IT security for small businesses: what really matters?

Why small businesses are targets too

Many attacks are not aimed at big names. Automated programs search the internet for open doors: outdated software, weak passwords, unsecured remote access. Add to that fraudulent emails that go out to many recipients at once. Whether a business gets hit therefore depends less on its size than on how easy it is to attack.

The consequences are often particularly noticeable for small companies: systems stand still, data is encrypted or leaked, customers have to be informed. Without an in-house IT department, there is often nobody who can react immediately. The best protection is therefore preparation: a few but reliable measures, clear responsibilities and a plan for the worst case.

Backups: the most important safeguard

A good backup turns a catastrophe into an annoyance. The 3-2-1 rule has proven itself: three copies of your data, on two different storage media, with one copy at a different location. Against ransomware, a copy that is disconnected from the network or immutable also helps, because otherwise the backups are often encrypted along with everything else.

Equally important is the test: a backup whose restoration has never been checked is a promise without proof. At regular intervals, try to restore individual files and ideally a whole system. Also think of data in the cloud, such as emails, documents and accounting: the provider runs the platform, but you are often responsible for backing up your content.

Updates, antivirus and expired support

A large share of successful attacks exploit known vulnerabilities for which updates have long existed. Keep operating systems, browsers, office programs, routers and industry software up to date, and enable automatic updates where possible. A simple device list with age, operating system and person responsible shows where action is needed. Anyone who schedules updates firmly closes these gaps before they are exploited.

Devices and programs without manufacturer support deserve special attention. Regular support for Windows 10 ended on October 14, 2025; such computers should be replaced, switched over or at least strictly secured. Up-to-date antivirus belongs on every device but replaces neither updates nor attentiveness. It is one layer in a multi-layered protection, not the whole protection.

Passwords, two-factor sign-in and access rights

Stolen credentials are among the most common entry points. Use long, unique passwords, ideally with a password manager, so nobody has to memorize or write down dozens of passwords. Enable two-factor sign-in first where a break-in would do the greatest damage: email accounts, cloud services, online banking, administration access to the website.

Assign rights as needed. Not every employee needs administrator rights or access to all folders. Define who sets up new accounts and who blocks them when someone leaves the company or changes role. Shared accounts should be the exception, because then it cannot be traced who did what.

• Password manager instead of notes and reuse
• Two-factor sign-in for email, cloud and administration access
• Administrator rights only for a few justified cases
• Block accounts of departed employees promptly
• Avoid shared accounts where possible

Employees: recognizing phishing and reacting correctly

Technology alone is not enough, because many attacks begin with an email that entices people to click, open or pay. Typical signs are time pressure, unusual sender addresses, unexpected attachments and links that do not match the displayed text. Particularly sensitive are payment requests or changed bank details from supposed suppliers or superiors. When in doubt, a call-back to a known number helps.

A short, regular briefing with examples from your own daily work is more effective than a long leaflet. A no-blame culture is important: anyone who clicked by mistake must be able to report it immediately without fearing sanctions. Define who suspected cases go to and what to do in the first minutes.

Network, website and emergency plan

Secure router and Wi-Fi with current firmware and strong passwords, separate the guest Wi-Fi from the company network and protect remote access, for example for home office or service providers, with two-factor sign-in. Your own website belongs here too: content management system, plugins and access must be up to date and secured, otherwise it becomes an entry point and a reputational risk.

Write a simple emergency plan on one page: who is informed first, which devices are disconnected from the network, where are the backups, who talks to customers? In incidents involving personal data, you must check whether a report to the data protection authority is necessary within 72 hours. This guide does not replace legal advice. For support, together with our IT service partners we offer support from 1st to 3rd level; we calculate the service individually according to scope.