Cyber security can sound like a separate technical discipline, but most smaller businesses can make meaningful progress by managing a clear set of everyday controls consistently.
The objective is not to remove every possible risk. It is to make common attacks harder, identify concerns sooner and give the business a workable way to respond.
Protect accounts
Business email and Microsoft 365 accounts are valuable targets. Multi-factor authentication, controlled administrator access and a clear joiner and leaver process reduce the chance that one password gives an attacker lasting access.
Manage company devices
Devices should receive agreed security settings, encryption, updates and protection. The business should know which devices have access to its information and be able to respond when a device is lost, replaced or no longer meets the required standard.
Strengthen email
Many attacks begin with a message designed to steal a password, persuade somebody to send money or deliver malicious content. Email protection, secure domain settings and employee awareness work together to reduce that risk.
Keep a separate backup
Microsoft 365 provides the live cloud service. A separately managed backup gives the business another recovery option for email and agreed cloud information if data is deleted, changed or otherwise unavailable.
Help employees recognise suspicious activity
People should know how to question an unusual request and where to report it. Training is most useful when it is short, relevant and supported by a simple reporting route.
Prepare for an incident
Write down who should be contacted, how the business will communicate if normal systems are unavailable and which services must be recovered first. A short usable plan is better than a detailed document nobody can find during an incident.
Review the Microsoft 365 baseline
Security settings and licences change over time. A review can identify gaps in authentication, administrator access, email protection and device management before more advanced services are considered.
Add monitoring where the risk justifies it
Some businesses also need continuous monitoring and human investigation. This does not replace the baseline. It adds the ability to watch for, investigate and respond to covered threats throughout the day and night.
baseMSP helps businesses move from the starting controls to an agreed roadmap through its free Microsoft 365 security review, managed support and Microsoft 365 security services.
Further reading
The National Cyber Security Centre provides a current small organisations guide to cyber security covering backups, devices, accounts and scams.
