Cybersecurity for Small Business: The 10 Steps That Matter

Cybersecurity for small business comes down to ten habits: unique passwords in a password manager, two-factor authentication on every account that offers it, a fixed routine for checking payment requests, automatic updates, tested backups, limited admin rights, a locked-down Wi-Fi, encrypted laptops and phones, a clean offboarding routine and a written plan for the day something goes wrong. ENISA's 2025 threat report puts phishing at about 60% of observed intrusions and vulnerability exploitation at 21.3%. These ten steps target those two entry points.

Why do attackers go after small businesses?

Small firms hold money, customer data and access to bigger partners, and rarely have someone whose full-time job is security. In its Threat Landscape 2025, the EU cybersecurity agency ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025. Phishing, which ENISA counts to include vishing (voice phishing), malspam and malvertising, accounted for about 60% of observed cases. Exploitation of vulnerabilities came second at 21.3%, and ENISA notes that new flaws are weaponised within days of disclosure.

In Romania, the national cybersecurity directorate DNSC and ING Bank Romania warned in March 2026, in a joint press release, that companies face two schemes in particular: phishing messages that demand an urgent data update, and spoofed phone calls from someone claiming to be the tax authority ANAF. Both copy a real institution's look and add urgency.

How do I stop stolen passwords from opening my accounts?

Step 1: unique passwords in a password manager

One password reused on ten sites means one leak opens ten doors. The NCSC's small organisations guide (published 9 April 2026, reviewed 21 July 2026) recommends saving passwords to the device or browser, or using a password manager, a tool that creates and stores passwords behind one master password. Pick one from a known vendor, give it a long, unique master password and start with accounts that can move money or reset others: email, online banking, accounting or invoicing, your domain registrar and cloud storage.

Step 2: two-factor authentication everywhere it exists

Two-factor authentication (2FA, which the NCSC calls 2-step verification or 2SV) asks for a second proof after the password, usually a code. The NCSC tells small organisations to use passkeys where a service supports them, because a passkey cannot be talked out of you the way a password can. Otherwise it advises a strong unique password plus 2SV, which it calls one of the most effective ways to protect accounts, and says any type of 2SV beats none. Secure email first, since whoever controls your inbox can reset every other password. Never read a code to someone who phoned you. A code belongs only to an action you started yourself.

How do I recognise phishing and fake invoices?

Staff who know the common patterns stop most attempts at the first message. These are the ones Romanian and European authorities describe.

• Urgent data update. A message that looks like a bank or an authority says your account will be blocked unless you confirm your details. The link opens a cloned site that collects bank data, passwords and one-time codes, according to DNSC and ING. Type the bank's address yourself or use its official app, and check the sender and link without clicking. Each one-time-password SMS names the operation the code authorises, so read it.
• The call from ANAF. DNSC and ING describe callers who promise a tax refund, send a link and then ask you to install a remote-control app such as AnyDesk or AirDroid, which hands them the phone and the banking app. Hang up, check through the institution's official channels, install nothing for a stranger and take no financial decision during a call.
• The changed IBAN. A supplier's email asks you to pay future invoices into a new account. The Romanian Police's guidance on business email compromise (BEC), published in August 2017, describes attackers who read a foreign partner's mailbox, follow the real correspondence and write from a lookalike or identical address that points to another account. Europol's invoice fraud leaflet describes the same technique and advises verifying every request to change bank details with contacts from earlier correspondence, not those in the message.

Turn that into a rule: any change of bank details is confirmed by phone on a number you already held, and a second person approves the first payment to a new account. After paying, email the supplier the bank name and the last four digits of the account, as Europol suggests. An invoice that arrives in the right format can still carry the wrong IBAN, so the rule also covers invoices received through the system in our e-Factura guide. Report attempts to the police even when nobody fell for them, as Europol advises.

Why do software updates matter, and how do I keep up?

Vulnerability exploitation was 21.3% of intrusions in ENISA's dataset, and campaigns weaponise new flaws within days, so waiting a month to patch hands attackers that month. The NCSC's mobile guidance gives the advice in two short tips: keep your device up to date and keep your apps up to date.

• Switch on automatic updates for Windows or macOS, phones, browsers and office software.
• Update the Wi-Fi router, NAS and printers, which people forget because they have no screen.
• Uninstall software nobody uses, and replace devices that no longer receive security updates.
• Keep one spreadsheet with device, owner, operating system and last update date. It takes ten minutes to start and shows what to fix first.

