Quick answer: A growing business should get the basics right before buying anything advanced. That means passkeys or two-step verification on every business-critical account, a password manager, automatic updates, backups that follow the 3-2-1 rule, and a written incident response plan. As the business grows, add security monitoring, either through an in-house security operations team or a managed detection and response (MDR) service. In India, know your reporting duties too: CERT-In expects certain cyber incidents to be reported within six hours.
When you first started your business, your biggest worries were probably developing or sourcing a product, building a brand and winning customers. If the business has grown over months or years, cybersecurity now deserves a place on that list. Cybercrime affects companies of every size and industry, and a data breach can bring legal consequences, fines, reputational damage and financial loss. The steps below will help your growing business improve its cybersecurity.
Secure your sign-ins first
Many attacks start with a stolen or guessed password. The UK’s National Cyber Security Centre (NCSC), in its small organisations guide revised in 2026, recommends:
- Passkeys for business-critical accounts wherever they are available, because they resist phishing.
- Strong, unique passwords plus two-step verification (2SV) where passkeys are not yet supported. The NCSC says any type of 2SV is better than none.
- Removing unused accounts for staff, suppliers or contractors who have left, because forgotten accounts are easy targets.
Start with email, banking, cloud storage, your website and domain hosting, payment systems and social media accounts.
Use an effective password manager
An earlier version of this article said free password managers built into browsers such as Chrome are “not enough” for a business. That is not what official guidance says. The NCSC recommends saving passwords to your device or browser, or using a password manager. It describes the managers built into popular browsers, such as Chrome, Safari and Edge, as a good option if your team uses one browser for most work accounts. It suggests a password manager app if staff use different browsers and devices, because these apps sync across all of them.
The original article’s underlying concern was valid, though. If an employee’s computer is infected with malware that steals passwords, anything saved on that computer is at risk. Keep devices clean and updated, and turn on 2SV, so that a stolen password alone is not enough to break in. As a team grows, a business password manager plan adds useful controls: secure sharing of logins, admin reports on weak or reused passwords, and quick removal of access when someone leaves. Many such products say they use “zero-knowledge” encryption, meaning the vendor itself cannot read your stored passwords. Check each vendor’s security documentation.
Keep devices and software updated
Updates fix security holes that criminals exploit. The NCSC advises turning on automatic updates for devices and apps, and replacing devices that no longer receive updates. You do not need the latest model, just one that is still supported. For desktops, a supported operating system and built-in protection go a long way; our article on whether free antivirus is good enough explains what independent tests show.
Backup like a pro
Every business needs backups to recover from ransomware, hardware failure, theft, natural disasters or accidental deletion. Many experts recommend the 3-2-1 strategy. The original version of this article described it slightly wrongly (“two types of data”). As the US Chamber of Commerce explains it, the rule means:
- 3 copies of your data: the original plus two backups;
- 2 different types of storage media, such as an external drive and a cloud service; and
- 1 copy off-site, away from your office, for example in the cloud or a secure location elsewhere.
The same guide adds three practical warnings. Retention settings in Google Workspace or Microsoft 365 are not a full backup. You still need offline or unchangeable copies, which ransomware cannot encrypt. And you should test restoring from your backups regularly, because a backup you cannot restore is no backup at all.
Train your team to spot scams
Phishing emails, fake invoices and calls pretending to be from a bank or a senior manager are among the most common ways into a business. Teach staff to check payment-change requests by phone using a known number, never to share one-time passwords, and to report suspicious messages quickly without fear of blame. Protecting customers’ data is part of the same job; see our guide to protecting customer identity online.
Turn to security operations as you grow
Security operations (SecOps) brings IT operations and security teams together to monitor systems, hunt for attackers who have got onto the network, and respond quickly to incidents. The team that does this work is usually called a security operations centre (SOC).
Few small businesses can staff a SOC around the clock. Different models suit different budgets:
- Do it yourself: use the security alerts built into your email, cloud and endpoint tools, and assign someone to review them.
- Managed detection and response (MDR): an outside provider monitors your devices and accounts 24/7, investigates alerts and helps contain attacks. The original article called MDR the most comprehensive option. It is often the most complete choice for a business without its own security staff, but it is not the only good one, and providers vary widely, so compare what each covers.
- In-house SOC: usually only practical for larger organisations.
If you build software or offer an API to customers, include it in your monitoring and follow our API security practices.
Create an incident response plan
An incident response plan helps a business recover quickly from a cyber incident. Write down, in advance:
- Who decides. Name the person who will make business-critical decisions during an incident, such as the chief operating officer or head of IT, plus a deputy.
- Who you will call. A lawyer, your IT or security provider, and your cyber insurer if you have one. Insurers often have conditions on how and when to notify them, so check your policy now rather than during an incident.
- What you must report, and to whom. The original article described HIPAA, the SEC and GDPR as organisations to report to. In fact, HIPAA is a US health-privacy law, the SEC is the US securities regulator, and GDPR is the EU’s data protection law. Your duties depend on where you operate and whose data you hold:
- India: CERT-In’s directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them. India’s Digital Personal Data Protection (DPDP) Rules, notified in November 2025, phase in obligations over about 18 months, including reporting personal data breaches to the Data Protection Board and informing affected people.
- EU (GDPR): controllers must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk.
- Other places and sectors: rules differ, so ask your lawyer which apply to you.
- How you will communicate. Ask a marketing or communications lead to prepare draft messages for the press, customers and employees.
- How you will restore. Note where your backups are and who can restore them.
Review the plan once a year, and run a short practice session so that people know their roles.
Frequently asked questions
What is the first cybersecurity step for a small business?
Protect your email and other business-critical accounts with passkeys or two-step verification. Email is usually the key to resetting every other account.
Is a browser’s built-in password manager safe for business use?
The UK’s NCSC describes browser-based password managers as a good option when your team uses one browser for most work accounts. Use a password manager app if people work across different browsers and devices.
What does MDR mean?
Managed detection and response: an outside provider monitors your systems around the clock, investigates alerts and helps you respond to attacks.
How quickly must an Indian business report a cyber incident?
For incidents covered by CERT-In’s April 2022 directions, within 6 hours of noticing them. Personal data breach duties under the DPDP Rules are being phased in. Check the current rules with a lawyer.
Checked in October 2026 against the UK NCSC’s small organisations guide, the US Chamber of Commerce’s 3-2-1 backup guide, CERT-In’s April 2022 directions, PIB’s announcement of the DPDP Rules 2025 and Article 33 of the GDPR. This is general guidance, not legal advice.
