The Cybersecurity Basics Every SME Should Have (and Usually Doesn't)

Most breaches at small and mid-sized companies aren't sophisticated — they exploit basics that were never set up in the first place.

Multi-factor authentication is first on the list. It's the single highest-leverage control against credential theft, and it's still not universal across company email, cloud storage, and admin tools.

Automated backups, tested at least quarterly, are second. A backup nobody has restored from is a hope, not a plan.

Endpoint protection with centralized visibility is third — knowing that every laptop is patched and protected, rather than assuming it.

Access reviews are fourth. When someone changes roles or leaves, their access should be revoked the same day, not "whenever someone remembers."

Finally, a written incident response plan — even a one-pager — turns a stressful surprise into a checklist. Who gets called, what gets isolated, and who talks to customers, decided in advance.

None of this requires a security team. It requires someone accountable for making sure it's actually done, which is most of what a managed IT partner is for.