A cyber attack does not need to bring down every system to cause serious disruption. A compromised Microsoft 365 account, an employee who approves a convincing fraudulent payment, or ransomware on one shared drive can stop orders, delay customer work and put sensitive data at risk. This small business cyber resilience guide is about making sure your business can keep operating, respond calmly and recover quickly if that happens.

Cyber security aims to prevent an incident. Cyber resilience accepts that prevention has limits. The practical question is not just, “How do we keep attackers out?” It is also, “What happens to our people, data and customers if they get in?”

What cyber resilience means for a small business

For a small business, resilience is the ability to continue the most important work during an IT or cyber incident, then restore normal service without losing control of the situation. That could mean keeping the phones answered while systems are restored, accessing a clean copy of client records, or knowing exactly who can approve an urgent supplier payment.

It is not about buying every security product available. A ten-person office and a multi-site automotive business will have different risks, systems and recovery priorities. Both, however, need clear ownership, sensible protection and a tested plan that works on a difficult Tuesday morning, not just in a policy document.

The strongest arrangements bring together people, processes and technology. A good firewall matters, but so does a member of staff feeling able to question an unusual email from a director. Backups matter, but only if they can be restored within the timeframe your business can tolerate.

Start with the disruption your business cannot afford

Before reviewing tools, identify the work that must continue. Think in terms of business operations rather than technical equipment. If your email was unavailable for a day, could staff communicate with customers? If a line-of-business application failed, could you take bookings or raise invoices another way? If access to shared files disappeared, which teams would be unable to work?

Write down your critical systems, the data they hold, who owns them and the consequences of losing them. This usually includes email, cloud storage, finance systems, customer databases, websites, telephony, payment processes and any specialist software.

A garage may rely on diagnostic platforms, workshop scheduling and parts ordering. A charity may need supporter data, grant records and secure access for volunteers. The technology differs, but the exercise is the same: decide what needs restoring first and what can wait.

There are useful trade-offs here. Restoring every file immediately may sound ideal, but it can add cost and complexity without improving the outcome. It is often better to set realistic recovery targets. For example, finance data may need to be available within four hours, while archived project files may be acceptable within two days.

Give every critical system an owner

Problems become slower and more expensive when nobody knows who manages a system, holds the administrator access or pays for the subscription. Keep a simple register covering the provider, contract renewal date, recovery contact, administrator accounts and the person responsible inside the business.

This is particularly valuable where technology has grown over time or several suppliers are involved. It reduces the risk of discovering, during an incident, that a former employee controls a key account or that no one can access the backup console.

Build the protections that stop common attacks

Most small-business incidents do not start with highly unusual techniques. They start with stolen passwords, phishing emails, missed software updates, poorly controlled access or a device that is no longer properly managed.

Multi-factor authentication should be switched on wherever it is available, especially for email, cloud platforms, remote access, finance and administrator accounts. A password alone is easily reused, guessed or captured through a fake sign-in page. Multi-factor authentication adds a meaningful barrier, although staff should still be trained never to approve a sign-in prompt they did not initiate.

Keep operating systems, applications, routers and security software updated. Delaying every update can be risky, but applying them without thought can also interrupt specialised systems. The practical approach is to use a managed patching process: prioritise urgent security updates, test changes where a critical application requires it, and keep an eye on devices that have fallen out of support.

Access should match a person’s role. Staff do not usually need administrator rights to do their job, and shared logins make investigations far harder. Remove access promptly when people leave, review permissions when roles change, and use separate administrator accounts for technical work.

Email remains a major route for fraud. Good filtering helps, but it cannot replace a clear payment process. For changes to bank details, urgent payment requests or unusual invoices, require an independent check using a known phone number. Do not reply to the email or use a number supplied in the message.

Make backup and recovery a business priority

A backup is not cyber resilience unless it can be restored. That sounds obvious, yet many businesses only find out a backup is incomplete, inaccessible or too slow when they need it most.

Keep protected copies of important data away from the systems they are backing up. Cloud services often provide some recovery options, but they are not automatically a complete backup strategy. Retention periods, deleted files, ransomware and accidental configuration changes all need consideration.

Your plan should cover the data itself, but also the systems required to use it. Restoring a database without the application, licensing information or server configuration may not get the business working again. Document what must be rebuilt, who will do it and where the recovery information is stored.

Test restoration on a planned basis. A small test might involve recovering a set of files to a separate location. A larger exercise could restore a key system and confirm staff can log in and complete a normal task. Testing may reveal gaps, but finding them during a planned check is far better than finding them during a live incident.

Create an incident plan people can actually use

A useful incident plan is short, clear and available even if your normal systems are offline. It should tell staff what to do first, who to contact and who is authorised to make decisions. It does not need to be a forty-page technical manual.

Include the steps for isolating a suspected infected device, reporting a suspicious email, contacting your IT support provider, informing senior decision-makers and recording what happened. Keep key phone numbers and account details somewhere secure but accessible outside the affected network.

Communication deserves particular attention. Staff need to know that reporting a mistake quickly is the right thing to do. If someone clicks a phishing link, early reporting can make the difference between a password reset and a wider compromise. A blame-free reporting culture is a practical security control, not simply a nice idea.

You should also decide in advance who speaks to customers, suppliers, insurers and regulators if an incident affects personal data or service delivery. The right response depends on the nature and scale of the incident, so avoid promising a fixed outcome. What matters is having a clear route for getting informed advice quickly.

Keep your team involved without turning security into a burden

Cyber awareness works best when it relates to the situations people actually face. Short, regular guidance about suspicious emails, password prompts, payment fraud and safe file sharing is more likely to be remembered than one annual presentation full of technical terms.

Use examples relevant to your organisation. A member of the accounts team may need to recognise invoice fraud. A remote worker may need guidance on home Wi-Fi and unattended devices. Managers need to understand why an urgent request apparently sent by a colleague still requires verification.

Avoid treating staff as the weakest link. They are often the first people to spot that something is wrong. Give them a simple reporting route, acknowledge reports quickly and feed back on what was caught. That builds attention without creating anxiety.

Review resilience as the business changes

New starters, office moves, acquisitions, new cloud software and flexible working arrangements all change your risk profile. Review your critical systems, access permissions, backups and incident contacts at least annually, and after a significant operational change.

For many businesses, an independent IT review is useful because it joins up issues that are otherwise handled separately: support tickets, ageing devices, cloud subscriptions, connectivity, backups and security controls. My Tech Team helps Sussex businesses turn that picture into a practical, prioritised plan, without burying decision-makers in jargon.

The aim is not perfect security or a complicated recovery plan that nobody can follow. It is the confidence that, when something goes wrong, your business knows what matters most, has the right support in place and can keep moving.