Cybersecurity Best Practices for Small & Medium Businesses

1. Start by knowing what you have

You cannot protect what you do not know about. Build a simple inventory of your IT assets: every computer, laptop, server, printer, mobile device, router, firewall and software licence the business owns. Note who uses each device and what data lives on it. This one spreadsheet becomes the foundation for every other security decision — from deciding who needs admin rights to knowing what must be patched first.

2. Lock down user access

Weak or shared credentials remain the most common way attackers get in. Apply these rules across the business:

• Strong, unique passwords for every system — no shared passwords on the finance PC or the main email account.
• Multi-factor authentication (MFA) on email, banking, cloud services and VPN access. Even SMS-based MFA stops most credential-reuse attacks.
• Least privilege: give staff access only to what their role needs. Not everyone requires an admin account.
• Disable accounts promptly when employees leave, and change shared credentials they knew.

A free or low-cost password manager helps staff follow these rules without writing passwords on sticky notes.

3. Keep everything updated

Unpatched software is one of the easiest doors for attackers. Turn on automatic updates for operating systems, browsers and office software, and schedule regular update windows for servers and network devices. Your firewall and router firmware deserves the same discipline — RITE Solutions regularly sees firewalls protecting entire offices while running firmware years out of date.

4. Put proper network and endpoint defenses in place

Three layers cover most SME needs:

• A business-grade firewall at the internet edge, with intrusion prevention and web filtering enabled — not just the basic router your ISP supplied.
• Endpoint protection (antivirus plus endpoint detection and response) on every computer, centrally managed so you can see which machines are unprotected.
• Email security: spam and phishing filtering on your email service, plus policies that block risky attachments and scan links.

5. Train staff — phishing is the real front door

Most breaches begin with an email: a fake invoice, a courier notification, an urgent request from the "boss". Technology filters some of these, but people must catch the rest. Run short, plain-language awareness sessions and make the message simple: pause before clicking, verify unusual requests through a second channel, and report anything suspicious instead of hiding it. A short reporting habit beats a long rulebook.

6. Treat backups as your last line of defence

Ransomware only destroys businesses that cannot recover without paying. Keep regular, automated backups of your important data — and follow the discipline of keeping one copy off-site or in the cloud. Just as important: test restores occasionally. A backup you have never tested is a hope, not a plan.

7. Secure the network itself

A few low-cost measures make your office network far harder to abuse:

• Change all default passwords on routers, firewalls, switches, CCTV recorders and access points.
• Separate guest Wi-Fi from the office network so visitors never touch company systems.
• Use a VPN for remote access and for staff working from home, rather than exposing services directly to the internet.
• Restrict admin access to network devices so it works only from inside the office network.

8. Write down what to do when something happens

You do not need a corporate crisis plan — a single page is enough. Decide in advance: who gets called, how infected devices are isolated, which data must be recovered first, and who contacts the bank or regulators if needed. Rehearsing this once turns a panic into a procedure.

Quick security checklist

• Asset inventory is complete and up to date
• MFA enabled on email, banking, cloud and VPN accounts
• No shared or default passwords anywhere
• Automatic updates enabled; firewall firmware current
• Business firewall with intrusion prevention in place
• Endpoint protection on all computers, centrally visible
• Guest Wi-Fi isolated from the office network
• Backups automated, one copy off-site, restores tested
• Staff know how to spot and report phishing
• One-page incident response plan written and known