Cyber security is sometimes treated as a problem for large organisations with specialist IT departments. In reality, smaller businesses can be particularly vulnerable because they often have fewer resources available to detect an attack and recover afterwards.
The Government continues to strengthen its approach to cyber resilience, including the planned Cyber Security and Resilience Bill. However, individual businesses can take several practical steps now.
Start by asking what would happen if staff could not access the accounting system, customer records or email tomorrow morning.
Backups are essential, but having a backup is not enough. Businesses should periodically test whether important data can actually be restored.
Access controls also matter. Multi-factor authentication should be used wherever possible, particularly for email, banking, accounting software and other systems containing sensitive information.
Employees remain another important line of defence. A convincing email asking for an urgent payment or a change of bank details can bypass sophisticated technology if the recipient acts without checking it independently.
Businesses should therefore have simple procedures for verifying unusual payment requests and any change to supplier bank details. It is also worth preparing for what happens after an incident.
Keep contact details for IT support, insurers and other key advisers somewhere that can be accessed if the main computer network is unavailable. Decide who will take responsibility for communicating with staff, customers and suppliers.
Cyber security does not require every business owner to become a technology expert. However, it does require preparation.
A short discussion about what the business would do if its systems became unavailable can quickly expose weaknesses that are relatively inexpensive to correct today. The aim is not to guarantee that a cyber-attack will never succeed, but to ensure that one incident does not bring the entire business to a halt.
