10 practical cybersecurity improvements small organisations can make this week
If you run a small organisation, you probably already have some of the cybersecurity fundamentals covered. Your computers receive security updates. You have malware protection in place. You have rules around passwords and access to important systems.
These things matter. But good cybersecurity extends considerably further.
We recently completed a detailed security assessment for a large enterprise client. It contained well over a hundred questions covering everything from access control and incident response to encryption, suppliers, and business continuity.
Working through an assessment like this properly is a useful exercise. It forces you to look beyond whether security controls theoretically exist and ask a more important question: can we demonstrate that they are consistently applied, monitored, and tested?
That prompted us to put together this list. It is not intended to be a complete cybersecurity framework, and some organisations will need considerably more sophisticated controls. But these are ten practical improvements that many smaller organisations can begin making without a dedicated security team or a major technology project.
1. Use MFA wherever you can
Multi-factor authentication (MFA) makes it considerably harder for an attacker to gain access to an account using a stolen password alone.
Many organisations already use MFA for their most obvious systems, such as Microsoft 365, Google Workspace, or their hosting platform. Go further.
Review every important service your team uses, including:
- Hosting platforms
- Domain registrars and DNS
- Code repositories
- Password managers
- Project management systems
- Cloud storage
- Finance systems
- Analytics and marketing platforms
If MFA is available, consider whether it should be required for everyone with access, particularly administrators and anyone with access to sensitive information.
Where possible, prefer stronger authentication methods such as passkeys, security keys, or authenticator apps over SMS.
If an important service does not support MFA, record that as a security risk and consider whether the service remains appropriate for your organisation.
Practical action: Make a list of your important online services and identify which accounts do not yet have MFA enabled.
2. Eliminate shared accounts wherever possible
If several people use the same username and password, it becomes much harder to establish who accessed a system or made a particular change. It also creates problems when someone leaves.
Where a service supports individual user accounts, give each person their own account and grant only the access they need to do their job.
Sometimes shared credentials are unavoidable. Legacy systems and some third-party services still provide only a single account. In those cases, store the credentials in a reputable business password manager rather than sending them by email, Slack, Teams, or another messaging service. Control who can access the credential and review that access periodically.
The password manager itself should be protected appropriately, including MFA.
Practical action: Identify accounts currently shared between team members and replace them with individual accounts wherever the system allows it.
3. Check your email domain security
Email impersonation remains a significant security risk. An attacker does not necessarily need access to your email account to cause harm. They may instead attempt to send a message that appears to come from your domain.
This is particularly dangerous when clients or suppliers regularly receive invoices or payment instructions from your organisation.
Three standards are particularly important:
- SPF helps identify which systems are authorised to send email for your domain
- DKIM provides a cryptographic signature that helps recipients verify that a message is genuine and has not been altered
- DMARC tells receiving systems how to handle messages that fail authentication checks and provides reporting that can help identify abuse
The NCSC provides tools and guidance to help UK organisations check their email security configuration, including a free checking service.
Simply having SPF, DKIM, and DMARC records present does not necessarily mean they are configured correctly. They need to reflect the systems that genuinely send email on your behalf and should be reviewed as those systems change.
Practical action: Check whether SPF, DKIM, and DMARC are correctly configured for every domain your organisation uses for email.
4. Encrypt devices and lock them automatically
Laptops and mobile devices leave the office. They are used at home, on trains, in hotels, at conferences, and in shared workspaces. Occasionally, they are lost or stolen.
Full-disk encryption provides an important layer of protection by making the information stored on a device much harder to access without the appropriate credentials. Modern operating systems include established encryption technologies such as BitLocker on Windows and FileVault on macOS.
The ICO recommends enabling storage encryption on devices such as laptops, smartphones, and tablets that store personal information.
Encryption should be accompanied by appropriate device locking. Configure devices to lock automatically after a suitable period of inactivity and require authentication when the user returns.
Practical action: Confirm that encryption and automatic screen locking are centrally configured or consistently enabled across every organisation-owned device.
5. Create a simple incident response plan
A cybersecurity incident is a particularly bad time to start deciding who is responsible for cybersecurity incidents. Even a small organisation should have a basic response plan.
At minimum, everyone should know:
- Who needs to be informed
- Who is responsible for coordinating the response
- Which technical suppliers may need to be contacted
- How key people can be contacted out of hours
- How the team will communicate if normal systems are unavailable or compromised
- Where important insurance, supplier, and regulatory information can be found
Keep an offline or independently accessible copy of essential contact details. An incident response document stored exclusively in a system you can no longer access is of limited use.
The NCSC’s Small Business Guide to Response and Recovery provides specific response and recovery guidance for small and medium-sized organisations.
A simple plan is considerably better than no plan at all, but it should be developed and tested as your organisation’s security arrangements mature.
Practical action: Create a one-page incident contact and escalation sheet and make sure the people named in it know what is expected of them.
