Most small businesses aren't chosen. They're found. An unpatched firewall, a reused password on a remote-access account, a fake invoice that looked close enough — any one of those is enough to start an encryption event that shuts down email, files and billing for days. The reason the bill gets paid is rarely that encryption is unbreakable. It's that nobody had ever tried to restore the servers from backup, so paying felt like the only way back online.

What follows is the order I'd work in over a single quarter. First the controls that keep you running when something goes wrong, then the ones that make getting in harder, then the ones that limit how much damage an intruder can do once inside.

1. Backups you can actually restore

Start here, before anything else. A backup that exists is not the same as a backup that works. You want three copies of your important data, on two kinds of media, with one copy offsite — and at least one copy that a compromised admin account cannot reach or delete.

In practice, that often looks like nightly images to a local device, a weekly rotated drive that lives in a locked drawer or offsite, and cloud storage with versioning and object lock enabled. The critical detail: the credentials for the backup system should not work on your production network. If the same domain administrator account can log into the backup console and delete the repository, an attacker who steals that account owns your recovery too.

Then test it. Once a quarter, restore a single file and one full server, and time how long it takes. Write the number down, because that is how long your business is offline in the worst case.

Warning signs your backups won't survive an attack

• Backup shares are mounted using domain administrator credentials.
• The only copies live on the same NAS, in the same room, on the same network.
• Nobody can name the last successful test restore.
• Backup jobs have been failing quietly for weeks and nobody reads the alerts.
• The backup console has no MFA and no separate login from everyday IT accounts.

2. Multi-factor authentication, in the right order

If you add MFA to only one thing, add it to email. Email is the reset path for almost every other service you use, and a hijacked mailbox is how invoice fraud and password resets begin.

After email, work down this order: remote access and VPN, cloud admin consoles, finance and banking tools, then everything else as licences allow. Prefer app-based or hardware-key methods over text messages, and turn on number matching if your provider offers it. Where staff approve prompts on a phone, teach them that an unexpected approval request means someone already has their password.

While you're in there, clean up accounts. Departing employees, old contractors and shared logins are free entry points. Give every administrator a unique account, stop sharing passwords over chat, and put a password manager in place so people aren't reusing the same phrase across work and personal sites.

3. Patch the perimeter first, then push the rest

You don't need a perfect patch record. You need a sensible order. Internet-facing systems come first: VPN appliances, firewalls, mail gateways, anything reachable from outside your building. These are scanned constantly and exploited within days of a public vulnerability becoming known. Second come the everyday targets — browsers, PDF readers, office suites — and third, everything else on a monthly cycle.

Turn on automatic updates wherever you can and accept the occasional forced restart. Then close what you don't use. Remote Desktop should never be exposed directly to the internet; put it behind a VPN or a gateway with MFA. Block macros in documents that arrive from the internet. If a marketing tool or file-sharing service has been sitting unused for a year, delete the account rather than leaving it as a door.

4. Make the click less profitable

Training fails when it's an annual hour of slides. Twenty minutes each quarter, built around two behaviours, works better. First: slow down and verify anything involving money, bank details, new payees or credentials — even when it appears to come from the boss. Second: report suspicious messages immediately, without fear of blame.

Give people one obvious way to report, such as a button in their mail client or a dedicated mailbox, and make sure someone actually responds. Then test the reporting path rather than just the clicking: send an internal test message with leadership aware and see how many people flag it. Praise the ones who do, publicly.

Pair this with an out-of-band rule for payments: any change to bank details or a request to move money gets confirmed by phone using a number you already have on file, never a number supplied in the message.

5. Limit how far an intruder can walk

Assume someone gets in. Your goal is to make the next hour boring for them. Give staff standard accounts for daily work and separate admin accounts for admin tasks, so a stolen everyday login doesn't come with the keys to the domain. Put servers, payment systems and cameras on separate network segments.

Keep backup credentials distinct from everything else, stored somewhere apart, and protected with MFA. If you have the tools, alert on the software attackers rely on to spread — remote-management utilities, scripting engines, bulk file-copy tools. Legitimate use of those tools is common, which is exactly why the unusual kind stands out once you're looking.

6. Write the plan down and keep it off the network

When ransomware hits, you will not have time to design a response. Write a one-page plan now: who calls whom, your IT contact, your insurer's incident line, your legal contact, which systems get restored first, and where the offline copy of this document lives. Print two copies and keep them out of reach of your own network, because you may not be able to open your files to read them. If customer data is involved, ask your insurer or a lawyer about notification duties before you send anything to anyone.

Your quarter, in order

If you do nothing else this quarter, do the first four. They cover the majority of real-world incidents at small organisations, and none of them require an enterprise budget.

1. Verify you have one backup copy an attacker cannot delete.
2. Perform and time a test restore of a single file and one server.
3. Turn on MFA for email and remote access.
4. Remove internet-facing Remote Desktop and disable unused remote tools.
5. Patch internet-facing systems within days of a critical update.
6. Give every administrator a separate account and a unique password.
7. Delete accounts for people who have left.
8. Block macros from the internet in Office applications.
9. Set up one-click phishing reporting and respond to every report.
10. Require phone verification for any bank detail change.
11. Keep some logs offsite so you can see how an intrusion started.
12. Write the one-page incident plan and store it offline.

Put the twelve items on a calendar with owners and dates. Then work through them at whatever pace your team can sustain — a steady two controls a month beats a frantic weekend of changes nobody maintains.

Photo: RDNE Stock project / Pexels