Cybersecurity for an SME:
where to start
Small businesses don't suffer sophisticated attacks. They suffer an email with a fake invoice, a reused password, an unpatched copy of Windows and a backup nobody ever tested. Cybersecurity for an SME isn't a product: it's a short list of things done in the right order. This is the list, with what each point costs and why it comes before the next.
By Ismael Vázquez, founder and technician · Published 5 November 2026
What gets into an SME is always the same
It isn't a targeted attack. It's an open door that a mass campaign finds.
When we get called after an incident, the story is very similar from one business to the next. An email that seemed to come from a supplier. A password that was the same everywhere. A computer running a Windows that no longer received updates. And a backup that was on the same disk that had just been encrypted, or that nobody had ever tried to restore.
None of those things needs a skilled attacker. They need nobody in the business to be responsible for closing them. And in an SME, there's almost never anyone responsible.
That's why this guide isn't a list of products. It's a list of seven things, in the order it pays to do them, because each one protects against something more frequent than the next.
Seven things, in this order
If you can only do three, do the first three.
Tested backups, with one off site
Not one copy: three, on two types of media, one away from the office and disconnected from the network, as the 3-2-1 rule says. And actually restored at least once, because a backup that has never been restored is an assumption. It's what turns ransomware into a lost afternoon instead of a ransom.
Everything updated, no exceptions
Windows, the browser, the management software, the router, the NAS. The holes used to get in are almost always known and already patched; whoever didn't install the patch is the one who gets hit. If any machine is still on Windows 10, what to do about end of support sets out the three ways forward.
Password manager and two-factor authentication
A different password for each service, stored in a manager, and two-factor authentication on email, banking, the management software and everything that allows it. It's what passwords: what to do and what to stop doing explains. A password stolen from another website is no longer any use for getting into yours.
Email, with staff forewarned
Almost everything comes in by email. The invoice with a changed account number, bank impersonation, the fake tech support call. Technical protection on the mail server, and a company rule: no change of bank account is accepted without calling the supplier on a known number.
Accounts and access reviewed
Who has access to what, in writing. Accounts of people who have left, closed the same day. Administrator access only for those who administer. And outside technicians and suppliers with access while they need it, not afterwards. One hour every quarter.
Separate networks and a firewall
Visitors, cameras and the card terminal on networks separate from the computers, and a business firewall that decides what comes in and goes out, instead of the provider's router. If people work remotely, a VPN with two-factor authentication, as in secure remote working for an SME.
A plan for the day it happens
One page listing who to call, what to disconnect, where the backups are and how to notify customers and the AEPD if personal data is involved. Written beforehand, not during. What you'll have to do is in ransomware: the first few hours and in what to do if you've already been caught out.
What doesn't protect you
We hear both every week.
"We're small, nobody's after us"
True, nobody's after you. Fake email and leaked password campaigns try thousands of businesses at once and get in wherever the door is least secure. Being small doesn't take you off the list: it puts you among those who've closed the fewest doors.
"We've got antivirus"
Antivirus stops what it recognises on the machine. It doesn't stop someone typing their password into a fake website, or an invoice being paid to a changed account, or an unpatched Windows having a known hole, or the backups sitting on the disk that gets encrypted. The seven points above are what antivirus doesn't do.
The problem isn't technical: it's that nobody is in charge of it
Everything on the list is simple. The hard part is getting it done, and keeping it done.
None of the seven points is expensive or complicated. What fails is something else: there's nobody in the business whose job it is to check every month that the backups are running, that the machines are up to date, that the accounts of people who've left are closed. It was done once, when everything was set up, and nobody looked again.
That's why at an SME security is almost never a project: it's part of maintenance. A named person, in-house or contracted, who goes through the list at a fixed interval and can see remotely, with monitoring tools, whether a machine has gone weeks without updating or a backup has been failing for days. What a maintenance contract should include sets out what to ask for in writing.
And if you're deciding where the important things live, it's worth thinking about it with security in mind too: in server in the office or in the cloud we explain what changes in each case.
Where to start based on what you have
Specific situations, with the first thing we'd do in each.
| Situation | First step |
|---|---|
| Small practice, everything on each person's laptop | Automatic cloud backup, two-factor on email, a password manager. One week |
| Office with a server and management software | Off-site backup that's been restored, a UPS, server updates, accounts reviewed |
| Shop with card terminal, cameras and customer Wi-Fi | Separate the networks: card terminal, cameras and customers apart from the computers. Default passwords gone |
| People working from home | VPN with two-factor, nothing exposed to the internet, personal devices kept away from company data |
| Clinic, or practice with sensitive data | All of the above plus the access log and the 72-hour breach plan from the GDPR checklist |
| Something has already happened | Isolate, don't pay, report. Ransomware or if you've been caught out, and INCIBE's 017 helpline |
Do the first three this week and put a name to the rest
Tested backups, updates and two-factor authentication prevent most of what we see.
