Cyber security for small businesses: the free NCSC help most owners miss

Most small business owners did not start their company to become experts in cyber security. You are busy serving customers, chasing invoices and keeping the website running. The good news is that the National Cyber Security Centre (NCSC), the UK government's technical authority on the subject, has built free, plain English help for exactly this situation. This post explains what is on offer and how to make use of it without a technical background.

The numbers behind the advice

In a blog post published on 28 November 2025, the NCSC pointed out that there are 5.5 million small organisations in the UK employing fewer than 50 people. It also stated that half of small businesses suffer a cyber incident every year. That does not mean half of firms lose a fortune. Many incidents are a hijacked email account or a convincing phishing message. But it does mean that preparing is sensible rather than paranoid.

The NCSC's message to small firms was simple: there are two actions worth taking. The first is the Cyber Action Toolkit. The second is Cyber Essentials.

Step one: the Cyber Action Toolkit

The Cyber Action Toolkit is a free NCSC resource aimed at people who are new to cyber security, from sole traders up to small organisations. Rather than handing you a long technical document, it turns expert advice into simple, achievable steps and lets you track your progress as you go. The NCSC says it helps protect against problems such as email hacking, phishing and ransomware, and that you do not need technical expertise to use it.

If you only do one thing after reading this post, this is the one. Set aside an hour, work through the first steps, and come back to the rest when you have time.

Step two: Cyber Essentials

Cyber Essentials is the government-backed certification scheme. According to the NCSC it covers five key controls:

• Secure configuration of devices and systems
• User access control, so people only reach what they need
• Malware protection
• Security update management, so software is kept up to date
• Firewalls and internet gateways

These sound technical, but in practice they mean things like removing accounts that nobody uses, turning on automatic updates, and making sure staff devices are set up sensibly.

The NCSC describes certification as a way to show customers and suppliers that you take security seriously. It also notes that many organisations require it from their suppliers, which matters if you hope to win work from larger companies, councils or public sector buyers. The NCSC lists free cyber insurance and emergency support among the benefits of certification, though you should read the terms and check whether your business is eligible before relying on it.

Where to get help along the way

You are not expected to do this alone. The NCSC points to a Readiness Tool and a Knowledge Hub to help you prepare for certification. If you would rather have someone alongside you, NCSC-assured Cyber Advisors are trained to explain cyber security in a way small businesses can follow.

GOV.UK also hosts the NCSC's Small Business Guide, which includes a free personalised Cyber Action Plan showing which protective measures to put in place first. It also lists free staff training, "Staying Safe Online: Top Tips for Staff", which it says takes under 30 minutes.

A practical plan for this month

If you are not sure where to start, here is a manageable order of work:

• Week one: start the Cyber Action Toolkit and finish the first set of steps.
• Week two: check who has access to your key accounts, such as email, banking, your website and your accounting software. Remove anyone who has left or no longer needs it.
• Week three: make sure devices and software are set to update automatically, and give staff the short online training.
• Week four: look at the Cyber Essentials Readiness Tool and decide whether certification makes sense for the customers you want to win.

Do not forget your website and online systems

Cyber Essentials covers devices and accounts, but your website, online ordering system or customer portal deserve attention too. Keep the platform and any plugins updated, limit who can log in as an administrator, and make sure someone is responsible for hosting and backups. If your site was built years ago and nobody looks after it, that is worth fixing. Our cloud and security team helps businesses in Manchester and across the UK put sensible protections in place without the jargon.

The bottom line

Cyber security can feel like a problem for bigger companies with IT departments, but the NCSC has deliberately built its latest tools for the smallest businesses. They are free to start, written in plain English and designed to be done in small steps. Taking an hour this week to begin the Cyber Action Toolkit is one of the better uses of your time, and it may open doors with customers who ask about security before they sign a contract.