TL;DR:

  • The first 90 days of a business are when security habits form — getting them right is much cheaper than fixing them later
  • Start with the basics that matter most: a password manager, MFA on email, a proper backup, and understanding your GDPR obligations
  • Cyber Essentials certification (from £300) gives small businesses a structured baseline and unlocks government contracts

When you’re starting a new business, cybersecurity feels like something to worry about later — after you have customers, after you’ve figured out the product, after there’s something worth protecting. This is understandable, and it’s also how most small business breaches happen.

Attackers don’t wait for you to get established. Newly registered UK businesses are routinely targeted within weeks of domain registration because they’re easy targets: generic email security settings, no multi-factor authentication, and usually someone holding a personal credit card attached to a business account. The good news is that setting up proper security foundations takes a few hours, not a few weeks, and most of it is free.

Here’s what to do, roughly in order of priority.

Week 1: Email and Account Security

Set up a business email address on your own domain. If you’re running a business from a Gmail or Hotmail address, you have no control over what happens to that account and no professional credibility. Google Workspace starts at £5/user/month; Microsoft 365 Business Basic is £4.90/user/month. Both give you email on your own domain, 1TB of cloud storage, and enterprise-grade security controls.

Enable multi-factor authentication (MFA) on everything. MFA means that even if someone steals your password, they can’t log into your accounts without a second factor — typically a code from an authenticator app on your phone. Enable it on:

  • Your email account (this is the most important one — email is the master key to everything else)
  • Your banking and accounting software
  • Your domain registrar account
  • Any software-as-a-service tools you’re using for the business

For the authenticator app, use Google Authenticator, Microsoft Authenticator, or Ente Auth (which backs up codes securely). Do not use SMS codes as your only second factor if you can avoid it — SIM swap fraud is real.

Install a password manager. Every account your business has should have a unique, long, randomly generated password. The only way to do this consistently is with a password manager. Bitwarden is free for individuals and has affordable team plans. 1Password Teams is popular and polished. Keeper is a strong option for businesses that want more administrative controls.

Set up a shared vault for business accounts that any staff member needs access to. Never share passwords via WhatsApp, email, or a shared spreadsheet.

Secure your domain registrar account. Your domain is a critical asset. If someone hijacks your domain, they can redirect your email, impersonate your website, and intercept anything sent to your business addresses. Ensure:

  • MFA is enabled at your registrar (GoDaddy, Namecheap, 123-reg, etc.)
  • Domain auto-renewal is turned on
  • Domain lock is enabled (prevents unauthorized transfers)

Month 1: Email Authentication and Backups

Set up SPF, DKIM, and DMARC on your email domain. These three DNS records tell the world’s email servers how to handle email that claims to be from your domain. Without them, criminals can send convincing phishing emails that appear to come from your business address — targeting your customers, suppliers, or staff.

  • SPF — lists which servers are authorized to send email for your domain
  • DKIM — adds a cryptographic signature to your emails proving they’re genuine
  • DMARC — tells receiving email servers what to do with messages that fail SPF/DKIM checks

If you’re using Google Workspace or Microsoft 365, both provide setup instructions in their admin consoles. The NCSC’s Email Security Check tool (available free at check.ncsc.gov.uk) will verify your setup once it’s done. This takes around an hour and makes it significantly harder for criminals to impersonate you.

Set up a backup. What would happen to your business if your laptop was stolen tomorrow? If the answer is “I’d lose everything,” that’s the problem to solve.

A minimal backup setup for a sole trader:

  • Enable cloud sync for your documents (Google Drive or OneDrive, both included in business email plans)
  • Set up Time Machine (Mac) or Windows Backup to an external hard drive kept at a different location from your laptop
  • Export and back up any critical data from SaaS tools (QuickBooks data, customer databases, etc.)

For a more robust setup, use a dedicated backup service like Backblaze Business (~£7/month per device) for continuous encrypted cloud backup of your whole laptop.

Register with the ICO for data protection. If you handle any personal data — customer names and emails, supplier contacts, employee records — you’re legally required to pay the Information Commissioner’s Office (ICO) data protection fee. For most small businesses, this is £40/year (Tier 1). Failing to register is a £4,000 fine. Register at ico.org.uk — it takes 10 minutes.

Month 2: Devices and Remote Access

Keep software updated — automatically. Outdated software is the most common way attackers get into small business systems. Enable automatic updates on:

  • Your laptop and desktop operating systems (Windows Update or macOS automatic updates)
  • Your web browser
  • Any software you use regularly (Zoom, Slack, accounting software, etc.)
  • Your router firmware (most routers have an auto-update option in the admin panel)

Secure your Wi-Fi router. Your office or home router is the gateway to your network. At minimum:

  • Change the default admin password (it’s usually printed on the label — criminals know these defaults)
  • Set the Wi-Fi password to something long and random (not the name of your business)
  • Enable WPA3 encryption if your router supports it; WPA2 is acceptable, WEP is not

If you have any smart home or IoT devices (cameras, printers, smart TVs) on the same network as your work devices, consider putting them on a separate guest network.

Separate work and personal devices where possible. If you’re using a personal laptop for business, at minimum create a separate browser profile for business use and don’t store business files in your personal cloud storage. A dedicated work laptop removes a significant category of risk — personal devices often have more software installed, less patch discipline, and sometimes shared access with family members.

Month 3: Building on the Basics

Consider Cyber Essentials certification. Cyber Essentials is a UK government-backed certification that assesses five basic controls: secure configuration, access control, software updates, malware protection, and network firewalls. For a sole trader or small business, the self-assessment version costs around £300–£400 through an accredited body.

Benefits:

  • Demonstrates to customers and partners that you take security seriously
  • Required for any contracts involving government data or handling of personal information on behalf of the government
  • Includes Cyber Liability Insurance for UK businesses turning over less than £20M/year (cover up to £25,000)

The assessment is a self-assessment questionnaire. Being well-prepared takes a few hours if you’ve implemented the basics above.

Think about your supply chain exposure. If you use accounting software, a website platform, or any SaaS tool that holds your data or your customers’ data, you’ve introduced supply chain risk. Make a list of which third-party services hold:

  • Customer data (names, emails, contact details)
  • Financial data
  • Login credentials for other systems

For each, check that you have MFA enabled, that you know the provider’s breach notification process, and that you know how to export and delete your data if you need to leave.

Know how to report a cybersecurity incident. If something goes wrong — a phishing attack, ransomware, a compromised account — knowing who to call saves time:

  • NCSC (National Cyber Security Centre) — report incidents at ncsc.gov.uk/report-a-cybercrime, free advice line for SMEs
  • Action Fraud — UK’s national fraud and cybercrime reporting centre, 0300 123 2040
  • ICO — if personal data is involved, you may have a 72-hour obligation to notify them (check ico.org.uk for current guidance)

Most cyber insurance policies also require you to notify your insurer before taking significant remediation action — keep that number handy too.

The Free Resources Worth Bookmarking

  • NCSC Small Business Guide — ncsc.gov.uk/smallbusiness — the official baseline, updated regularly
  • Cyber Essentials — cyberessentials.ncsc.gov.uk — self-assessment framework and certification
  • Have I Been Pwned — haveibeenpwned.com — check if your business email addresses appear in known breaches
  • Email Security Check — check.ncsc.gov.uk — verify your SPF/DKIM/DMARC setup instantly

Security doesn’t have to be expensive or complicated when you’re starting out. The basics above, properly implemented, protect you against the vast majority of threats that target small UK businesses.