?

Yes. We review platforms, plugins, hosting configuration and admin access, and can maintain the site afterwards. Our service packages include security hardening for new websites.

Strengthen your defences with Creensight UK

If you would like a practical review of your current security against Cyber Essentials and the checklist above, our team can provide a prioritised action plan and help implement it. Contact Creensight UK to book a review.