Security measures for small businesses
For small businesses, a few consistently applied basics matter most. Much is already included in existing licences. We explain tool types – no rankings and no ad links.
Orientation in three stages
Stage 1
Basic protection
- MFA
- Updates
- Backups
- Device protection
- Password management
- Admin rights
Stage 2
Extended protection
- Email security
- MDM
- Cloud backup
- Monitoring
- Awareness
- Incident plan
Stage 3
Higher dependency / higher risk
- EDR / MDR
- SIEM
- WAF / DDoS
- Extended monitoring
- Business continuity
- Supplier management
Orientation only – not a certification, score or binding risk assessment. Which measures your business needs depends on IT dependency, data and sector.
Topics in depth
- MFA, passkeys and password management for businesses
- Protecting endpoints: endpoint protection, EDR and MDR
- Email security and phishing protection
- Business backups and recovery
- Securing Microsoft 365 and Google Workspace
- Securing devices, phones and administrator access
- Network, firewall, DNS and secure remote access
- Protecting business websites and online shops
- Monitoring, logging and early attack detection
- Cyber incident planning, suppliers and safe AI use
Not every small business needs every tool. Each measure is therefore placed – from basic to relevant with higher risk.
Identities and access
MFA and passkeysSecond factor for email, cloud, banking, shop back end and admin access.Basic
Included free in almost every service. Prefer phishing-resistant methods (passkey, security key) for admin accounts and document exceptions.
Password managementManage shared logins by role – not in spreadsheets or chats.Basic
A team password manager allows per-person sharing and clean removal when someone leaves. For one-person businesses a good individual manager can be enough.
Admin rights and least privilegeWork without admin rights day to day; keep admin accounts separate and protected.Basic
Everyone gets only the rights they need. Separate admin accounts not used for email reduce the risk that one phishing click opens the whole system.
Securing Microsoft 365 / Google WorkspaceReview security defaults, sharing and sign-ins of your office cloud.Useful as IT grows
Many protections are included in licences but not switched on: enforced MFA, blocking legacy sign-in, rules for external sharing and alerts on suspicious sign-ins.
VPN and Zero Trust – contextGrant remote access to internal systems selectively, not wholesale.Relevant with higher risk
A classic VPN often opens the entire network. Zero-trust approaches check every access by person, device and context. Cloud-only businesses without internal servers often need neither.
Devices and endpoints
Endpoint protectionMalware protection on every work device, visible centrally.Basic
Built-in protection of modern operating systems is a solid base. Centrally managed solutions help once several devices are in use.
Patch managementUpdates for systems, applications, routers, shop software and plugins.Basic
Automatic updates where possible, a fixed rhythm for the rest. Especially critical: internet-facing systems such as the shop, VPN or remote maintenance.
Device encryptionEncrypt laptops and phones – a loss then usually stays a hardware loss.Basic
Included in all common operating systems. Store recovery keys centrally and separately from the device.
Mobile device management (MDM)Set up devices centrally, enforce policies and lock them on loss.Useful as IT grows
Worth it once you have several employees or personal devices used for work. Sometimes included in office licences.
EDREndpoint detection and response spots suspicious behaviour, not just known malware.Relevant with higher risk
EDR records activity on devices and enables fast response. Only useful if someone actually reviews the alerts – otherwise MDR is the better fit.
MDRManaged detection and response: a provider monitors and responds for you.Relevant with higher risk
For businesses without their own security team whose operations depend heavily on IT. Important: agree response times, authority and availability in the contract.
Email and communication
Spam and phishing protectionUse your mail provider's filters and define a route for reporting suspicious messages.Basic
Basic filters are included in business mailboxes. In addition: tag external email and offer a simple way to report suspicious messages.
Email securityAdvanced checking of attachments and links; SPF, DKIM and DMARC for your domain.Useful as IT grows
SPF, DKIM and DMARC make it harder to send forged email in your name – free via DNS settings. Advanced filters are worth it with high email volumes or targeted attacks.
Data, backup and cloud
Backups and restoreSeparate or immutable backups – and regularly tested restores.Basic
At least one copy offline or immutable. A documented, practised restore is what matters: how long until you can work again?
Cloud backupBack up cloud data too – mailboxes, file shares and shop data.Useful as IT grows
Cloud providers ensure availability, not automatically recovery after deletion or encryption. Check provider retention and back up separately where needed.
Network, web and domain
FirewallAllow only necessary connections; no unprotected open remote access.Basic
Routers and operating systems include firewalls. What matters is closing unneeded port forwards and separating networks for guests and devices.
DNS filteringBlocks known harmful domains for every device on the network.Useful as IT grows
A simple additional layer. Useful when several devices need protection, including on the road via device profiles.
Domain and DNS protectionRegistrar account with MFA, expiry dates tracked, lock against unwanted transfer.Basic
Losing your domain takes down website and email. Secure registrar access, turn on auto-renewal and use the domain lock.
WAF for web applicationsA web application firewall filters attacks on your shop, portal or web app.Relevant with higher risk
Relevant for online shops and own web applications holding customer data or revenue. Does not replace updating the shop system and plugins.
DDoS protectionProtects against deliberate overload of your website or shop.Relevant with higher risk
Often part of hosting or CDN offers. Relevant when website downtime directly costs revenue.
Detect and respond
Monitoring and loggingLog sign-ins, changes and errors – and actually read the alerts.Useful as IT grows
Many cloud services offer sign-in alerts for free. Keep logs long enough to reconstruct an incident later.
SIEM – contextBrings together logs from many systems and spots patterns.Relevant with higher risk
Too demanding for most small businesses. Relevant with many systems, regulatory requirements or as part of an MDR service.
Incident responseWho does what when something happens? Define contacts and first steps in advance.Useful as IT grows
A one-page plan with contacts, IT provider, insurer and bank is enough to start. A retainer with an incident response provider saves time in an emergency.
Organisation, people and suppliers
Awareness trainingShort, regular exercises on phishing and payment fraud.Useful as IT grows
More effective than one long session: short formats, a clear reporting route and a culture where mistakes are reported without fear. Free material is available from Germany's BSI and the Alliance for Cyber Security.
Supplier and service-provider riskWhich providers have access to your systems or data?Relevant with higher risk
A simple list of access rights, contacts and security commitments is often enough. Enable remote maintenance access only when needed.
Business continuityHow does the business keep running when core IT fails?Relevant with higher risk
Name critical processes and define a fallback mode (e.g. manual invoices, offline phone list). No big project needed – one page is a start.
Disaster recoveryPlanned, practised recovery of IT after a major outage.Relevant with higher risk
Defines the order in which systems are restored and how long that may take. Builds on tested backups.
Cyber crisis planPrepare decisions, communication and reporting duties for an incident.Useful as IT grows
Who decides? Who talks to customers? Where are contacts stored offline? Adds the business side to the incident response plan.
Safe use of AI at workClear rules on which data may be entered into AI services.Useful as IT grows
No customer, staff or trade secrets in freely available AI tools without reviewed contract terms. Check outputs before use. A short internal policy is enough to start.