Boring first: sign-in, accounts, and backups
Most "breaches" an SME will see are not film-script hacks — they are a reused password, a shared admin login, or a backup you never test. The goal is to close the obvious doors first, with things people will actually do, not a forty-page policy nobody opens.
If you want a second pair of eyes on how that maps to your real stack, book a free systems review — it is a conversation, not an audit. If the fit is right, we can support ongoing system care so the basics do not fall off the calendar.
Multi-factor (MFA) and shared accounts
Turn on multi-factor authentication (sometimes called 2FA) for email, cloud file storage, and your admin consoles — especially anything customer-facing. Prefer app-based factors over SMS where you can; the point is that a stolen password is not enough on its own.
Avoid shared inboxes and generic logins ("info@", "admin") when those accounts can change billing, DNS, or payroll. If you must share, use a proper shared mailbox, named users, and know who can reset the factor when someone leaves.
Backups: prove you can put things back
Backups you have never restored are guesses. For the systems that matter, check at least one of these a quarter: pull a file from backup, or spin a test restore into a sandbox, or walk through a vendor's restore with a simple checklist. If nobody owns that task, it does not happen.
Keep offline or immutable copies for scenarios where a live sync drive gets encrypted along with the originals. That does not mean enterprise kit — it can be a second cloud, a weekly snapshot, or a copy that is not rewritable from the same login.
Who is allowed to do what
"Everyone is an admin" is fast until someone clicks the wrong link. Map a few critical roles — email admin, site or DNS, file or tenant admin, device or laptop policy — and name an owner. Offboarding is where this bites: a former team member with access that was never removed is a common, preventable gap.
What to skip on day one
- A policy in a drawer when real behaviour stays the same. Start with a one-page who can do what and a test calendar, not a binder you never open.
- Security theatre — complex rules nobody follows — when MFA and a restore test would have done more good.
- Buying a fancy tool before the account list, MFA coverage, and backup owner are true.
When to bring a specialist in
Signals you are past the basics: regulated or sensitive data, a growing remote team on unmanaged devices, public web apps with customer or patient data, or an incident and you are not sure how to scope the blast radius. A good specialist helps you prioritise and evidence — not just add another dashboard.
Where we help: we work with Teesside and the North East as well as remote partners. If the basics are sound and you need deeper process or build work after, we are happy to talk in plain language.
Book a systems review to sanity-check the stack you have today, or see our offers for audits, build, and ongoing system care.