6. Test that you can restore your backups
Having backups and being able to recover from them are not quite the same thing. A backup process can fail silently. Files may be incomplete. Credentials may be missing. The recovery process itself may never have been tested.
This is why restoration matters.
For a web agency, testing does not necessarily require an artificial annual disaster-recovery exercise. If you routinely create staging or development environments from production backups, those activities can provide useful real-world evidence that parts of the restore process are working.
But make sure you are testing what actually matters:
- Can you restore the data you depend upon?
- Can you recover it within a useful timeframe?
- Do the people responsible know how?
- Are backups appropriately protected from the same incident that might affect the live system?
Practical action: Choose one important system and perform a controlled restore into a safe environment.
7. Start a risk register
The phrase “risk register” sounds more bureaucratic than the underlying idea really is. At its simplest, it is a structured list of:
- What could go wrong
- How likely it is
- What the impact would be
- What controls are already in place
- What further action is required
- Who owns the risk
- When it will next be reviewed
Its real value is not the spreadsheet. It is the discipline of making conscious decisions about risks rather than allowing known problems to remain indefinitely in somebody’s head.
Perhaps a supplier does not support MFA. Perhaps an important legacy system cannot yet be replaced. Perhaps a member of staff temporarily needs broader access than you would normally permit. Not every risk can be eliminated immediately. Recording it means the organisation has acknowledged it, assigned responsibility, and can review the decision later.
Practical action: Create a basic risk register and start with the five security issues that currently concern you most.
8. Monitor vulnerabilities relevant to your technology
Security updates should be applied promptly, but you also need to know when important vulnerabilities affect the technology you use. Do not rely solely on general technology news.
Identify authoritative security information relevant to your actual systems and suppliers. For WordPress organisations, for example, this might include vulnerability intelligence covering WordPress core, plugins, and themes, alongside NCSC alerts and notifications from hosting and software suppliers.
The same principle applies whatever technology you use. Knowing that a vulnerability exists also allows you to make a more informed decision about urgency. A critical vulnerability affecting an internet-facing system deserves very different treatment from a low-severity issue in software you do not expose publicly.
Practical action: Identify the security advisory sources relevant to your main platforms and make somebody responsible for monitoring them.
9. Formalise your leaver process
When someone leaves an organisation, their access should be removed as soon as it is no longer required. That sounds obvious. In practice, smaller organisations can accumulate accounts across dozens of systems, particularly when staff, freelancers, and contractors have worked across multiple projects.
A leaver checklist might include:
- Email and identity accounts
- Cloud storage
- Hosting platforms
- Domain and DNS services
- Code repositories
- Password manager access
- Project management tools
- Finance and administrative systems
- Client systems
- Physical devices and security keys
Where appropriate, suspend rather than immediately delete accounts so that records and audit information are retained while access is removed. Shared passwords known to the departing person may also need to be changed. The same process should apply to contractors, freelancers, and temporary staff.
Practical action: Write one checklist covering every system somebody might access and use it whenever a person leaves or changes role.
10. Review your cyber insurance
Cyber insurance is not a substitute for good cybersecurity. Insurers increasingly expect organisations to demonstrate that appropriate security controls are already in place. But appropriate cover can provide valuable financial and specialist support when an incident occurs.
Depending on the policy, that may include access to:
- Incident response specialists
- Digital forensics
- Legal advice
- Data breach support
- Public relations advice
- Business interruption cover
- Third-party liability
If you already have cyber cover, read the policy rather than assuming what it includes. Look at the limits and exclusions. Understand your obligations. Check whether incidents involving important suppliers or service providers are covered, and make sure the security controls you declared when taking out the policy remain in place.
Practical action: Find your current policy and establish exactly what would happen, and whom you would contact, if you discovered a serious cyber incident tomorrow.
Cybersecurity is a process, not a project
None of these measures makes an organisation secure on its own. Together, however, they encourage something more important: a systematic approach to cybersecurity.
Know which systems you use. Know who can access them. Protect important accounts. Keep systems updated. Record known risks. Prepare for incidents. Test that recovery works. And keep reviewing all of the above as your organisation changes.
For organisations considering Cyber Essentials, these activities also provide useful preparation for thinking more systematically about security. It is important to distinguish between general cybersecurity good practice and the specific requirements of the scheme, however.
Cyber Essentials focuses on five technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection. Cyber Essentials Plus applies the same controls but adds independent technical verification.
The ten measures in this article extend beyond those requirements and should not be treated as a Cyber Essentials checklist.
The NCSC’s guidance for small organisations is an excellent starting point for organisations looking to strengthen their cybersecurity, and many improvements can be made without a dedicated security team or a large budget. The important thing is to start.
If you would like to discuss the security, hosting, or ongoing management of your website and related infrastructure, speak to the Castlegate IT team.
'
'