The NCSC small business guide: a one afternoon plan for UK firms

The National Cyber Security Centre (NCSC) publishes a free guide for small organisations, and it is one of the more usable pieces of government advice around. It was published on 9 April 2026 and reviewed on 21 July 2026. It runs to six pages, needs no technical background, and the NCSC says many of its recommendations can be done in as little as five minutes. This post turns it into a plan you can work through in an afternoon.

Why a small business should bother

The guide opens with two figures from the NCSC. The UK has about 5.5 million organisations with 0 to 49 employees, and one in two small businesses suffers a cyber incident every year. The NCSC is blunt that being small does not make you safe: small businesses are as likely to experience online crime as larger ones. It also says security should not sit with one person, because everyone on the team has a part to play.

The guide covers backups, protecting devices, securing email, securing important online accounts and spotting attacks. Here is what each section asks you to do.

1. Protect your devices

Phones, laptops and tablets hold business information, so the NCSC says to lock down all of them, including personal devices that staff use for work. Phones and tablets are at higher risk of loss or theft because they leave the office. The guide's steps:

• Control access. Use a 6 digit PIN or a strong password on every device. Fingerprint or face recognition is preferred where available.
• Pick a good PIN or password. Use a different one for each device, change any default, and avoid guessable choices such as 123456 or 000000. Avoid personal details like birthdays and pets' names. One suggestion for a stronger password is combining three random words.
• Keep everything updated. Install updates for software, apps and browsers, because updates fix bugs criminals can exploit. Turn on automatic app updates. If a device no longer receives updates, replace it, though you do not need the latest model.
• Delete apps you no longer use, and download apps only from official stores or websites.
• Check antivirus and firewall. Modern devices usually have both switched on, but check that a previous user has not turned them off. On Apple devices the firewall needs to be turned on. The NCSC says smartphones do not need separate antivirus if you install only official apps.

The NCSC also offers a "Check your web browser" tool that confirms whether you are running the latest version of Chrome, Edge, Safari or Firefox.

2. Secure your email

A hacked business email account can expose private data, including banking details. Attackers can also send messages pretending to be you and reset passwords to reach your other accounts. The NCSC points out that business email also counts as data under your GDPR obligations.

• Use passkeys where your provider supports them. A passkey is created and stored by a service on your device, so there is nothing to remember. The NCSC says passkeys resist interception, reuse and theft, and are faster to use than a password plus a code. Enable them for staff accounts first.
• If you still use a password, make it strong and unique to that email account. Do not reuse it at home or at work. If you have reused it, change it as soon as possible.
• Turn on 2-step verification (2SV). This sends or generates a code that proves you are the account holder even if someone knows your password. The guide says any type of 2SV is better than none, and recommends keeping backup codes in case you lose your phone.
• Use a password manager. The NCSC suggests the one built into your device or browser, or a dedicated app if staff use different devices. You need one if you use passkeys. Whichever you choose, the master password must be unique, strong and not based on personal information.

3. Secure your other important accounts

Start by listing the accounts your business relies on, putting first those that hold customer or staff information or would cause serious disruption if stolen. The NCSC's examples are:

• banking and finance
• HR and payroll
• social media accounts
• online storage such as Google Drive, OneDrive and iCloud
• your company website and domain hosting, if separate
• point of sale software

For each one, use a passkey if it is offered, or otherwise a strong, unique password with 2SV. Then do two jobs many businesses skip. First, remove or disable accounts nobody needs any more. The guide notes that accounts for former staff, suppliers and contractors often stay active and are more likely to have outdated passwords and weak settings. Its tip is to review who has access to important accounts every few months. Second, on laptops and desktops, use a standard user account for daily work and keep the administrator account for when you need it. If an attacker compromises an administrator account, they could take control of the device and lock you out.

If you are not sure who can log in to your website or hosting, our cloud and security team can help you check.

4. Back up your data

The NCSC says to back up everything your business needs to operate, including your website, emails, invoicing, documents, contacts and customer information. Data can be lost through ransomware, a lost, stolen or broken device, or a move to a new device.

• Online backup with a service such as iCloud, Google Drive or OneDrive, if your internet connection is reliable.
• External storage, such as a USB stick or external hard drive, kept somewhere secure and disconnected when not in use, because some viruses also affect devices connected to an infected computer.

The tip we would underline is the NCSC's suggestion to use two backups, one online and one on a storage device, and to protect the online one with 2SV. The guide also says to learn how to restore a backup before you need to, and to check that it contains all your important data. A backup you have never restored is a guess.

5. Spot attacks early

The NCSC lists signs that something is wrong: unfamiliar emails in your inbox, customers receiving emails you did not send, login alerts you do not recognise, devices running slowly or oddly, and unauthorised payments from your account.

It also states that 85% of cyber attacks against businesses start with a scam email. Warning signs it highlights include misspelled email addresses, unexpected attachments, generic greetings such as "Dear valued customer", links to unknown sites, spelling and grammar mistakes, and poor quality logos. If you are unsure about a message, contact the organisation directly using details from its official website, not the numbers or links in the message. Report suspicious emails to the NCSC.

Two other points are easy to overlook. Review your website and social media for information criminals could use, such as staff profiles and details about third parties you work with. And write a cyber attack plan that sets out who does what, and when, if something happens, so you can act quickly and recover faster.

A plan for this week

• Today: check every device has a PIN or password and that updates are on.
• Tomorrow: turn on 2SV, or a passkey, for your email and bank.
• This week: list your important accounts and remove anyone who no longer needs access.
• This week: set up an online and an offline backup, then try restoring one file.
• This month: write a one page plan naming who to call if you think you have been hacked.

If you think you have already been hacked, the NCSC points to its Response and Recover guidance for small organisations. None of this guarantees you will never be attacked, but it covers the basics the NCSC considers most worthwhile for a business of your size.