Cybersecurity for a small business: the minimum you need to have
You do not need a security department. You need six things, nearly all free, and the only one that costs money is the one that actually saves you: a backup the attacker cannot delete.
· Security
The conversation about cybersecurity in a five-person company usually ends with «that is for big companies». And then comes the day somebody opens an attachment, the files turn up encrypted and it turns out the backup was in the same shared folder as everything else.
What follows is not a corporate security plan. It is six measures, ordered by what they actually prevent.
1. A backup the attacker cannot delete
It is the only measure that saves you once everything else has failed, and the one almost everybody gets wrong. A backup on a disk connected to the computer, or in a synced folder, gets encrypted at the same time as the original: it is not a backup, it is a second original.
What works: a copy that is offline or immutable — one that cannot be modified for a set period — with previous versions accessible. And a detail most people skip: testing the restore. A backup that has never been restored is not a backup, it is a folder with hope in it.
2. Two-factor on email and on banking
Most attacks on small businesses are not sophisticated: they are a stolen password used from somewhere else. The second factor turns a stolen password into a failed attempt.
Priority: email first, always. Whoever controls your email can reset the password for everything else.
3. A password manager, not a spreadsheet
The repeated password is what turns somebody else's breach into your problem: some service you were registered with gets breached and, if you used the same key, they now have your email one. A manager generates a different one for every site and nobody has to remember them.
4. Update. That is all
Almost all automated attacks exploit known and already-fixed flaws. Updating the system, the browser and — very especially — the company website closes the door most of them come through. If you have a WordPress site untouched for two years, that is probably your biggest risk today.
5. Knowing who has access to what
Make the list once: who gets into the email, the banking, the server, the invoicing software, the website. There are nearly always two or three accesses belonging to people who have left the company, and a shared account everybody uses.
When somebody leaves, their accesses are revoked the same day. It is not distrust: a forgotten account is a door with no owner.
6. The team recognising a boss fraud
The fraud that takes the most money from small businesses uses no virus at all: it is an email that looks like it is from the manager asking for an urgent transfer, or a supplier who «has changed bank account». The defence is not technical, it is a procedure: no change of bank account is accepted by email, it is confirmed by phone on a number you already had.
And what the law requires of you if it happens
If the incident involves personal data of customers or employees, it is not just a technical problem. In Spain, the GDPR requires notification to the supervisory authority within 72 hours when the breach poses a risk to the rights of those affected. In Chile, Ley 21.719 establishes the same duty to notify the competent body and the affected data subjects.
That means that on the day of the incident there are two clocks: recovering the business, and the legal one. It is worth knowing who handles each before it starts ticking.
If this sounds like you
Reviewing these six points in a small business is a single session's work, and two holes nobody knew were open nearly always turn up. That is what we do in cybersecurity. And if you also handle customer data with AI tools, we cover the legal side in AI and data compliance.
We are Mindset & Code: automation, data and development for small businesses, with the technical team that builds it and keeps it running. You can see what we do and what it costs — published, with no surprise quotes.
Sources: Spanish Data Protection Agency, notification of security breaches; Ley 21.719 on personal data protection in Chile. General guidance; it does not replace a security audit.