Security basics for a small company, in the order worth doing them

The short answer

For a small company, the practical approach is to fix an order and work down it. A sensible order is: keep systems updated, turn on multi-factor authentication, get backups working, sort out passwords, tidy up permissions, agree how email is handled, and keep records you occasionally read.

The first four need no big budget. Updates and multi-factor authentication are mostly settings; backups and password management may involve a small cost for a disk or a password manager. It is not the case that safety has to be bought. Before buying anything, look at the settings of what you already run.

How the order is decided

Two questions settle it: does skipping this stop the business, and can it be started today. Work down from the items that score high on both.

Without backups, data does not come back and work stops. Detailed log analysis, by contrast, is worth little if nobody is going to read the logs. The same word, "measure", carries very different weight at different company sizes.

Pick one reference document and stick to it. In Japan, IPA (the Information-technology Promotion Agency) publishes a security guideline written specifically for small and medium enterprises, along with a short list known as the six information security principles. Reading that first, then looking for the gaps in your own setup, is faster than assembling advice from a dozen sources. The material is on IPA's website (www.ipa.go.jp).

The four that start without a big budget

1. Keep everything updated

One of the cheapest items on the list, and one of the most effective. Operating systems, browsers, business applications, and the firmware in routers, network storage and similar equipment.

In practice this means turning automatic updates on. Then make a list of what cannot update itself, such as line-of-business systems, multifunction printers, routers and cameras, assign an owner, and set how often it gets checked. Ten minutes a month is enough.

Software past its support date stops receiving updates at all. This is the one place where replacement budget is genuinely needed, so find out the end-of-support dates early and put them in a plan rather than discovering them.

2. Turn on multi-factor authentication

Stop relying on a username and password alone, so that a leaked password is not on its own enough to get in. Multi-factor authentication is available at no extra cost on most email, cloud storage, accounting, payroll and administration services.

You do not have to do all of them at once:

1. Email first, because whoever controls the mailbox can reset passwords everywhere else
2. Anything that moves money: banking, accounting, payroll
3. Anything holding customer data: CRM, order management
4. Every account with administrator rights

An authenticator app is the easier method to live with. Some services only offer text messages; that is still a large improvement over nothing.

3. Get backups working

Ransomware, hardware failure and an accidental deletion all end in the same question: can you get the data back. IPA's guideline puts backups in its short list of first steps for the same reason.

Four decisions:

• What to copy. Not everything, but what hurts to lose: accounts, customer records, contracts, drawings
• Where to put it. At least two places, one of which is not permanently connected
• How often. Daily, or at whatever point the work naturally breaks
• Who checks it. Not whether the copy ran, but whether a file can actually be restored

That last one is the one that gets skipped. A backup is not really about copying; it is about restoring. Once a year, restore a single file and see what happens.

Copying to a share that is always mounted is not enough on its own, because ransomware encrypts what it can reach. If you use an external disk, unplug it when the copy is finished.

4. Decide how passwords are handled

Stopping reuse matters more than making any individual password clever, because a password leaked from one service will be tried on others.

A realistic route:

• A different password per service, favouring length over punctuation puzzles
• Nobody can remember those, so use a password manager rather than sticky notes and a spreadsheet
• Reduce shared accounts; where one is unavoidable, name an owner and a storage place
• Change what a leaver or transferred colleague knew

A spreadsheet of passwords on the shared drive is common and quietly serious: anyone who can open the file holds every credential in the company. Moving it into a proper manager is worth the afternoon.

The three that follow

5. Tidy up permissions

Stop giving everyone administrator rights. An administrator account can install, reconfigure and delete, so when something goes wrong on that machine the damage can spread much further.

At minimum, separate everyday work from administration: normal duties under a standard account, administrator rights only for the moments that need them. Keep the number of administrators small and write down who they are. There is more to say about this than fits here, so it has an article of its own.

6. Agree how email is handled

Attachments dressed as invoices, a supplier's bank details changing by email, a login page imitating a system you use. Email remains a common way in.

Agree on procedure before you consider products.

• Never accept a change of bank details from email alone; confirm by phone on a number you already had
• Check the actual sender address rather than the display name — but remember it can be forged, so it is not proof on its own
• Do not log in from a link you were not expecting; open the site from your own bookmark instead
• If something feels wrong, ask. If you already clicked, say so anyway

The last point does the most work. In a company where the person who reports gets blamed, nobody reports, and problems are found late. An atmosphere where "I think I clicked it" can be said out loud matters as much as any product.

7. Keep records, and read them occasionally

Daily log analysis is not the expectation here. For a small company this is enough:

Most cloud services show a sign-in history in their admin screen. Once a month, look for logins from unfamiliar places or times. At the same sitting, review the list of administrator accounts and the sharing settings on shared folders. It takes well under an hour.

Name the person and name the day. Without both, logs only get read after something has already happened.

What any of this costs

Of the seven, the only items with a real price tag are a password manager, somewhere to keep backups, and replacing equipment that is out of support. Multi-factor authentication, updates, permissions, email procedure and log review are all configuration and habit in tools you already pay for.

IPA also runs SECURITY ACTION, a scheme through which a small company declares its own commitment to security. The one-star declaration is a statement of intent to follow the six principles; two stars requires completing a twenty-five-item self-assessment and publishing a basic security policy. Declaring is not itself protection, but the assessment items make a useful checklist of things to look at.

Where it goes wrong

Trying to do all of it at once means stopping halfway. Two items this month and two the next is fine. Four finished is better than seven abandoned.

Do not mistake installation for completion. Multi-factor authentication with no recovery codes, or a backup nobody has tested restoring, is dangerous in its own way, because it comes with a false feeling of safety.

Finally, look outside your own walls. If suppliers or contractors handle your work, hardening your own systems leaves a gap. At minimum, keep a list of which data sits with whom.

In short

Updates, multi-factor authentication, backups, passwords, permissions, email, records. The first four start without a big budget (backups and password management may cost a little). Prove you can restore a backup. Treat recovery codes as part of enabling MFA, not an afterthought. When unsure, use IPA's material as the baseline and go looking for your own gaps.