Cyber Security for Small Business: 9 Critical Controls to Check
Search for cyber security for small business and you get the same page twenty times over: use strong passwords, train your staff, keep backups. All true, all useless, because none of it tells you which setting, in which admin centre, at which licence tier. This is written for a business that already pays for Microsoft 365 — nine controls you can go and check today, each one against Microsoft’s own documentation rather than somebody’s blog.
Every figure here comes from a primary source read while writing: the Verizon 2026 DBIR, Microsoft Learn, and the NCSC’s Cyber Essentials requirements. Where a number does not honestly exist, this post says so rather than borrowing one.
Why is cyber security for small business a different problem?
Not because the attackers are different. Because nobody chose you.
Verizon’s 2026 Data Breach Investigations Report carries a section devoted to organisations with fewer than 1,000 employees — 7,256 incidents, 7,152 of them with confirmed data disclosure. The initial access breakdown for those breaches is blunt: exploitation of vulnerabilities 26%, credential abuse 13%, phishing 9%. External actors, 100%. Financial motive, 100%.
The report is equally blunt about why it happens to you specifically. The attacks are opportunistic, and “it’s not so much about industry or the revenue of the victims but the fact that the victims had credentials that were compromised (38%) or unpatched vulnerabilities in edge devices (29%) that resulted in them being victimized.”
That sentence is the whole argument for working from a control list rather than a threat list. A scanner found a version number. It did not care what you sell.
Two other figures from the same section are worth sitting with. A third party was involved in 55% of those breaches, and the human element in 45%. And of the ransomware cases where organisation size was known, about 96% of the victims were small and medium businesses. Those cases rarely make the news, which is precisely why the risk feels smaller than it is.
The average cost of a cyber attack on small business is unknowable
This is one of the most-searched questions in the category, and it is almost always answered with a number that traces back to nothing. We are not going to publish one, and it is worth explaining why, because the reasoning is more useful than the figure would have been.
The DBIR is the largest breach dataset in the industry and it undermines its own cost figures in public. It notes that the median ransom payments it published for 2023 and 2024 in the 2026 edition are different from the ones it published for the same years in the 2025 edition, because new contributors were added. It states plainly that “gaining an accurate grasp of the scale of the Ransomware threat has been an ongoing challenge for the industry”. And it reports that criminal groups reuse old breaches, repost other groups’ breaches, and invent victims outright to build a reputation.
When Verizon cross-referenced publicised victims against known criminal wallet payments, the median share of publicised victims per group who actually paid came out at about 9%. Meanwhile 69% of the ransomware cases in its 2025 data did not pay at all, up from 65% the year before.
So the denominator is contaminated, the numerator moves between editions, and most of the incidents are never disclosed at all. Any “average cost” built on that is arithmetic performed on noise.
Measure your own instead. Take payroll plus gross margin per working hour, multiply by the number of hours you would honestly need to get email, files and your line-of-business system back, and add whatever a supplier would charge to do the recovery for you. That number is derived from your own figures rather than someone else’s survey, and it is the only version of the question a board can act on. If you cannot answer the recovery-hours part, that is the finding.
Nine controls, and where to check each one
Each of these is a specific screen you can open. None of them requires a purchase you have not already made if you are on Microsoft 365 Business Premium, and several work on any paid tier.
1. Which identity baseline is actually switched on
There are two, and Microsoft is explicit that you cannot run both. Security defaults are free and binary: they require MFA registration for everyone, force MFA for fourteen administrator roles, block legacy authentication protocols, block device code flow, and require MFA for anything touching the Azure portal or the Entra admin centre. Conditional Access is the alternative and needs at least Microsoft Entra ID P1, which Business Premium includes.
Check it at the Microsoft Entra admin centre under Entra ID → Overview → Properties → Manage security defaults. The failure mode is a tenant that disabled security defaults to build Conditional Access policies and then never finished building them, leaving nothing enforced at all.
2. The accounts excluded from it
Every tenant has exceptions, and the exceptions are the accounts an attacker wants. Microsoft documents that the directory synchronisation accounts are excluded from security defaults entirely and are never prompted for MFA. Conditional Access exclusion groups accumulate the same way — a service account, a director who found the prompts disruptive, a break-glass account created during a migration.
List them, name an owner for each, and put a review date against it. We wrote about why this matters more than the MFA rollout itself in the gaps MFA does not close: in ransomware cases where credentials were the way in, the overwhelming majority of victims already had MFA deployed.
3. How many Global Administrators you have
Microsoft’s published guidance on Entra roles is specific: fewer than five people should hold Global Administrator, and fewer than ten privileged role assignments should exist in total. If you cross five, Entra shows an alert card on its Overview page.
Two of that handful should be cloud-only emergency access accounts belonging to no individual. And Microsoft recommends against using on-premises synced accounts for Entra roles at all — if the on-premises account falls, so does the tenant. This is also the control cyber insurers ask about most precisely, as we set out in the controls underwriters check on the application form.
4. Whether your preset security policies apply to anyone
This one catches nearly everybody. Microsoft ships Standard and Strict preset security policies containing its own recommended anti-spam, anti-malware and anti-phishing settings — and, in Microsoft’s words, “until you turn on the profiles and assign users to them, the Standard and Strict preset security policies are assigned to no one”.
They are free with the licence and off by default. Check at security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Preset Security Policies. Strict is applied first, then Standard, then custom policies, then the defaults.
5. Impersonation protection for the people who authorise payments
Microsoft states that the default anti-phishing policy provides spoof protection and mailbox intelligence, but that “the other available impersonation protection and phishing email thresholds settings aren’t configured in the default policy”.