If you do nothing else, do this: an off-site backup you've restored, everything updated and two-factor authentication on email. With that, most of the incidents that reach us wouldn't have happened, or would have stayed a scare. The other four points, with a date and someone responsible, the following month.
In solutions for businesses we start with an audit that goes through this same list at your business and tells you what's covered and what isn't. Whatever's missing can be done in one go or as part of the monthly maintenance, which is where it usually ends up, because that's the only thing that guarantees it keeps getting done.
What people usually ask
Is a small business really a target?+
Yes, precisely because it's small. The attacks that reach an SME aren't aimed at it: they're mass campaigns of emails with fake invoices, bank alerts or passwords stolen from another website, trying their luck with thousands of businesses at once. They get in wherever the door is least secure, and SMEs have the least secure doors because nobody is in charge of them. The attacker doesn't know who you are and doesn't care: they know that an eight-person business with no backups will pay sooner than a large one with a security department. INCIBE's alerts and the sector's annual reports say it every year: most incidents at Spanish businesses happen at SMEs, and most start with an email.
Isn't an antivirus enough?+
An antivirus stops what it recognises on the machine, and it's necessary, but it doesn't cover what gets in most often. It doesn't stop someone typing their password into a fake bank website, or an invoice being paid to a changed account number, or an unpatched Windows having a known hole, or the backups sitting on the same disk the ransomware encrypts. The seven points in this guide are what the antivirus doesn't do. What is worth having is a managed antivirus: someone checking remotely whether it's active on every machine and what it has detected, instead of trusting each person to look at their own icon.
How much does all this cost?+
Less than a single incident. Tested backups, updates, two-factor authentication and account reviews are mostly work, not purchases: a password manager and cloud backup for a small business cost a few euros per user per month. What is an investment is a business firewall and, if there's a server, a UPS. What costs most is the time to do it and keep it up, which is why at SMEs it usually goes into a maintenance contract, with a technician who reviews it every month. In our case, the Essential plan with managed backups, antivirus and updates starts at €49 a month, and the Managed plan with an assigned technician and monitoring at €99; what a maintenance contract should include explains what to ask for in any case.
What do I do with the accounts of people who have left?+
Close them the same day the person leaves, and check every few months that none is still open. It's one of the most common failings and one of the easiest to avoid: a former employee with their email still active, access to the management software, or a Wi-Fi password that was never changed. You don't have to think badly of anyone; it only takes their password, which they may have reused on other websites, turning up in a data breach. The same goes for suppliers and outside technicians who were given access for a specific job. A list of who has access to what, reviewed every quarter, is the tool; it takes an hour.
Are there any legal obligations?+
Several that already apply to every business, and one that may be on its way. The GDPR requires personal data to be protected with appropriate measures and a security breach to be reported to the AEPD, Spain's data protection authority, within 72 hours; an SME holding customer data is already covered, and we go into detail in the GDPR checklist for practices and clinics. The European NIS2 directive, which Spain is transposing into national law, affects medium and large companies in specific sectors, not the typical SME, but it does affect some of their customers, who are starting to require security measures from their suppliers by contract. And if you handle health data or work for the public sector, there are specific requirements. What this guide proposes covers what's reasonable for any SME; whatever your sector adds, take up with your adviser.
What do I do if something has already happened?+
It depends on what. If someone has fallen for an email and given away a password, what to do if you've already been caught out sets out the order for the first two hours: change access details, alert the bank if relevant, report it. If files show up encrypted or with a note demanding money, ransomware: the first few hours covers what to do and what not to do: isolate, don't switch off, don't pay, report. In both cases, INCIBE's free 017 helpline assists businesses and individuals and advises on the steps to take and on reporting. And after the incident, this seven-point list is exactly what needs reviewing, because something on it was missing.
Let’s take the step together
Shall we look at it
together?
Tell us about your situation and we'll give you just the advice you need, without overselling. Free quote. We take calls in Spanish or Catalan; in English we reply by email or WhatsApp.
644 836 122CALL OR WHATSAPP USAsk for advice and a quote
Fill this in and we'll call you. No obligation.