Using online services safely: the NCSC's plan for small businesses

Most small businesses run on cloud services without ever deciding to. Email, shared drives, online accounting, the website host, the booking tool and the social media accounts all live on someone else's servers. The National Cyber Security Centre (NCSC) has a free collection of plain-English guidance called "Using online services safely", written for small organisations rather than IT departments. This post turns it into a practical plan you can work through in an afternoon.

Why this guidance matters

The NCSC collection was published on 11 January 2024 and covers the services the NCSC says most small organisations rely on, often without realising: email and instant messaging, online storage, online accounting and invoicing, website or online shop hosting, and social media. Trade press reporting on the launch noted that the NCSC felt its existing cloud security guidance was too technical for smaller firms, which is why a simpler version was written. If you have someone who configures your systems, the NCSC points them to its more detailed Cloud Security Guidance. If you do not, this collection is the place to start.

Step 1: Choose a good service and set it up properly

The NCSC says every cloud service you use should be configured so that it is protected against common cyber attacks. It makes two practical points worth noting.

• Check which version you are on. Services often come as Free, Lite or Business editions with different features. Make sure you assess the edition you actually use.
• Use the provider's own set-up guides. The NCSC says reputable providers make secure set-up straightforward. It points to Google's security checklist for small businesses with 1 to 100 users, and Microsoft's guide to the top 10 ways to secure your business data.

Step 2: Give everyone their own work account

The NCSC is blunt here: staff should not use personal accounts for work activities. Each person should have their own work account, because shared accounts make information harder to keep private, make it harder to tell who did what, and mean one successful attack exposes more data. If you use a directory such as Google Workspace or Microsoft Entra ID, create an account for each person there so the accounts stay under your control.

Step 3: Protect user accounts with three habits

The NCSC gives three tips for accounts your organisation creates for staff.

• Turn on two-step verification. Also called two-factor authentication, it means a password alone is not enough, typically because you also need a code from a phone or an authenticator app. Switch it on for every account that offers it.
• Use a unique password for every account. If one is discovered, an attacker only gets that one account. A password manager, or your browser's password storage, does the remembering for you.
• Avoid guessable passwords. The NCSC's test is that somebody who knows you well should not be able to guess your password in 20 attempts. Avoid birthdays, family and pet names and favourite teams. Three random words strung together make a long password you can still remember. The NCSC also says writing passwords down is acceptable if the note is kept safe and private.

Step 4: Look after your admin accounts

Admin accounts can change important settings and manage other users. The NCSC warns that an attacker who compromises one could read users' emails, delete files and backups, or approve large invoices. Its advice:

• Turn on two-step verification for every admin account.
• Keep more than one admin account, each assigned to a different person, so that if one is lost or compromised the other can begin the clean-up.
• Give admin rights only to people who truly need them, and remove them promptly when someone leaves or changes role.
• Give admin staff a separate, normal account for daily work, and use the admin account only for admin tasks.
• Keep contact details on the account up to date so you can prove you are the legitimate owner. If asked for a backup email address, use one from a different provider with a different password.
• Store backup or recovery codes somewhere you can reach even if you lose email access, such as a printed copy or a separate USB stick.

Step 5: Protect your domain name

Attackers may try to take over a domain to hijack a website, email accounts and other services that use it. The NCSC advises two things. First, do not tie the domain to a personal email account: if it is registered that way, move it to an account your organisation controls. Second, protect the account that manages the domain using the same account and admin advice above. Providers may also ask you to prove you control the domain when you need help recovering a service, so keeping it secure helps there too.

Step 6: Switch on the built-in protections

Many cloud services include features that guard against common attacks. Some are on by default, but others need an administrator to activate them. The NCSC suggests confirming they are switched on and apply to everyone in your organisation, including filtering of phishing links and malicious attachments. It also advises using the service's own web interface or official app, avoiding any access method that makes you weaken security settings, and checking that "legacy" or "compatibility" options are turned off because they often do not support current security technology.

Step 7: Back up, even though it is in the cloud

This is the point many owners miss. The NCSC says storing data in a cloud service does not remove the need for backups. Some services keep earlier versions of files, which may help if ransomware encrypts your data, and some keep deleted files for a short time. But the NCSC says these features are not a reliable backup for critical data. It recommends confirming that all essential data is exported and backed up, that you know how to access and restore it, and that you keep a separate, independent copy in a different secure location or with a different service. If you back up to another cloud service, the NCSC points to its principles for ransomware-resistant backups.

The NCSC page does not say how long providers keep versions or deleted files, so check your own provider's documentation for exact figures, and test a restore once so you know it works.

Step 8: Know what to do if an account is hacked

The NCSC advises reading its recovery guidance before you need it. Signs include losing access, activity you do not recognise, changed security settings, or password reset messages you did not request. Each service has its own recovery process, and you may need the provider's support. Google and Microsoft both publish steps for resetting a user's password and recovering a compromised account, so bookmark them now.

Your plan for this week

• List every online service your business uses and who the admins are.
• Check each person has their own work account and two-step verification is on, admins first.
• Confirm the domain is registered to a business email address, not a personal one.
• Set up a second admin and store recovery codes somewhere safe.
• Arrange an independent backup of email, files and accounting data, then try a restore.

If you would rather have help with set-up, access control or backups, our cloud and security team can work through this checklist with you. None of it needs special equipment, and most of it costs nothing but an hour or two of attention.