Most small organisations don't need an enterprise security programme. They need five foundational controls applied consistently. Here's what those are and how to implement them without a dedicated IT team.
Small organisations aren't too small to be cybersecurity targets. They're, in many respects, more attractive targets than large organisations: they hold real data (financial records, staff information, beneficiary data), they often have weak controls, and they typically lack the resources to recover quickly from an incident. Cybercriminals know this and have adjusted accordingly. The good news is that most successful attacks against small organisations exploit basic failures — weak passwords, unpatched software, staff clicking phishing links, no backups. Fixing those basic failures doesn't require an enterprise security budget or a dedicated IT team. It requires five controls, applied consistently. This guide covers: - Why small organisations are targeted - The five controls that address the majority of risk - How to implement each without specialist knowledge - How to build awareness in a small team ## Why Small Organisations Are Targeted The most common attacks against small organisations aren't sophisticated. They're automated: bots scanning for devices with default credentials, phishing emails sent to millions of addresses hoping a few percent click, ransomware delivered through unpatched vulnerabilities. These attacks don't discriminate by organisation size. They discriminate by security posture — and small organisations often have weak ones. The consequences of a successful attack on a small organisation are disproportionate. A ransomware incident that encrypts all your files, a business email compromise that diverts a payment, or a data breach affecting beneficiary records can each cause damage that takes months to resolve. Many organisations never fully recover. > The question isn't whether your organisation is interesting enough to be attacked. The question is whether it's easy enough to be worth the (minimal) effort. ## Control 1: Strong, Unique Passwords and a Password Manager The majority of account compromises start with a weak or reused password. "Password123", the organisation's name with a number, or — critically — the same password used across multiple systems means that a breach of one system hands attackers access to everything else. The solution is a password manager (Bitwarden is free and reputable; 1Password and LastPass offer low-cost team plans). A password manager generates and stores strong, unique passwords for every account. The team only needs to remember one master password each — and that master password should be long, not just complex. Enforce unique passwords for all critical systems: email, banking, accounting software, any system holding personal data. This single control eliminates the majority of account-takeover risk. ## Control 2: Multi-Factor Authentication on Critical Accounts Multi-factor authentication (MFA) requires a second verification step — typically a code from an app on your phone — in addition to a password. Even if an attacker obtains a password, they can't log in without the second factor. Enable MFA on every system that supports it, prioritising: email (attackers with email access can reset every other password), banking, accounting software, and cloud storage. Microsoft 365 and Google Workspace both support MFA and allow administrators to enforce it for all users. Enabling it takes ten minutes; it's the single highest-value security action a small organisation can take after strong passwords. ## Control 3: Patched Software and Operating Systems Software vulnerabilities are discovered regularly and exploited actively. The window between a vulnerability being discovered and being actively exploited by attackers is often measured in days. The window between a patch being released and most small organisations applying it's often measured in months. Enable automatic updates on all operating systems and software, particularly on anything internet-facing (email clients, browsers, remote access tools). Review monthly whether updates are actually being applied. On older machines or unsupported operating systems, consider whether the security risk has become unacceptable — an unsupported Windows version receiving no security updates is a significant liability. ## Control 4: Email Phishing Awareness Phishing — emails designed to trick recipients into clicking a link, entering credentials, or authorising a payment — is the most common delivery mechanism for attacks against small organisations. The emails are increasingly convincing: they mimic banks, SARS, courier companies, Microsoft, and supplier emails with high fidelity. The awareness training required to address this doesn't need to be formal. A regular team conversation about what phishing looks like, combined with a clear rule — verify any payment instruction or credential request by phone before acting — addresses the majority of risk. The specific patterns to teach: urgency in the subject line, mismatched sender domains (the display name says "SARS" but the email address is a Gmail account), links that lo...