Cyber security refers to the practices and tools that protect digital assets from unauthorised access, theft or damage. For a small organisation, that means the website, email accounts, cloud storage, customer data and any other systems it relies on day to day.
Most organisations do not think about security until something goes wrong. By then, the cost in time, money, reputation and sometimes legal liability is almost always higher than the cost of basic prevention would have been.
Why smaller organisations are targeted
There is a common assumption that cyber attacks are aimed at large organisations with valuable data. In practice, smaller organisations are frequently targeted because they are less likely to have strong protections in place. Automated attacks do not discriminate by size. They scan for vulnerabilities and exploit whatever they find.
The most common threats are:
- Phishing emails designed to steal login credentials
- Compromised websites caused by outdated software
- Account takeovers through weak or reused passwords
- Ransomware that locks access to files until a payment is made
What good cyber security looks like
Every organisation needs a baseline of security, whatever its size. These basics cover most of the risk:
- Strong, unique passwords and a password manager to keep track of them.
- Two-factor authentication on important accounts, including email, cloud storage, banking and the website admin panel.
- Regular software updates, because outdated plugins and themes are one of the most common ways WordPress websites get compromised. See How much maintenance does a website need? for more.
- Current backups stored separately from the main system, so that a hack or hardware failure is a bad day and not a serious disruption to the organisation.
- An SSL certificate on the website, with any address that starts with http rather than https fixed promptly.
- Email security settings, with SPF, DKIM and DMARC records configured to reduce the risk of the organisation’s domain being used for spam or phishing. This is covered under Digital Setup.
- Staff awareness of phishing and social engineering, because most security incidents start with a person clicking something they should not have.
For a practical starting point, see How do I check my website security?
How we help
A security review looks at the current setup and identifies where an organisation is exposed, including the website, email, accounts and cloud tools. The output is a plain-English list of what needs attention, prioritised by risk, with a recommendation for each item. It is delivered as part of our Cyber Security & Safety service.
We carry out regular security reviews for a professional services practice to support its insurance compliance. Our digital governance case study describes how we helped a member association recover after its website was compromised.
