Cybersecurity for SMEs: the basics you can't skip

Many SMEs think they are too small to interest an attacker. It is a dangerous mistake: precisely because they are less protected, small companies are convenient targets. A successful attack can halt operations, expose customer data and cost sums that an SME struggles to absorb. The good news is that 80% of the risk is covered by basic measures, not by a big-company budget. Here are the foundations, in order of priority.

Passwords and access: the first line

Most breaches come through weak or reused credentials. Before anything else, put your access in order.

• Long, unique passwords for every service: a reused password compromises all the linked accounts.
• Two-factor authentication (2FA) on email, banking, management software and portals: even if the password is stolen, access stays blocked.
• Password manager: it eliminates the habit of writing passwords down or reusing them.
• Immediate revocation of access when an employee leaves the company.

This single block of measures removes a huge part of the risk, at almost no cost.

Backups: your safety net

If ransomware encrypts your data, the only real defence is having an intact copy. Backups are not a luxury, they are the insurance on your continuity.

• Apply the 3-2-1 rule: three copies of the data, on two different media, one of which off-site (or on a separate cloud).
• Make sure the backups are automatic: those that depend on someone remembering will fail sooner or later.
• Test the restore: a backup you don’t know how to restore is not a backup. Periodically try to recover the data.
• Keep at least one copy unreachable from the network, so that an attack cannot encrypt it along with the rest.

Updates: closing the open doors

Most attacks exploit known vulnerabilities for which a fix already exists. Not applying it means leaving the door open.

• Enable automatic updates on operating systems, browsers and management software.
• Replace systems that are no longer supported: software that no longer receives patches is a permanent gap.
• Keep even the “forgotten” devices updated too: routers, network printers, connected devices.

The human factor: the most important defence

Technology stops many attacks, but phishing targets people, not systems. An employee who clicks the wrong link can bypass any firewall.

• Train the team to recognise suspicious emails: unusual senders, artificial urgency, requests for credentials or payments.
• Establish a verification procedure for payments: a change of bank details by email must always be confirmed through a second channel.
• Build a culture in which flagging a doubt is normal, not a source of embarrassment. An attack reported in time can be contained.

Data protection is not only technical

A Swiss SME processes data of customers and employees, and data protection legislation requires it to protect them adequately. Cybersecurity therefore also has a compliance dimension:

• Knowing what data you hold and where it is stored.
• Limiting access to the data to those who genuinely need it.
• Being ready to handle a possible breach, which may entail notification obligations.

A minimum plan, in order of priority

If you are starting from scratch, this is the sequence that covers the most risk with the least effort:

1. Enable 2FA on all critical accounts.
2. Secure and test your backups.
3. Enable automatic updates everywhere.
4. Train the team on phishing.
5. Define roles and access to the data.

You don’t need to do everything at once, but you do need to do these things well.

How we work

At SIH ONE, data security is an integral part of the way we manage your administration. The documents and data you entrust to us are encrypted, with personal access and traceability, kept in known locations and in a way that complies with Swiss legislation. Our portal and our systems are designed so that protection is the rule, not an option to configure.

Would you like a check of your SME’s security basics? Let’s talk about it together.