Most IT disruption in small and growing businesses is not caused by sophisticated attacks. It comes from unpatched devices, shared passwords, untested backups and accounts that are never removed when people leave. Getting the basics right prevents most of it.
Turn on multi-factor authentication everywhere
Email and cloud accounts protected only by a password are the most common way in for attackers. Multi-factor authentication is free in Microsoft 365 and Google Workspace and takes minutes to enable.
Keep devices patched
Operating system and application updates close known security holes. Automating updates, and checking that they have actually been applied, removes a large share of risk.
Back up, and test the restore
A backup is only useful if you can restore from it. Test restores regularly, and keep at least one copy separate from your everyday systems.
Manage joiners and leavers
Create accounts from a checklist when people join, and remove access promptly when they leave. Keep a simple register of devices and licences.
Give staff one place to ask for help
When people know exactly how to raise an IT issue, problems are reported early and fixed before they spread.
None of these practices require large budgets. They require ownership: someone responsible for making sure they happen every week.
