Basic Cyber Hygiene for Small Teams
Small teams do not lose time to “advanced threats” most days. They lose time to predictable failures: reused passwords, missing MFA, sloppy access, unpatched devices, and backups that do not restore.
This checklist covers 12 controls that prevent most pain, without turning you into a full-time security team.
What This Is and What It Is Not
Cyber hygiene is the set of basic habits and controls that reduce your chance of account takeover, ransomware, and avoidable data loss. It is not a guarantee, and it is not a replacement for incident response. It is the baseline that makes everything else less fragile.
The goal is simple: fewer preventable incidents, faster recovery when something goes wrong, and less risk concentrated in one person’s laptop or inbox.
The Main Risks and Patterns
Most small-team incidents cluster into a few patterns.
- Account takeover: one compromised inbox leads to invoice fraud, password resets, and access to downstream tools.
- Phishing and malware: someone clicks, installs, or signs in to a fake page, and credentials leak.
- Data loss: a laptop dies, a drive is wiped, or a shared folder is deleted without a workable restore path.
- Privilege sprawl: too many admins and shared logins mean one mistake becomes a company-wide incident.
Good hygiene breaks these chains early, or limits the blast radius when a mistake happens.
Minimum Viable Safeguards
These 12 controls are the baseline. If you implement only half, start with MFA, a password manager, updates, backups, and admin discipline.
- Password manager for everyone. One per person, no shared vault logins. Enforce unique passwords and remove “reuse” as a daily temptation.
- MFA on all critical accounts. Email, finance, admin consoles, password manager, CRM, and code repos. Prefer authenticator apps or hardware keys over SMS where possible.
- Separate admin accounts. Admin rights should not be used for everyday email and browsing. Create dedicated admin identities and use them only when needed.
- Least privilege by default. Give people the minimum access for their role, then review monthly. Remove access the same day someone changes roles or leaves.
- Device updates on a schedule. Turn on automatic OS and browser updates. Set one day per month for “everything updates”, and one person accountable for nudging stragglers.
- Approved device baseline. Require screen lock, full-disk encryption, and basic endpoint protection on laptops. If you cannot enforce this, do not allow access to sensitive systems from unmanaged devices.
- Backups you have tested. Follow 3-2-1 in spirit: multiple copies, different locations, and at least one protected from easy deletion. Run a quarterly restore test, not just “backup succeeded” alerts.
- Phishing drills and a reporting habit. Run lightweight drills or simulated phish quarterly. More important, make reporting easy and blame-free, so near-misses become learning.
- Secure the inbox. Tighten email rules: block auto-forwarding where possible, review mailbox delegation, and alert on suspicious logins. Inbox compromise is the most common starting point.
- Harden finance workflows. Add a call-back or second-channel confirmation for bank detail changes, large transfers, and new vendor setups. This prevents invoice fraud even when email is compromised.
- Patch your key business apps. Keep CMS, plugins, and shared tools up to date. Remove unused plugins and accounts. Old admin accounts are a quiet risk.
- Document an incident “first hour” plan. Who to call, what to shut off, where backups live, how to reset passwords, and what evidence to keep. In an incident, speed and coordination matter more than perfect process.
Keep the checklist visible. A simple internal page like our small-team security runbook is often enough to make this stick.
How to Choose Tools Without Getting Burned
Small teams overspend when they buy “security platforms” before they fix basics. Choose tools that reduce everyday failure, not tools that promise magic detection.
- Prioritise adoption: the best password manager is the one everyone uses, every day.
- Prefer defaults that enforce: automatic updates, forced MFA, and device policies beat training slides.
- Reduce tool sprawl: fewer systems means fewer logins, fewer admins, and fewer forgotten permissions.
- Check recovery paths: for any tool, confirm what happens when a device is lost, an employee leaves, or an admin account is compromised.
If a tool increases complexity, it often reduces safety. Hygiene is supposed to lower operational load.
Common Failure Modes
These are the mistakes that make “we have security” feel true until it matters.
- MFA only on some accounts: attackers go for the one system you forgot.
- Shared logins: no accountability, no clean offboarding, and no easy way to rotate access.
- Backup without restore: you find out it does not work during the incident.
- Too many admins: convenience turns into blast radius.
- Offboarding delays: access lingers after departures, and nobody remembers where.
FAQ
What should we do first if we can only do three things?
Start with a password manager, MFA on critical accounts, and tested backups. Those three reduce the most common incidents and make recovery realistic.
Do we need a dedicated IT person to do this?
Not at the start. You do need one named owner for follow-through. Most controls are policy and discipline, not specialised engineering.
Are phishing drills worth it for small teams?
Yes, if they are lightweight and paired with a simple reporting habit. The goal is not to shame people. It is to create a reflex to report suspicious messages quickly.
Basic cyber hygiene is boring on purpose. Implement these 12 controls, assign an owner, and review monthly, and most small-team security problems stop being emergencies.