List what would stop the business tomorrow
Start with the services that would halt work or expose customer data if someone else got in: email, the domain registrar and website hosting, banking and payments, payroll and HR, file storage, accounting, the CRM and social media accounts. The UK National Cyber Security Centre (NCSC) names most of the same priorities in its guide for small organizations.
For each service, record three names: the business owner, the administrator and the recovery contact. Include services paid for on a founder's personal card or registered to a personal email address; those are the ones that disappear when that person leaves.
Then ask: if the person who set this up were unavailable tomorrow, who could get back in? Record where recovery codes are kept, for example in the company password manager, but never write the codes themselves into the register.
| Service | Why it matters | Minimum control |
|---|---|---|
| Password resets for every other account arrive here | Passkey or two-step verification for every user | |
| Domain and website hosting | Controls your website and email delivery | Two-step verification; two people with access; renewal on a company card |
| Banking and payments | Direct financial loss | Two-step verification; access limited to the people who pay bills |
| Payroll and HR | Staff personal data | Two-step verification; admin access for two people at most |
| File storage | Contracts, proposals and client work | Two-step verification; independent backup |
| CRM | Customer records and pipeline | Two-step verification or SSO; a tested export |
Protect the accounts that unlock everything else
Turn on passkeys for business-critical accounts wherever the service offers them; the NCSC recommends them as a priority because they resist phishing. Where an account still uses a password, add two-step verification and give it a password used nowhere else. An authenticator app plus saved backup codes keeps you in when a phone is lost.
Check enrollment yourself. An email asking colleagues to switch on two-step verification is not evidence; the admin console's user list or security report is. Record the date you checked and the number of users still missing.
Give everyone a standard account for daily work and use administrator accounts only for tasks that need them; a criminal who reaches an admin account can take over everything it controls. Review who has admin rights and access to important accounts every three months, and remove accounts for former staff, suppliers and contractors.
Check which security features your plan actually includes. Pipedrive, for example, offers two-factor authentication and SSO on every plan, but security alerts, device history and an audit log only on Ultimate. If your baseline needs an audit trail, that is a plan decision, not a setting.
Make device ownership and updates visible
List every device that can reach business data, including personal phones that read work email, with its owner and the person who maintains it.
Apply four device basics from the NCSC guidance: switch on automatic updates for the operating system and apps; replace any device or app that no longer receives updates; protect every device with at least a 6-digit PIN or a strong password, with fingerprint or face unlock on top; and check that built-in antivirus and the firewall are switched on.
Give every exception a fix date and an owner. “Laptop needs updating” is not a completed control. Record who will fix it, what evidence closes the task and whether the device should lose access to business data until it is fixed.
Do not buy a monitoring tool before someone is responsible for responding to it. Ask what happens when an alert arrives at 2 am, what support is included and which systems the tool really covers. The person who answers the alerts is part of the purchase.
Check a restore, not just a backup label
Back up all the data the business needs to operate: email, documents, invoices, contacts, customer records and the website. Decide how much work you can afford to redo: losing a day of draft notes may be tolerable, losing signed contracts is not. That decision sets the backup frequency.
Keep two copies: an online backup protected by two-step verification and a separate storage device that stays disconnected when not in use, so malware on the computer cannot reach it. For cloud services, export essential data to an independent copy instead of relying on version history or the recycle bin, which keep items only for a limited time.
Test a restore every quarter. Pick a non-sensitive sample folder and a CRM export, restore them and record who did it, how long it took and whether the files opened. Remember that some exports expire: Pipedrive keeps an export file for 28 days, so save it to your own storage. A failed restore is an open task even when the backup dashboard shows green.
Treat joining and leaving as repeatable workflows
Keep an access checklist by role. When someone joins, grant only what the role needs and record who approved it. When someone leaves, work through the same list in order on their last day.
Do not stop at the main email account. A leaver may still have access to the CRM, shared document links, a password vault or an app bought outside the main sign-in system. The service inventory is what makes offboarding checkable.
