SME Cybersecurity: Where to Start?

SME cybersecurity: where to start in 2026

Cybersecurity does not have to begin with a long shopping list. For a small or medium-sized business, the first task is to understand what must keep working, then protect the accounts, information and suppliers that those activities depend on.

As of November 2026, the foundations remain practical: know your systems, restrict access, maintain software, protect backups and rehearse your response. The official ANSSI cybersecurity guide for small businesses provides a useful starting structure. The approach below turns those foundations into work that a business owner and IT provider can verify together.

Start with business consequences

Your company does not need to be singled out to suffer an incident. A stolen email account, an exposed device or a compromised supplier connection can be enough to disrupt ordinary operations.

Ask what happens if staff cannot receive orders, issue invoices, access project files or run production. Which activities can continue manually? Which depend on a particular person or application? Who can authorise temporary changes?

The answers help you prioritise. Protecting the service that keeps orders moving may be more urgent than polishing a policy nobody uses. The objective is not perfect security; it is a defensible sequence of improvements that reduces exposure and makes recovery possible.

Understand the five main risks

Phishing and account takeover

A convincing message can lead someone to enter credentials, open an attachment or approve an unexpected request. Training matters, but employees should not be the only barrier. Combine awareness with stronger authentication, email protection and a simple way to report suspicious activity.

Ransomware and operational disruption

Attackers may encrypt files, disable services or steal information before demanding payment. Backups can also be affected if they are reachable using the same administrative credentials as production. Recovery depends on separation, usable copies and tested procedures, not merely on a successful backup notification.

Data exposure

A public sharing link, an incorrect recipient or excessive permissions can expose information without an elaborate intrusion. Review shared folders, exports and external accounts alongside the technical perimeter. Staff should know which sharing methods are approved and who can authorise an exception.

Payment and impersonation fraud

Unexpected transfers and bank-account changes need independent verification. Call a known contact using a number already held in your records, rather than the number in the request. A familiar voice or video is not sufficient evidence for an unusual payment instruction.

Supplier compromise

IT support, hosting and software suppliers may hold sensitive access. Identify those connections and establish how they can be restricted or suspended. A signed contract is useful, but it does not prove that remote access is secure or that an incident contact will answer.

Map the services you rely on

List your essential business activities and connect each to its applications, data, devices and providers. Include online services purchased directly by teams, remote working arrangements and administrator accounts.

For each asset, record an owner, its purpose, authorised users and recovery arrangements. An initial asset inventory does not need to be elaborate. It needs to reveal gaps such as an unsupported laptop, an unmanaged application or an important system with no identified owner.

Use a focused risk analysis to agree which scenarios matter most. Describe the consequence in business language: missed orders, blocked payments, unavailable records or disclosure of confidential information. This gives management a clear reason to approve the next action.

Put the essential technical controls in place

Secure identities first

Use unique passwords and a password manager suitable for business use. Enable multifactor authentication for email, remote access and privileged accounts. Prefer phishing-resistant methods where the service supports them, and protect the recovery process as carefully as normal sign-in.

Separate administrative accounts from everyday accounts. Define what happens when someone joins, changes role or leaves. Replace shared accounts where practical; where an exception remains necessary, document ownership and control access to the credentials.

Keep systems supported and maintained

Enable automatic updates where appropriate and assign responsibility for software requiring manual intervention. Replace systems that no longer receive security fixes rather than treating unsupported operation as a permanent exception.

Include routers, security equipment and internet-facing tools. Verify that endpoint protection is actually active across the devices in scope. Owning a licence or installing an agent once is not the same as maintaining effective coverage.

Build backups around recovery

Start with the information and applications needed for priority activities. Maintain copies that are isolated or protected against alteration, using access arrangements distinct from production administration.

Check cloud services individually. Synchronisation can replicate deletion or corruption; it is not automatically a recoverable backup. Establish what can be restored, by whom and with which dependencies.

Test a file restoration and then a representative application recovery in a controlled environment. Record missing credentials, unavailable configuration and other obstacles. The test succeeds when staff can use the recovered service, not simply when files have been downloaded.

Make secure behaviour easy

Give employees instructions they can use during ordinary work:

• report suspicious messages quickly, without fear of blame;
• verify unusual payment instructions through a separate channel;
• share documents using approved tools and permissions;
• lock sessions and protect devices while travelling;
• give exceptional access an owner and an expiry date.

Use training and awareness to practise realistic situations. After a phishing exercise, explain the warning signs and the reporting route. A punitive approach can discourage the early reporting needed to limit damage.

A five-step starting plan

1. Assign a coordinator. Management owns priorities; a named person coordinates staff, business owners and IT support.
2. Select critical activities. Record their dependencies and the practical impact of losing them.
3. Check the foundations. Verify access restrictions, updates and backups through evidence rather than verbal reassurance.
4. Rehearse an incident. Walk through a compromised account and a recovery exercise, then fix the obstacles encountered.
5. Track a short action list. Give each task an owner, deadline and completion test; escalate important unresolved risks to management.

Prepare for an incident before it happens

Keep essential contacts somewhere accessible if normal email and shared drives fail. Include IT support, business decision-makers, your insurer and specialist assistance. Establish who can isolate a device, suspend access and authorise external communications.

During an incident, report promptly, preserve useful evidence and avoid improvised changes that could hinder investigation. Have qualified people assess notification obligations if personal data is involved. Do not promise a recovery time or rule out data exposure before the facts are established.

Domyno combines a SaaS platform with a dedicated human expert: agents prepare the work and a human validates it. To explore a practical way to organise priorities and follow-through, request a demo.