Cyber resilience for London SMEs: a practical guide

Small businesses don't need a large IT budget to make themselves harder to attack. A lot of useful security work is fairly ordinary.

Turn on multi-factor authentication, keep devices updated, back up important files and make sure former staff can't still log in. Give people a clear way to report suspicious emails.

None of these measures guarantees that your business will avoid a cyber incident.

But they do reduce some of the most common risks and make it easier to recover when something goes wrong.

When you have only limited time, money and technical support, that's a sensible place to start.

What is cyber resilience?

Cyber security is about stopping attacks before they happen.

Cyber resilience is broader. It's the ability to prepare for an incident, respond when one occurs and recover afterwards with as little damage as possible.

Think of it in four parts:

1. Prevention: things like passwords, updates and staff awareness.

2. Detection: noticing something is wrong, whether that's a strange log-in or a customer flagging a suspicious email that appears to come from you.

3. Response: what you do in the first hours after discovering a problem.

4. Recovery: getting back to normal trading, restoring data and learning from what happened.

No set of security measures stops every attack. Software has flaws, people make mistakes and criminals adapt quickly.

Resilience accepts that something will eventually slip through and focuses on making sure it doesn't put you out of business when it does.

Why cyber resilience is so important

Cyber attacks on small businesses used to be quite rare. They aren't anymore.

The government's most recent Cyber Security Breaches Survey found that 43% of UK businesses identified a breach or attack in the past year.

Phishing (see below) remains the most common route in, and it accounts for most incidents that small firms report.

The risks tend to fall into a few familiar categories.

• Phishing emails try to trick staff into handing over passwords or making a payment to the wrong account.

• Ransomware locks up files and demands money to release them.

• Data breaches expose information about customers or suppliers.

• Account compromise gives someone access to email, banking or social media without permission.

The impact goes beyond the immediate disruption. A locked system means losing valuable trading time. Recovering data and rebuilding people's trust takes weeks, sometimes longer.

And in a city where reputation travels fast through reviews and word of mouth, a breach that becomes public can put off customers for good.

There's also a growing expectation from the outside. Larger clients now ask suppliers about their security before signing contracts.

Insurers ask questions before offering cover, and the same government survey found that 62% of small businesses now hold cyber insurance, up sharply from the year before.

Under GDPR, businesses handling personal data have a legal duty to protect it and report serious breaches to the Information Commissioner's Office (ICO).

Choosing the right low-cost cyber security set-up

There's no single set-up that suits every business, so it helps to think through a few things first.

• How big is your business and how fast is it growing?

• What kind of data do you hold, and how sensitive is it?

• How many people and devices need protecting?

• Realistically, what can you spend, and who's going to manage it day to day?

For most small London businesses, a handful of controls cover the bulk of the risk:

• Multi-factor authentication on your main accounts.

• A password manager.

• Regular software updates.

• A working back-up.

(We explain each in the next section.)

Beyond that, the priorities shift depending on the sector in which you operate.

• If you handle financial data for clients, you need stronger controls around access and encryption than if you're a small design studio.

• If you're a retail business that takes card payments in store, you have different obligations to a consultant who keeps client contracts on a laptop.

Plenty of useful online security tools have generous free tiers, including password managers, basic antivirus and cloud back-up for smaller volumes of data.

Paid tiers usually add more storage, more users or more detailed alerts.

It's worth starting with what's free, using it properly and only paying once you can see exactly where the gap is.

Setting up your defences properly

A few basic measures, set up correctly, cover most of the risk small businesses face.

• Multi-factor authentication (MFA): turn this on for email, banking, cloud storage and any accounting software. It's usually free and takes minutes to set up. It's the single most effective step against someone unauthorised taking over your account.

• A password manager: this generates and stores strong, unique passwords for every account, so no-one is reusing "password1234" everywhere. Most reputable options have a free version for individuals and affordable plans for small teams.

• Keeping software updated: enable automatic updates on operating systems, browsers and apps wherever you can. Most successful attacks exploit known flaws that a patch would have fixed months earlier.

• Regular back-ups: keep at least one back-up copy of critical data somewhere separate from your main systems, ideally in the cloud and test it occasionally to make sure it actually restores.

Common mistakes with cyber security

These are worth flagging too.

• Sharing one log-in between several staff makes it impossible to know who did what.

• Storing passwords in a spreadsheet or a sticky note defeats the point of having them.