Review service accounts and integrations before disabling anything. A connector running under the leaver's credentials may support a live workflow, such as web forms feeding the CRM. Assign a new owner and move the connection first so offboarding does not silently break it.
| Offboarding step | When | Evidence |
|---|---|---|
| Transfer ownership of files, CRM records and open deals | Before the last day | New owner named on each item |
| Move integrations that run under their login | Before the last day | Connector works under the new owner |
| Disable the main account and sign out active sessions | End of the last day | Account shows as disabled |
| Remove access to the password vault and shared links | End of the last day | Vault and sharing lists updated |
| Change shared passwords they knew | Within 24 hours | Change logged in the vault |
| Collect or wipe devices | Within one week | Device returned or wipe confirmed |
| Update recovery contacts and admin lists | Within one week | Register updated |
Choose the next purchase from a documented gap
Every row in the register needs five columns: gap, consequence, action, owner and the evidence that closes it. A missing account protection may be fixed with a setting; recovery may need a backup service; unmanaged devices may need outside support. Most first-pass gaps cost nothing to close.
Compare products only after the gap is defined. A password manager and a remote-access product do different jobs. Ask which missing safeguard the purchase supplies, who will operate it and how much ongoing effort it adds.
Review the register when people, critical services or devices change, and at least every three months. Keep it to one page. A short list with real owners and recent evidence beats a complete-looking spreadsheet that nobody opens.
| Gap | Action | Evidence that closes it |
|---|---|---|
| Two-step verification not confirmed on email | Enforce it in the admin console | Enrolment report shows every user enrolled |
| Restore never tested | Restore a sample folder and a CRM export | Restored files open; steps documented |
| Unknown device update status | Switch on automatic updates; list each device | Update status recorded per device |
| One person controls the domain | Add a second admin and company payment | Two named admins on the account |
| Former contractors still have access | Remove accounts; review every three months | Access list dated this quarter |
Template and next steps
A one-page control register listing each service, its owner, the current gap, the fix and the evidence that closes it. Adapt the fields to your own process and keep passwords, card details and other sensitive account data out of shared worksheets.
Frequently asked questions
What are the basic cybersecurity measures for a small business?
Five controls cover most of the risk: passkeys or two-step verification on email, banking, domain and other critical accounts; separate admin accounts used only when needed; automatic updates on every device, replacing devices that no longer receive them; two backups, one online and one offline, with a tested restore; and a written checklist for removing access when people leave.
Is two-factor authentication enough to protect business accounts?
It is the minimum, not the whole job. Use passkeys where the service supports them, because they resist phishing, and two-step verification everywhere else, with backup codes stored in the company password manager. Also give each account a password used nowhere else, keep admin rights off everyday accounts, and review who has access to important accounts every few months.
How often should a small business back up its data?
Match the frequency to how much work you can afford to redo. Daily automatic backups suit active files, email and customer records; weekly may be enough for archives that rarely change. Keep one online backup and one separate copy, export critical cloud data such as your CRM regularly, and test a restore every quarter, because an untested backup is only an assumption.
What should I do when an employee leaves a small business?
Work through a written offboarding checklist: transfer ownership of files, CRM records and open deals, move integrations that run under their login, disable their main account, remove them from the password vault and shared links, change any shared passwords they knew, collect or wipe their devices, and update recovery contacts. Record who completed each step and when.
Does a small business need antivirus software?
Usually it needs antivirus switched on rather than a new product. The NCSC advises checking that built-in antivirus and firewalls are turned on, notes that Apple devices have built-in protection enabled by default, and says smartphones generally do not need antivirus if apps come only from official stores. Spend the budget on updates, backups and account protection first.
Sources
Prices and plan limits come from each vendor's own pricing pages and documentation, checked on the dates shown. Vendors change packaging often, so confirm the final figure in your own quote.
- NCSC: small organisations guide to cyber security — checked Oct 29, 2026Overall scope of the baseline.
- NCSC: secure your important online accounts — checked Oct 29, 2026Priority accounts, passkeys, two-step verification, admin accounts and access reviews.
- NCSC: protecting your devices — checked Oct 29, 2026Automatic updates, unsupported devices, PINs and built-in antivirus.
- NCSC: backing up your data — checked Oct 29, 2026What to back up, online and offline copies, and restoring.
- NCSC: back up critical cloud data — checked Oct 29, 2026Independent copies of cloud data and the limits of version history.
- Pipedrive: pricing and plan comparison — checked Oct 29, 2026Plan prices, trial, plan features and security features by plan.
- Pipedrive: exporting data — checked Oct 29, 2026Export formats and the 28-day file window.