Many small business owners start their security planning by asking which software to buy. Security professionals tend to begin with a simpler question: what needs protecting, and who is responsible for looking after it?
Antivirus is a sensible starting point. But it cannot fix an outdated router, remove a former employee's access or recover a website when the backup fails.
For charities, retailers and businesses whose websites connect to payment gateways, customer databases and internal systems, protection has to reach beyond the website itself. The laptops, accounts, hosting and connections behind it all matter.
The most reliable approach is to start with the basics, check that they actually work and give someone clear responsibility for keeping them working. The UK's National Cyber Security Centre takes the same view in its Small Business Guide, which sets out low-cost steps any firm can take.
1. Start with antivirus and the devices people use
Every computer used for business needs checking, including personal laptops that access company systems. Malware protection should be active, up to date and acted on when it raises an alert.
An installed application is not proof of protection. Its status needs checking directly.
The device's firewall, automatic screen locking and disk encryption should all be switched on. Recovery keys should be stored securely and remain accessible to the business if a device is lost or an employee leaves.
The check: Can the business confirm that every work computer has working malware protection, its firewall enabled and encryption switched on?
2. Update more than Windows or macOS
Updates need to cover browsers, applications, phones, routers and anything else connected to the network. Equipment that no longer receives security updates needs a replacement plan.
The same principle applies to websites: the content management system, plugins and underlying server software. Updating WordPress while leaving an unsupported PHP version running underneath leaves part of the job unfinished.
Updates work best alongside backups and checks that important functions still work afterwards. A security update should not quietly break a checkout or donation form.
The check: Which devices or systems are overdue an update, and which are no longer supported?
3. Check the router and separate guest Wi-Fi
A router deserves the same attention as a laptop. Default administrator credentials should be changed, firmware kept up to date and WPA2 or WPA3 wireless security used.
Visitors belong on a guest network that cannot reach business devices. Where practical, connected cameras and other smart equipment should be kept separate from computers holding sensitive information.
Remote router administration is worth checking too, along with whether anyone actually needs it. Providers can explain unfamiliar settings before anything is changed.
The check: Can a visitor using the Wi-Fi reach office computers, shared storage or router settings?
4. Secure remote access
For a remote-first business, the security boundary extends well beyond an office.
A list of the tools staff use to connect remotely is a good start. Unused remote-control software should be removed, and remote desktop services should never be exposed directly to the internet. A properly configured remote-access service with multi-factor authentication is the safer route.
A VPN can protect a connection, but it does not make an infected laptop safe. The device and the account still need protection.
The check: Can the business explain how each team member connects to its systems, and revoke that access quickly?
5. Protect accounts and remove unnecessary access
Email comes first, followed by hosting, domain registration, finance and administrator accounts. Each should have multi-factor authentication and a unique password stored in a password manager.
Individual accounts are better than shared logins, which make it harder to see who changed something or to remove one person's access.
Access should match each person's current responsibilities. Reviews should include former employees, agencies and temporary developers.
The check: Does everyone with administrator access still need it, and are the most important accounts protected by multi-factor authentication?
6. Treat the website as part of the business
A website may sit outside the office network, but it can still connect directly to customers, payments and operations.
Where websites link to commerce systems, website security belongs in the wider business security conversation.
Protection can include Cloudflare filtering, Wordfence on WordPress, server-side malware protection, backups and monitoring. These serve different purposes, and none removes the need to maintain the application underneath.
Integrations need reviewing too. Unused connections should be removed and each integration limited to what it needs.
The check: Who maintains the website, hosting and integrations, and where is that responsibility written down?
7. Test a backup before it is needed
"The hosting company probably does that" is not a recovery plan.
Businesses should identify the information they cannot operate without: customer records, orders, documents, website files and databases. Then check how often it is backed up and how much recent work could be lost.
A protected copy should be kept separate from the live system, with offline or otherwise isolated protection against ransomware. The final step is to restore something and check it opens correctly.
For a shop or charity, recovery means getting transactions working again, not simply bringing back the homepage.
The check: When was a backup last restored successfully, and how long did it take?
8. Make suspicious requests easy to report
Staff need a clear route for reporting an unexpected login prompt, suspicious attachment or unusual payment request.
Early reporting should be encouraged, including when someone has already clicked. Fear of blame can turn a manageable problem into a longer incident.
Changes to bank details should be verified through a known contact number, never the number supplied in the message requesting the change.
The check: Would everyone know whom to contact, and feel comfortable doing so immediately?
9. Check who receives security alerts
Monitoring only helps when someone responds.
Alerts for malware, failed backups, unusual logins and website problems should reach a person who knows what action to take, with cover when that person is unavailable.
Uptime monitoring alone is not enough. A website can be online while an account has been compromised.
The check: Who receives each important alert, and who covers their absence?
10. Put ownership and recovery on one page
Essential systems, responsible people and emergency contacts should all be recorded in one place, including the hosting provider, IT support and whoever controls the domain and email.
A copy should stay accessible if company email stops working. Businesses should also agree who can authorise recovery work and how staff will communicate during an outage.
The check: If a key system stopped working tomorrow, could the team find the right contacts and begin responding?
Make the checklist a routine
The best place to start is with the checks that cannot be answered confidently. Each gap needs an owner and a deadline, and the list should be revisited monthly and whenever people or systems change.
Business owners do not need to become security specialists to ask useful questions. They do need evidence that the basics are working.
Rehan Ahmed is Director of Smart Web Agency, an Ashford-based web agency working with charities, retailers and international organisations. He has more than a decade of experience in software delivery, website development and connected business systems.