In practice that means user impersonation protection is off, and even where mailbox intelligence detects an impersonated user the default action is don’t apply any action. The recommended settings table also shows the first contact safety tip — the banner warning that you have never had mail from this sender before — is not selected by default and is switched on by both presets.
Name your directors, your finance staff and anyone who can move money as protected senders. This is the single cheapest control on the list against invoice fraud.
6. Safe Links and Safe Attachments beyond the built-in tier
The Built-in protection preset is assigned to all recipients by default, so you do get Safe Links and Safe Attachments. It is the weakest tier, though: built-in protection does not apply Safe Links to internal senders and does not rewrite URLs. Standard and Strict do both. Knowing which tier a mailbox is actually on is a two-minute check and most people assume the better answer.
7. Your patch window, expressed in days
“We patch regularly” is not a control. The NCSC’s Cyber Essentials requirements, v3.3, April 2026 give the number: updates fixing vulnerabilities rated critical or high risk by the vendor, or carrying a CVSS v3 base score of 7 or above, must be applied within 14 days of release. Where the vendor gives no severity detail, the same 14 days applies.
Set against the DBIR finding that exploitation of vulnerabilities is now the top initial access vector in small-business breaches, this is the control most likely to be quietly failing. The edge devices matter most — firewalls, VPN appliances, remote access gateways — and they are the ones nobody has a maintenance window for. We covered why in hardening systems you cannot physically reach.
8. How long your audit log survives
You cannot investigate what was never recorded. Microsoft’s audit log retention documentation states that the default retention for Audit (Standard) changed from 90 days to 180 days, with logs generated before 17 October 2023 still held for 90. Longer than 180 days requires E5 or a Purview add-on licence.
Six months sounds generous until you notice how long compromises sit undetected. Check what your tenant actually holds before you need it, not during an incident — and note that the same logs are what a regulator will ask for. Our POPIA compliance checklist covers the reporting duty those records support.
9. What happens to your data when somebody deletes it
Microsoft 365 retention is not a backup, and the published periods are shorter than most people assume. Deleted items in SharePoint and OneDrive are held across the two-stage recycle bin for 93 days and then purged. When a user account is deleted from Entra ID, Microsoft’s documented process gives a default OneDrive retention of 30 days before the drive moves to the site collection recycle bin.
None of that is a restore point you control, and none of it survives a determined attacker with an administrator token. The question is not whether you have backups but whether you have restored from them, which is the argument in our piece on running a real restore drill.
The best cyber security for small business is not a product
The two phrases people search alongside this one are “best cyber security for small business” and “cyber security companies for small businesses”, and both assume the answer is something you buy. It usually is not.
Eight of the nine controls above are already paid for. What is missing is not a tool but a named owner, a review date, and evidence that somebody looked. A firm that sells you a product before it has read your Entra properties page is selling you a product, not an assessment.
The reasonable use of an outside firm is the part you genuinely cannot do: knowing which of Microsoft’s several thousand settings actually change your risk, and having someone accountable for checking them on a schedule when the business has no full-time IT person. That is a governance problem before it is a security one.
Where the standard advice is actively wrong
The tips lists all say enforce strong passwords, change them regularly, and demand a symbol. Cyber Essentials — a government-backed scheme, not a vendor — explicitly tells you to do the opposite. Its requirements list “not enforcing regular password expiry” and “not enforcing password complexity requirements” as the things you should be doing to support good passwords.
What it asks for instead: MFA, or a 12-character minimum with no maximum, or 8 characters with automatic blocking of common passwords from a deny list. Plus brute-force protection — no more than 10 guesses in 5 minutes, or lockout after 10 attempts. It also notes that SMS is not the strongest second factor but is enormously better than none.
If your password policy still expires everything every 90 days, you are enforcing a rule the standard-setters abandoned, and paying for it in reused passwords with a digit on the end.
When this cyber security for small business checklist is the wrong start
Three cases, and they come up often enough to be worth naming.
You are not on Microsoft 365. If your estate is Google Workspace, or genuinely on-premises, controls 1 and 4 through 9 do not map cleanly. The shape of the argument holds — find the platform’s own baseline, find what it leaves off by default — but the screens are different and following this list literally will waste your afternoon.
You are mid-incident. If something is happening now, stop reading control lists. Containment, evidence preservation and legal notification come first, in that order, and hardening during an active compromise can destroy the evidence you will need.
You have a regulator or a contract driving the work. If a client questionnaire, an insurer or a sector regulator has given you a specific control set, work from that document, not this one. Overlap is high but the gaps will be exactly the items you get audited on.
And one honest limit on our part: nine controls is not a security programme. It is the subset that is checkable in an afternoon, costs nothing, and closes the routes that the largest breach dataset in the industry says are actually being used against businesses your size.
The order we would work through it
Cyber security for small business work has an order to it, and identity comes first. Confirm which baseline is on, then enumerate every exclusion and exemption, because an unenforced tenant is not improved by better email filtering. Then the administrator count, which is a five-minute read of one page.
Email policies next: turn on a preset, configure impersonation protection for the people who authorise payments, and confirm which Safe Links tier your mailboxes are really on.
Then the slower ones. Write down your patch window as a number of days and see whether the edge devices meet it. Check your audit retention. And book a restore test with a date on it, because that is the control that tells you what every other failure will cost you.
If you want a second pair of eyes on the results rather than a product recommendation, that is the kind of work we do remotely, for clients in several countries. The risk management service page sets out what that looks like, and it starts with reading your tenant rather than quoting you a licence.