First Steps to Cybersecurity – A Guide for Small Businesses

The managing director of a small family business sighs: “Cybersecurity – where do we even begin?” This is a question many SMEs ask, having had little prior exposure to IT security. No company jumps straight to a high-end level; what matters is taking the first step at all. This article gives you a practical guide to getting started with IT security that you can act on immediately – without technical jargon and with manageable effort.

Basic Steps for Getting Started with Cybersecurity

Clearly Define Responsibilities Within the Company

Designate someone to coordinate IT security. In small businesses, this can be an external IT service provider or an IT-savvy employee – the main thing is that someone feels responsible. According to the BSI, company management should actively support this topic and designate a suitable IT service provider or internal person responsible.

Conduct an IT Inventory

Get an overview of your IT landscape. Which devices, servers, software, and cloud services do you use? Where is important data stored? This “inventory” helps identify risks. Example: all employee laptops run Windows 10 – are updates current on all of them? Is business data stored and backed up centrally on the server?

The Key Building Blocks for Basic IT Protection

Implement Regular Data Backups

Ensure that automatic daily backups of your important files are performed (e.g., to an external hard drive kept offline, or to cloud storage with versioning).

Set Up Updates and Patch Management

Enable automatic updates for operating systems and software. If applicable, set up a “Patch Tuesday” in your calendar to manually apply updates that don’t come automatically.

Install Protective Software on All Devices

At a minimum, install a current antivirus program on all PCs/servers. Many solutions are affordable or already integrated into operating systems. Also check your router/firewall – internet providers often include basic firewall functions in routers that just need to be activated.

Establish Secure Password Policies

Require all employees to use secure passwords (at least 12 characters, no simple words) and use two-factor authentication wherever possible. Establish a policy that also governs regular changes or blocking in case of suspicion.

Involve Employees and Prepare for Emergencies

Conduct Awareness Training

Talk with your employees about simple security rules (don’t click unknown links, handle USB drives carefully, always ask when unsure). The BSI offers short explanatory videos and materials that provide an easy introduction. Feel free to use these in a team meeting.

Prepare Emergency Contacts

Note down important contacts for emergencies – your IT service provider, the free BSI hotline, and possibly the insurance emergency line (if cyber insurance is in place). In the stress of a cyberattack, a prepared emergency plan with contact details and checklists is invaluable.

Use External Expertise Strategically

If you don’t have internal IT specialists, don’t hesitate to seek external advice. There are qualified service providers and special consulting subsidies that support SMEs with cybersecurity. Even a one-day security check by an expert can provide clear recommendations for action.

These steps are based on proven questions and recommendations, such as those provided by the BSI in its SME brochure. Of course, IT security is an ongoing process – but with the checklist above, you lay a foundation to build on.

Practical tip: Plan a “Security Week”: tackle one of the above steps each day. By the end of the week, you will have achieved a remarkable amount – and have significantly better-protected IT systems.