Contents
Short answer
Small businesses do not need to run a security operations centre. What matters is that sign-in alerts and security notices of existing services are on, someone reads them and logs are kept long enough. SIEM and MDR only become relevant with larger IT or higher risk.
Why does this matter for small businesses?
Many attacks go unnoticed for days although the services involved already generated alerts. The earlier an unusual sign-in or new forwarding rule is noticed, the smaller the damage.
- Event
- Log
- Alert
- Response
What does it include?
Logging
Log sign-ins, admin changes and errors in cloud, shop and devices, and know the retention.
Basic
Alerts
Turn on alerts for new sign-in locations, MFA changes, mass deletion or external forwarding, and assign them to a person.
Basic
Monitoring
Automatically check website and shop availability, backup success and storage space.
Useful as IT grows
EDR signals
Alerts from EDR solutions show suspicious behaviour on devices – valuable only if assessed.
Relevant with higher risk
SIEM
Brings together logs from many systems and detects patterns. Not a necessary product for most small businesses.
Relevant with higher risk
MDR
A provider takes over monitoring and response – often the more realistic option than running your own SIEM.
Relevant with higher risk
What does it protect against?
- Late detection of account takeovers
- Unnoticed backup failures
- Gaps in traceability after an incident
What does it not protect against?
- Attacks themselves – monitoring only reveals them
- Alerts nobody reads
- Events that are not logged
Which basic measures are often enough?
- 01Sign-in alerts on in office cloud and shop
- 02Read backup status messages
- 03One person responsible for alerts, with a deputy
- 04Know log retention periods
When does a more advanced solution make sense?
Professional support becomes relevant with many systems, sensitive data, regulatory duties or nobody internally able to assess alerts. An MDR service is then often more sensible than a self-run SIEM.
Common mistakes
- Sending alerts to a mailbox nobody reads
- Enabling so many alerts that all get ignored
- Losing logs after a few days
- Buying a SIEM without staff to review it
Checklist
- Sign-in alerts on
- Responsibility and deputy for alerts clarified
- Backup success is checked
- Log retention known
Frequently asked questions
What should we monitor at minimum?
Sign-ins and admin changes in the office cloud, backup status and website or shop availability.
Do we need a SIEM?
Most small businesses do not. It becomes relevant with many systems or as part of an MDR service.
Sensible next step
Check where your office cloud's security alerts go and whether anyone reads them.
Sources
- CISA – Cybersecurity and Infrastructure Security Agency
- NIST Cybersecurity Framework
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.