Contents
Short answer
Don’t prioritise by products but by your business-critical systems and biggest gaps. First close basic gaps such as missing MFA, untested backups and outdated systems, use existing features and organisational measures, and only then invest in specialist solutions. There is no universal amount or percentage.
Start with the right questions
Business-critical systems
Which systems do you need to work, deliver and invoice?
Important data
Which data would be especially problematic to lose or expose?
Existential outages
Which outage would be unbearable for several days?
External access
What access exists from outside – remote access, cloud, providers, online shop?
Missing basics
Which basic measures are still missing today?
Organisational fixes
Which risks can be reduced through rules instead of expensive technology?
Simple budget questions
- 1
What would stop us first after an outage?
That is usually where the highest priority lies.
- 2
Which gap is easiest to exploit right now?
For example an account without MFA or an unpatched internet-facing system.
- 3
Which measure reduces several risks at once?
MFA or tested backups often help against several scenarios.
- 4
Which basic feature do we already pay for but not use?
Licences often include security features that are not switched on.
- 5
What can we solve organisationally?
Clear responsibilities and approval rules mainly cost time.
- 6
Where do we lack in-house know-how?
External support may make more sense there than another product.
- 7
Which measures need ongoing care?
Plan time and cost for operation and monitoring – not just purchase.
Priority levels in the Cyberschutz.io level model
| Level | Examples |
|---|---|
| Level 1 – baseline protection | MFA, updates, backups, device protection, password management, restricted admin rights |
| Level 2 – extended protection | Email security, device management (MDM), monitoring, security awareness, cloud backup, incident plan |
| Level 3 – higher dependency or higher risk | EDR/MDR, SIEM, WAF/DDoS protection, extended monitoring, business continuity, supplier management |
Step by step
- 01
Identify what’s critical
List business-critical systems, important data and external access.
- 02
Check baseline protection
Review the level 1 measures and note gaps.
- 03
Activate what you have
Switch on paid-for but unused features and settle organisational matters.
- 04
Rank gaps by impact
Prioritise using the budget questions, not product offers.
- 05
Plan running costs
Account for operation, maintenance and external support where needed.
- 06
Review yearly
Reassess after changes in the business or after incidents.
Invest by impact
Before expensive specialist solutions, check whether basic gaps exist. Example: a small business without MFA, with untested backups and outdated systems should not automatically start with a complex SIEM. This is an example, not a fixed rule – depending on sector, dependencies and requirements, a different order may make sense.
Organisational, existing or additional?
What falls into which group depends on your existing environment and licences.
Organisational
Assign responsibilities, reduce admin rights, payment approval rules, incident plan.
Existing features
MFA, device encryption, built-in device protection, logging – where included in your systems and licences.
Additional investment
Backup solution, professional email security, MDM, EDR/MDR, external security support.
Checklist
- Business-critical systems and data are known.
- Gaps in baseline protection are documented.
- Existing security features are checked and switched on.
- Organisational measures are in place.
- Additional investments are prioritised by impact.
- Ongoing care is planned in terms of people and budget.
Common mistakes
- Starting with an expensive specialist solution while basics are missing.
- Deciding by product offers instead of your own risks.
- Planning only purchase costs, not operation.
- Overlooking features already included in licences.
- Adopting a blanket budget ratio that doesn’t fit your business.
Frequently asked questions
How much should we budget for cybersecurity?
There is no universal amount or ratio. What matters is your dependency on IT, your data and your existing gaps.
Where should we start?
In many small businesses with level 1 baseline protection. This is guidance, not a guarantee that this order is right in every case.
Do we need EDR or a SIEM?
It can make sense with higher dependency. First check whether basics are missing and whether you can operate it.
What can be improved without extra cost?
Often admin rights, payment approvals, the incident plan and already-licensed features such as MFA – depending on your environment.
Does this replace a risk assessment?
No. It helps you get started but is not a binding risk assessment.
Sources
- BSI – Cyber security for SMEs: the top 14 questions (German, 3rd edition, PDF)
- ENISA – Cybersecurity guide for SMEs: 12 steps (2021)
Checked on 7 October 2026.
The levels are editorial guidance – not a certification, score or binding risk assessment. No measure guarantees that an attack is prevented.