How to Build an Information Security Programme for a Small Business

Why do small businesses need an information security programme?

Because attackers do not choose victims by size. They send phishing messages in bulk, scan the internet for anything unpatched and try leaked passwords everywhere. A company of 40 people with client money passing through its inbox is a reasonable target from an attacker's point of view, and it usually has less cushion to absorb a loss than a large one.

The public evidence is consistent. The UK government's Cyber Security Breaches Survey 2025 found that 43% of UK businesses identified a cyber breach or attack in the previous twelve months, and that phishing was involved in 85% of those cases. Verizon's 2026 Data Breach Investigations Report found that 31% of breaches now start with a software vulnerability, ahead of stolen passwords, and that ransomware appeared in 48% of breaches. IBM's Cost of a Data Breach Report 2026 put the global average cost of a breach at 4.99 million US dollars; that average is dominated by large organisations, but the direction is clear.

A programme is simply the difference between hoping and knowing: someone owns security, the important controls are in place and checked, and there is a plan for the day something goes wrong anyway. It does not need a security team. It needs an owner, a short list of controls, registers that prove them and a monthly number.

Who should own security when there is no security team?

One named person, with a deputy, agreed by leadership in writing. In a small company that is often the operations director, the finance director, an office manager who looks after IT, a compliance lead or a founder. Technical skill is not the requirement; authority is. The owner must be able to ask any team for information and say no to a new tool. Your IT provider, whether an outside firm or one internal person, supplies the technical changes.

The same UK survey found that only 27% of businesses had a board member with explicit responsibility for cyber security, which helps explain why updates lapse and leavers keep access: everyone assumes someone else is dealing with it. A useful idea from the Institute of Internal Auditors' three lines model, in plain words, is that the people doing the work own day-to-day risk, someone sets the rules and oversees, and someone independent checks. In a small company those are three hats, not three departments.

Ask leadership for four decisions in one short meeting: who owns it, the 90-day plan, how much risk is acceptable (for example how fast critical updates must be applied, and that leavers lose access the same day) and a budget cap. Write the decisions in a minute. That minute is your first piece of evidence.

How do you find out what you need to protect?

Build an inventory. You cannot protect what you do not know you have, and this step costs nothing but time. Make one row per device group, account, cloud application, data store and supplier, with an owner (a person, not a department), the kind of data it holds and how critical it is.

Four questions surface most of what nobody listed: what do people log into each week, where do files actually live (shared drives, personal cloud accounts, USB sticks, an old server), what does finance pay for by card, and who controls the domain, DNS and website? Then add four control columns to each row: MFA on, encrypted, backed up, updates managed. Tick only from evidence. The count of critical assets with gaps is the first number to take to leadership.

How do you assess and prioritise security risks?

Write each risk as a scenario: what could happen, to which asset, caused by what. Score likelihood and impact from 1 to 5 with a short written guide so that two people score the same way, multiply them, and rank. Then choose a treatment for each: reduce it with controls, transfer it through insurance or contract terms, avoid it by stopping the activity or retiring the system, or accept it in writing with a named approver.

Leadership understands money better than scores, so for the top few risks estimate an expected annual loss: the chance per year multiplied by the cost if it happens. A 15% chance of a 200,000 loss is an expected 30,000 a year, which helps a finance director compare a control that costs 9,000. These are planning numbers, not forecasts, and many of the best controls cost nothing at all.

Which security controls should a small business put in place first?

A short baseline stops most of what actually happens to small companies. The key word is enforced: many companies have these features available and switched off, or switched on for some people. For each control, decide what 'done' looks like and where the evidence lives, such as a coverage report or a restore log.

These controls match the ideas behind the UK's Cyber Essentials scheme, which certifies five technical controls (firewalls, secure configuration, security update management, user access control and malware protection), and the first implementation group of the CIS Controls. A study of real sign-ins by Microsoft researchers published in 2023 reported that MFA reduced the risk of account compromise by more than 99% across the accounts studied, which is why it comes first.

