Cyber security basics: where to actually start

Most cyber security advice aimed at small businesses is either too generic to act on, or pitched at selling a product. Neither tells you what to actually do first. The good news is that the list of things that matter most is short, boring, and hasn't changed in years. It's just rarely presented as a priority order.

For most small and medium businesses it comes down to five things: a properly configured firewall on every network and device, devices set up securely rather than left on default settings, security updates installed quickly (not eventually), access and admin rights kept to the people who actually need them, with multi-factor authentication switched on, and anti-malware protection kept current. This isn't our list; it's the basis of the UK's Cyber Essentials scheme, precisely because these five areas account for the large majority of real-world compromises.

The hard part usually isn't knowing these five things matter. It's knowing which of them your business is actually missing, since "we're basically covered" and "we can prove we're covered" are two very different things. Run the free 5-minute readiness check to find out where the real gaps are.