How to protect a small business from cyberattacks

To protect a small business from cyberattacks, start with the basics, which cover most cases: multi-factor authentication on email and remote access, tested backups kept off the network, up-to-date software, phishing training, the minimum permissions needed, and a written plan for what to do if an incident happens.

Why small businesses are targets too

A small business is not "too small to be interesting". The UK's National Cyber Security Centre (NCSC) states in its guide for small organisations that small businesses are just as likely to experience online crime as larger ones, and that one in two suffers a cyber incident every year (a figure for the UK) [1]. It is not a figure for your country, but it describes a reality that does not depend on geography: attackers automate and look for the easy target.

ENISA's threat report points the same way: in the incidents it analysed, phishing (60%) and vulnerability exploitation (21.3%) were the two leading entry points [2]. Both are reduced by inexpensive measures.

The ten measures with the most return

All are backed by public guidance from reference bodies. CISA summarises four basic behaviours for everyone: avoid and report phishing, use strong passwords, use multi-factor authentication and a password manager, and update software [3]. The other measures complete the picture.

1. Multi-factor authentication (MFA) on email, remote access, admin tools and banking [3].
2. Unique passwords with a password manager. No reuse [3].
3. Updates for systems, applications, router and devices, with automatic updates switched on [3].
4. Backups of what you cannot lose, with an off-network copy and a periodic restore test. CISA includes making backups among the six elements of its Cyber Essentials guide for small businesses [4]; the NCSC advises not leaving the backup device connected when not in use, keeping it somewhere secure, and checking that it contains all your important data and that you know how to restore it [5].
5. Protected email and key accounts: filters, MFA and review of forwarding rules. The NCSC has sections on securing your email and your important online accounts [1].
6. Least privilege: each person accesses only what they need; administrators use separate accounts. Cyber Essentials frames it as ensuring only those who belong have access to the digital workplace [4].
7. Inventory of devices, accounts and data. CIS defines Implementation Group 1 of its controls as "essential cyber hygiene" and says every enterprise should start there [6].
8. Phishing training for the whole team, with real examples and an easy way to report. Cyber Essentials frames it as developing staff awareness and vigilance [4].
9. A one-page incident response plan: who to call, what to isolate, how to communicate. Cyber Essentials frames it as limiting damage and speeding restoration [4].
10. Risk analysis and a security master plan. INCIBE's decalogue for companies starts there and also covers access control, backups, protection tools, updates, communications, information protection, business continuity and training [7].

Checklist

Print it, assign an owner to each item and review it every quarter.

• Pending: MFA enabled on email, VPN/remote access and admin consoles
• Pending: Password manager in use; no passwords shared by email or chat
• Pending: Automatic updates on for computers, phones and the router
• Pending: Backup of critical data with an off-network copy
• Pending: Backup restore tested in the last 6 months
• Pending: Everyone accesses only what they need; separate admin accounts
• Pending: Up-to-date inventory of devices, applications, accounts and suppliers
• Pending: Phishing training done this year and a clear way to report
• Pending: One-page incident response plan, with contacts, printed
• Pending: A person in charge of cybersecurity named, even if part-time
• Pending: Basic risk analysis done and reviewed every year

A reasonable order (indicative)

An illustrative case: a small business with the checklist in hand

An illustrative case, not a real company. A professional-services small business with no IT department prints the checklist and goes through it.

• This week: it finds that email has no MFA and that two people share an admin password. It turns on MFA for email and remote access and separates the admin accounts.
• This month: its only backup sits on a disk that is always connected to the server. It adds an off-network copy and runs the first restore test, which fails on one folder; it fixes it in time.
• This quarter: it builds an inventory, runs a phishing-awareness session with a clear way to report, and writes a one-page response plan with the contacts printed.

If someone later clicks a fake link, MFA hampers the use of the stolen password and the plan says whom to call. It is not a guarantee, but each item closes one way in.

When it makes sense to ask for outside help

• You handle sensitive data or your customers ask for security evidence.
• You need continuous monitoring and cannot have someone watching alerts (see managed SOC, SOCaaS / MDR).
• You want to know what an attacker sees of your domain: you can ask about places in the external radar.
• You are worried about ransomware: see ransomware protection and response and Ransomware in 2026: trends and protection.
• You want to train the team with real cases: cybersecurity training and awareness.
• You need to organise regulation and evidence: GRC and regulatory compliance consulting.

For the Spanish regulatory framework and a step-by-step on a tight budget, there is also the guide Cybersecurity for SMEs in Spain: where to start without a large-enterprise budget. And if your business manages critical suppliers, get to know HodeiShield.

Frequently asked questions

How to protect a small business from cyberattacks?

Start with the basics. If you had to pick one measure: multi-factor authentication on email and remote access, together with tested backups. Both appear among the basic behaviours and elements recommended by CISA [3] and the NCSC [1].

How much does it cost to protect a small business?

The basic measures (MFA, updates, password manager, training and a response plan) cost little or nothing; costs rise with continuous monitoring, external testing and regulatory compliance. There is no figure valid for everyone: it depends on your size, sector and the data you handle.

What do I do if I have already been attacked?

Isolate the affected devices from the network, change credentials from a clean device, restore from verified backups and notify whoever needs to know. The NCSC maintains a response and recovery guide for small organisations [1] and, in Spain, INCIBE offers the 017 helpline for cybersecurity queries, reports and incidents [8]. Having the plan written beforehand speeds everything up.

Does a cloud backup protect me against ransomware?

Not necessarily: a permanently connected backup can be affected, and the NCSC warns that some viruses also affect devices connected to an infected computer [5]. Aim for a disconnected or isolated copy and a tested restore.

Does my business need to comply with NIS2 or the ENS?

It depends on your sector, size and customers. If you are not sure, see our NIS2 compliance solution or ask a specialist.

Next step

Do you want a quick diagnosis and a roadmap tailored to you? Talk to the Hodeitek team.

Sources

1. Small Business Guide. UK NCSC. https://www.ncsc.gov.uk/collection/small-business-guide
2. ETL 2025: EU consistently targeted by diverse yet convergent threat groups. ENISA, 2025-10-01. https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups
3. Secure Our World. CISA. https://www.cisa.gov/secure-our-world
4. Cyber Essentials. CISA. https://www.cisa.gov/resources-tools/resources/cyber-essentials
5. Backing up your data (Small organisations guide to cyber security). UK NCSC. https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data
6. CIS Controls Implementation Groups. Center for Internet Security. https://www.cisecurity.org/controls/implementation-groups
7. Decálogo de ciberseguridad para mejorar el nivel de protección de tu empresa. INCIBE, 2024-02-13. https://www.incibe.es/empresas/blog/decalogo-de-ciberseguridad-mejora-el-nivel-de-proteccion-de-tu-empresa
8. Línea de Ayuda en Ciberseguridad 017. INCIBE. https://www.incibe.es/incibe/registro-actividad/linea-ayuda