Cyber security for small business: how do you protect an SME from cyberattacks?

Cyber security for small business comes down to three steps: apply a set of basic good practices (passwords, backups, updates, phishing awareness), detect the attacks that get through anyway with an EDR and continuous monitoring, and prepare your incident response in advance. Your MSP is the natural starting point for organising all three.

This article is part of our series on choosing a SOC and security providers. For the monitoring side, see our guide How to choose a SOC provider.

1. Get the basics right

National agencies converge on the same handful of measures. The UK’s National Cyber Security Centre covers them in its Small Business Guide; in France, Cybermalveillance.gouv.fr and Campus Cyber publish five essential recommendations along the same lines:

1. Strong, unique passwords for every service: at least 12 characters in the French guidance, with multi-factor authentication switched on wherever it is offered.
2. Regular, offline backups: some attacks deliberately target online backups. A copy kept off the network lets you restart.
3. Prompt updates on every device: laptops, servers, phones and applications.
4. Phishing awareness: help every employee spot fake messages and unusual payment requests.
5. Trusted providers: work with IT providers whose security expertise is recognised by labels or qualifications.

2. Take stock of your IT

A joint guide from ANSSI, the French national cybersecurity agency, and the French Directorate-General for Enterprise, “Cybersecurity for small businesses in 13 questions”, builds on these basics. It suggests some practical questions:

Area	The question to ask
Inventory	Do you know your devices, accounts and critical data?
Network	Is the firewall configured and remote access secured?
Email	Are suspicious attachments and links filtered?
Usage	Are personal and business uses kept separate?
Travel	Are laptops and phones protected when staff travel?
Cloud	Are the online services you use controlled and secured?
Insurance	Does your policy cover cyber risk?

This review works best with your MSP, who already knows your estate.

3. Detect what gets through

No preventive measure is perfect. A password stolen through phishing, a flaw exploited before it is patched, and an attacker is inside. The question then becomes: how long until someone notices?

Two building blocks address this:

• An EDR on endpoints and servers. It analyses suspicious behaviour and can isolate a machine remotely. See Do you need an EDR for a managed SOC?.
• Continuous human monitoring by a SOC. An EDR raises alerts; someone still has to analyse them, including at night and at weekends.

For a small business, a managed SOC usually comes through the MSP, built into the managed services contract. Email deserves special attention, as Microsoft 365 and Google Workspace are frequent targets. See Managed SOC for Microsoft 365.

4. Prepare for an incident before it happens

On the day of an attack, lost hours are costly. A little preparation goes a long way:

• An up-to-date contact list: MSP, incident response provider, insurer and the internal person who makes decisions.
• Tested backups, not just scheduled ones. A restore that has never been tried often holds surprises.
• A short procedure: who to inform, and who can decide to isolate a device or cut access.
• Regulatory reflexes: for a personal data breach, GDPR Article 33 provides for notification to the supervisory authority within 72 hours of becoming aware of it, and the UK GDPR sets the same deadline. Your legal adviser can help you work out what applies to your situation.

The role of your MSP

Most small businesses have no in-house security team. Their MSP is the natural conductor: it applies the basics, deploys the tools and relies on specialist partners for monitoring and incident response. This is Cyna’s model: a 24/7 SOC operated from France by in-house teams, with a CERT, serving partner MSPs who own the relationship with their clients. The terms (scope, licences) are set out in the contract agreed with the partner MSP. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. Cyna’s certifications and security documents are available on its Trust Center.

Talk to an expert

Want to know where your business stands? Speak to your MSP first: if they work with Cyna, they can present the monitoring they offer. Otherwise, get in touch to discuss it.

Frequently asked questions

Where should a small business start with a limited budget?

With free or low-cost measures: multi-factor authentication on email, unique passwords, offline backups and automatic updates. They address a large share of common attacks.

Is antivirus enough for a small business?

Not against today's attacks, which often use legitimate tools. An EDR analyses behaviour and can isolate a device remotely. See Antivirus vs EDR.

Does a small business need a SOC?

Once the business depends on IT, continuous monitoring becomes useful, because many attacks start at night or at weekends. It is usually delivered through the MSP. See Do SMEs need a SOC?.

Who should I call if we are attacked?

Your MSP first, then your incident response provider and insurer. National agencies also offer guidance and victim support. See Who to contact after a cyberattack.