• Multi-factor authentication enforced for everyone, admins first, with number matching or passkeys
• A company password manager and a unique password for every account
• Separate admin accounts and least privilege: access by role, not by copying the last person
• Security updates within agreed deadlines on laptops, phones, servers, firewalls and browsers
• Endpoint protection with detection and response on every laptop and server
• Email security: filtering, SPF, DKIM and DMARC, an external sender tag and a report button
• Full-disk encryption and remote wipe on every laptop and phone
• Backups with three copies, two kinds of storage and one off-site or immutable copy, plus a quarterly restore test
• Secure cloud configuration: sharing defaults tightened, legacy sign-in off, audit logs and alerts on
• A payment rule: any change of bank details is verified by a call to a number you already hold
• A set-up and disposal checklist for every device and account
• Training, a one-step way to report, and a yearly rehearsal of the incident plan

How do you manage access for joiners, movers and leavers?

Access should follow the role. Joiners get access from a role template before day one, with MFA and the password manager set up before they touch client data. Movers get new access added and old access removed within a few working days, because privilege quietly accumulates across roles. Leavers lose access the same day: sign-in disabled, sessions revoked, MFA methods removed, every cloud application checked, and any shared passwords they knew changed.

Ask each manager to review their team's access every quarter: keep, reduce or remove. Track days to revoke for every leaver; it is one of the first things customer questionnaires and insurers ask about. Treat contractors and agencies as leavers with an end date written in at the start. Personal devices need either a company device for sensitive work or managed apps that keep company data in a container you can wipe. Monitoring and device rules touch employment and privacy law, so agree the wording with HR and check local law.

How do you train staff and run phishing simulations fairly?

Train short and often: a 45-minute launch session for everyone, a 20-minute module before new joiners get access, short role modules for finance, managers and admins, and a ten-minute topic each month at a team meeting. Five habits matter most: report fast, MFA always, use the password manager, verify payments by phone, and lock and encrypt devices.

Run phishing simulations openly. Announce the programme first, keep lures realistic but never cruel (no fake bonuses, redundancies or health scares), report results by team and never by name, and send a kind private note to anyone who clicked. A person who was shamed last time will stay quiet when they click a real link, and silence turns a ten-minute incident into a long one. The measure to watch is the report rate rising, because reports are what stop real attacks. If you want a fair, consistent way to measure the starting point, AssessAll's Social Engineering & Phishing Defence Judgment assessment can sit alongside your own simulations.

What should an incident response plan for a small business include?

Roles, a contact list printed and kept off your systems (IT partner, insurer, counsel, key customers), severity levels, the first hour, a notification section and short playbooks for the incidents you are most likely to face: phishing and business email compromise, ransomware, a lost or stolen device, a compromised account and a data leak.

The first hour is the same whatever happens. Log it and call your IT partner. Contain it: disable the account and revoke sessions and tokens, because a password change does nothing to an attacker who already holds a valid session; isolate devices; freeze payments in flight. Preserve evidence and scope it: inbox rules, forwarding, new MFA methods, other recipients of the same lure. Then decide severity and who to tell. Call your insurer early, since many policies expect notice before you engage outside help, and call counsel early if personal data may be involved, because breach notification deadlines in many countries are counted in hours or days from the moment you become aware.

Rehearse once a year with a 90-minute tabletop exercise and review every real incident within two weeks, without blame. The UK breaches survey found 45% of businesses had some form of cyber insurance but only 7% had a standalone cyber policy, so read what your cover actually includes before you need it.

How do you measure and report security progress?

Pick a handful of measures, define them once and report them monthly in a short note to leadership: five numbers, one decision needed and one thing that went well. Repeat a simple self-assessment on day 1 and day 90 to show the change. Use AI tools to draft policies, summarise vendor security pages or match customer questionnaires to your approved answers, but only approved tools for company data, a person deciding every action, and no untrusted documents pasted into assistants that can send email or change systems.

When you are ready for more structure, the six functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond and Recover) are a sensible way to organise everything above, and customers and insurers recognise them. The Information Security for Small Business Kit from Bodhih Training follows that structure with a programme workbook, policies, incident playbooks and a 90-day roadmap. For the people who run the programme, a Jobulary development plan can turn the skills it needs, such as risk scoring or incident handling, into practice with dates.