Five cyber basics for a 20-person business

You do not need a security operations centre to be a hard target. Most attacks on small businesses are opportunistic and stop at the first competent wall. These five basics are the wall. [REVIEW BEFORE PUBLISHING]

1. Multi-factor authentication on every account

MFA means that after the password you also approve a prompt on your phone. It is the single most effective control available to a small business, because a stolen password alone is no longer enough to get in.

The usual excuse is that staff find it annoying. In practice, Microsoft Authenticator takes two seconds a day per person. The alternative — a fraudster sitting in your finance email for three weeks while you are none the wiser — is far more annoying.

Enforce MFA on all users, not just management.
Do not allow SMS as the only method where an app is possible.
Lock down the few global-admin accounts hardest.

2. Clean up who is an administrator

In most tenants we review, far more people hold admin rights than need them, and several belong to staff who left years ago. Every extra admin account is a second front door into your whole system.

Give people the access their job needs and nothing more. When someone leaves, their account should be disabled the same day — not "when we get to it".

List every global admin and justify each one.
Disable (do not just delete) leaver accounts, keeping the mailbox for 30 days.
Use shared, company-owned accounts for roles, never a personal Gmail.

3. Backups you have actually restored

A backup you have never restored is a hope, not a plan. Ransomware and accidental deletion are both real; the difference between a bad week and a business-ending event is whether you have a recent, tested, offline copy.

Follow the 3-2-1 idea: three copies, two media types, one off-site or immutable. Then test a restore at least a couple of times a year and write down how long it took.

Include the things people forget: mailboxes, SharePoint, the line-of-business database.
Keep at least one copy the attacker cannot reach from the network.
Time a real restore so you know your recovery window.

4. Patch the boring things

Most breaches still walk through unpatched software that had a fix available for months. Windows, browsers, and anything internet-facing should update automatically on a schedule that suits your trading hours.

This is the least glamorous basic on the list and one of the highest-return. If you run an on-prem server, patching it is part of the job — and if it is Windows Server 2016, remember that free security updates end 12 January 2027.

Turn on automatic updates for Windows and browsers.
Patch network gear and any remote-access software first.
Plan the Server 2016 exit now, not in December 2026.

5. A written plan for the bad day

When something goes wrong, people freeze or improvise. A one-page runbook — who to call, what to isolate, when to notify the Information Regulator and affected people — turns a panic into a process.

This is the IT-controls side of POPIA. It does not make you compliant on its own; POPIA is broader than IT and legal advice must come from an attorney. But it means you are not writing your response while the incident is still running.

Name one person to make the call and one backup.
Keep your engineer’s number on paper, not only in the PC.
Note the Information Regulator’s reporting expectations with your attorney.

Put this into practice

Want these checked properly? The IT & Security Health Review looks at your Microsoft 365 secure score, MFA gaps, admin accounts, backups and patch status, and gives you a one-page risk summary.

Book a Health Check WhatsApp us

← All resources