• Treating a back-up as done once it's switched on, without ever checking it works, is one of the most frequent and costly oversights.

  Plenty of businesses only discover their back-up was misconfigured the day they actually need it, which is the worst possible moment to find out.

A sensible rule of thumb is to keep a back-up copy somewhere separate from the systems it's protecting.

If ransomware locks your main files, a back-up sitting on the same network can end up locked too. Cloud storage from a reputable provider usually handles this separation for you automatically.

Managing your cyber resilience from day to day

Security isn't a project you finish, but a short list of habits that need repeating.

• Set a monthly reminder to check who has access to what.

• Remove log-ins for anyone who's left.

• Review any account with admin rights and check it's still needed.

• Read your back-up logs to confirm they've actually run.

• Check for outstanding software updates across the devices you use.

Staff training matters more than you might expect, and it doesn't need to be formal or expensive.

A short conversation about what a phishing email looks like, or a quick walkthrough of a real example that's landed in your inbox, will do a lot of good.

Encourage people to double-check unusual payment requests by phone rather than reply to the email, since that single habit stops a large share of invoice fraud.

It also helps to write down, even briefly, what you'd do if something went wrong. Who do you call? Where's the back-up? Who tells customers, and when?

A one-page plan, agreed in advance, saves precious time and clearer thinking during an actual incident.

Over time, these small habits become part of how the business runs rather than an extra task bolted on top.

Cyber resilience benefits and trade-offs

Getting the basics right pays off in several ways.

1. It reduces the chance of a costly incident in the first place.

2. It gives customers and partners more confidence in dealing with you, particularly if you can point to concrete steps you've taken.

3. It shortens the time it takes to get back to normal trading if something does happen.

4. It protects the customer and company data you're legally and morally responsible for.

None of this comes entirely free, and it's worth being honest about the trade-offs.

• Setting up MFA, a password manager and proper back-ups takes a few hours you might not feel you have spare.

• Some tools carry a monthly cost once you outgrow the free tier.

• Staff training needs repeating, not doing it once and forgetting.

• And it's easy to fall into the trap of buying a tool and assuming the job is done, when the tool only works if the underlying habits and processes are followed alongside it.

The businesses that manage this well tend to treat it as ongoing maintenance – similar to bookkeeping or renewing insurance cover – rather than a one-off fix.

How AI is changing cyber security for small businesses

It's becoming increasingly common for AI features to be built into the affordable tools small businesses already use, often without any extra cost or set-up.

Email providers now flag suspicious messages with growing accuracy, spotting patterns that go beyond an obvious spelling mistake or dodgy link.

Many back-up and security tools monitor activity in the background and alert you automatically if something looks unusual, such as a log-in from an unfamiliar location.

Some accounting platforms back-up payment requests that don't match a supplier's usual pattern.

When you're a small business without a dedicated security team, this is genuinely useful.

A level of monitoring that would once have required specialist staff is now sitting inside the tools you're already paying a modest subscription for.

That said, AI tools aren't infallible. They can miss a well-crafted attack and occasionally flag something harmless as suspicious.

You should see them as a useful layer of defence rather than a replacement for the judgement of the person reading the email or approving the payment.

Keep a human checking anything that looks unusual, especially where money is involved.

Building cyber resilience as your business grows

As a business takes on more staff, more devices and more suppliers, the basics from earlier need extending rather than replacing.

• Endpoint protection software, which monitors laptops and phones for suspicious activity, becomes worth the monthly cost once you're managing more than a handful of devices.

• Device management tools let you enforce security settings across the whole team and remotely wipe a lost or stolen laptop.

• Security monitoring tools give you visibility across accounts and systems rather than relying on individual alerts arriving separately.

Many growing businesses work towards a recognised standard such as Cyber Essentials, the UK government-backed certification.

Basic certification starts at around £300 for a micro business and gives a clear checklist to work through, along with a badge that reassures clients and can smooth the way into contracts that require it.

Finally, know when to bring in outside help.

If you're handling particularly sensitive data, facing specific rules or regulations, or simply find the technical side is outpacing what you can manage in-house, a few hours with an independent IT or security adviser can be worth far more than the fee.

Read more

• Cyber security essentials for London businesses

• Free cyber security support for Grow London Local members

• Cyber security community

Find the right support for your business

At Grow London Local, we understand that you’re passionate about your small London business. That’s why our website is packed with resources tailored to you. Find more support