Online meetings: what the NCSC says small businesses should check first

Video calls are now how many small firms pitch to customers, talk to suppliers and run team meetings. That makes the meeting link a useful thing for a scammer to fake, and the meeting itself something worth protecting. In March 2026 the National Cyber Security Centre (NCSC) published guidance called "How to secure your online meetings", aimed at small and medium-sized organisations. This post turns it into a practical set of steps you can finish in an hour.

Why online meetings are worth a look

The NCSC guidance, published on 19 March 2026, sets out three simple ideas: secure the account, control who can join, and limit what is shared and stored. None of them need technical skills. They do need someone to decide the settings rather than leaving everything on default.

There is also a scam angle. An industry notice dated 26 March 2026 says security researchers have uncovered phishing campaigns that use fake meeting invitations for Zoom, Microsoft Teams and Google Meet as bait. We could only read the teaser of that notice, so we draw no further detail from it. The general point stands: a meeting invitation is just another message that can be faked.

Step 1: choose the right plan and download from the right place

The NCSC says free versions may be enough for personal use, but organisations typically need paid plans so they can manage several users securely and meet compliance and data protection needs. If your whole team is using personal free accounts for work calls, nobody can see who has access, and nobody can switch it off when someone leaves.

The guidance also says to download meeting apps only from trusted sources, such as the official app stores or the provider's own website, and to avoid adverts and unsolicited links, which may lead to malicious sites. It does not give product specific settings, so check the support pages of whichever service you use.

Step 2: lock down the admin account

Whoever sets up your meeting account holds the keys. The NCSC recommends:

• A strong, unique password for the account.
• Two-step verification (2SV) switched on.
• Passkeys, where the provider offers them.
• Keeping the app up to date.

If you are not sure where to start with accounts, our earlier post on passkeys and two-step verification covers the basics in more detail.

Step 3: decide who can get into a meeting

This is where most uninvited guests are stopped. The NCSC suggests:

• Allow direct access only to signed-in users and invited guests.
• Require passcodes for anyone who is not signed in.
• Use a waiting room, sometimes called a lobby, so you can check who someone is before admitting them.
• Consider blocking calls from outside your organisation and from unknown contacts.
• Never share meeting links or passwords in public places.

If you do not recognise someone in a meeting, the guidance says to politely ask who they are before carrying on. That is an awkward moment worth having, especially if the call is about money, quotes or customer details.

Step 4: be careful what you share on screen and what gets stored

Before you join, check what is visible behind you. The NCSC suggests a background blur or a neutral image. Make sure you know how to mute your microphone, turn off your camera and spot when a meeting is being recorded, and review the privacy settings before you start.

It also asks you to know where recordings, transcriptions, chat logs and shared files are kept, to limit access to the people and systems that genuinely need them, and to keep personal data only as long as there is a clear reason to.

Step 5: think about AI attendees

The NCSC warns organisations to be aware of AI attendees. These are tools that may record, transcribe or analyse a meeting. You should understand what data they collect, how it is used and whether you can opt out.

If an AI note-taker is listening, personal data protection applies. The Information Commissioner's Office (ICO) says organisations must tell people how their personal data is collected and used, which it calls privacy information. That covers the purposes, how long the data is kept and who it is shared with. For data collected directly from a person, you should provide this at the point of collection. The ICO says the information should be concise, transparent, intelligible and easily accessible, in clear and plain language. It also notes this guidance is under review because of the Data (Use and Access) Act, so check the page for changes.

In practice, that means telling people at the start of a call if a recording or transcript is being made, and saying what it is for. If a customer would be surprised to learn a tool was transcribing them, tell them first.

Spotting a fake invitation

The NCSC's small organisations guide says phishing uses fake emails, texts or calls to get login or bank details, access to business or customer data, or access to email, which can lead to control of other accounts. It cites a figure of 85% of cyber attacks against businesses starting with a scam email. The warning signs it lists include misspelled email addresses, unexpected attachments, generic greetings, links to unknown sites and strange looking logos. Messages often pressure you into acting fast.

Apply that to meeting invitations:

• Be wary of an invitation from someone you do not know, or an unexpected one from someone you do.
• Do not download an app, plug-in or "update" that a meeting page tells you to install. Get apps only from the official store or the provider's website, as the NCSC advises.
• If a page asks you to sign in before joining and you were not expecting that, stop and go to the provider's site directly.
• If in doubt, contact the sender using details from their official website, not the details in the message.

If someone does click or download something suspicious, the NCSC says not to panic, and to follow its phishing steps. You can report scam emails to the NCSC for free, and the NCSC says doing so takes about a minute and that it has the power to investigate and take down scam email addresses and websites.

A one hour checklist for this week

• List every meeting service your team uses, including free accounts staff signed up to themselves.
• Move work calls onto a paid business plan where you can see and manage users.
• Turn on 2SV, and passkeys if offered, for the admin account.
• Switch on passcodes and the waiting room for external meetings.
• Check where recordings and transcripts are stored, and who can open them.
• Decide whether AI note-takers are allowed, and write the rule down in two lines.
• Tell staff that meeting links and "update required" pop-ups can be fakes, and that they should ask if unsure.

The NCSC also advises small organisations to prepare a cyber attack plan setting out who does what, and when, if an incident happens. Early recognition and a clear response can stop a small problem becoming a major one.

Where an outside hand helps

None of this requires a consultant. But if you have several staff, a mix of devices and no one clearly in charge of accounts, it can help to have someone review your setup. Our cloud and security work covers this kind of review for small businesses.