How should a small business back up its data?

Follow the 3-2-1 rule, which the NCSC states as at least 3 copies, on 2 devices, with 1 offsite. A cloud copy counts as the offsite one.

Rule	What it means	Example
3 copies	The live data plus two backups	Working files, an external drive, a cloud backup
2 devices	Backups on different kinds of storage	Laptop disk and an external drive
1 offsite	One copy outside the office	Cloud storage or a drive kept elsewhere

Two extra points come from the NCSC's offline backups post. It reports incidents where ransomware encrypted the original data and also the connected USB drives, network storage and cloud locations that held the backups, so keep at least one backup disconnected or write-protected. And test your backups: restore one file and one whole folder every quarter, and write down how long it took. A backup you have never restored is a hope. Check whether your cloud provider keeps older versions and deleted files for a period, because the NCSC notes that this lets you roll back after an attack.

Admin rights, Wi-Fi, device encryption and offboarding: what do I lock down?

Admin rights

The NCSC warns that if you are logged in as administrator during an attack, a criminal could take full control of the device and your accounts, and even lock you out. Use a standard account for day-to-day work and the administrator account only to install software or change settings. Keep the owner role on your domain, email admin console, bank and cloud accounts with as few people as possible, and make sure two trusted people hold recovery access.

Wi-Fi

Change the router's default admin password, use WPA2 or WPA3 with a long passphrase, put visitors on a guest network and update the firmware. The NCSC's mobile guidance also advises against connecting to unknown Wi-Fi hotspots, and recommends password protection and a way to track, lock or wipe a lost device.

Device encryption

A lost laptop is only a hardware loss if the disk is encrypted. Microsoft says Device Encryption turns on BitLocker automatically when you sign in with a Microsoft or work account, and does not turn on for local accounts. Apple says Macs with Apple silicon or a T2 chip encrypt data automatically, and FileVault adds a further layer. Store recovery keys away from the device.

Offboarding

The NCSC notes that accounts for departed staff and contractors often stay active unnoticed, and suggests reviewing who has access to important accounts every few months. When someone leaves, do this the same day: disable their accounts and mail forwarding, remove them from the shared password vault and rotate shared passwords, remove them from admin and recovery lists, revoke app tokens, collect devices and transfer ownership of their files.

If staff use AI assistants, add one rule: no customer personal data or confidential contracts in a tool the company has not approved. Our guide to using AI well covers checking the output.

What do I do if we get hacked, and who do I call in Romania?

Write the plan before you need it, on one page: who decides, the bank's fraud line, your IT provider and the contacts below. Then follow this order.

1. Contain it. Disconnect the affected device from the network. Do not wipe it yet, because it holds evidence.
2. Call the bank at once if money moved or banking details were entered. ING states that in most fraud cases the chances of recovering the money are extremely low, so minutes matter.
3. Reset from a clean device. Change passwords and sign out other sessions, starting with email, and turn on 2FA.
4. Keep evidence. Save the emails, screenshots, phone numbers and transaction details.
5. Report it. DNSC runs the national line 1911 and an online reporting form for individuals and legal entities. File a complaint with the police too.
6. Check data protection duties. If personal data of customers or staff was exposed, Article 33 of the GDPR requires notifying the supervisory authority, in Romania ANSPDCP, without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. Ask your lawyer or accountant the same day.

Small business security checklist

• Passwords: a unique password per account, kept in a password manager.
• 2FA: on email, banking, accounting, domain registrar and cloud storage first.
• Payments: bank-detail changes confirmed by phone, first payment approved by a second person.
• Phishing: staff know the three patterns: urgent data update, fake ANAF call, changed IBAN.
• Updates: automatic everywhere, router and NAS included, with a device list.
• Backups: 3-2-1, one copy offline or write-protected, restore tested this quarter.
• Admin rights: daily work in standard accounts, two people with recovery access.
• Wi-Fi: default password changed, WPA2 or WPA3, guest network for visitors.
• Encryption: BitLocker or Device Encryption on Windows, FileVault on Mac, screen lock on phones.
• People and plan: an offboarding checklist and a one-page incident plan with 1911 on it.

Want help applying this to your setup?

Danube Labs is a one-person studio in Bucharest. If you want to talk through how this checklist fits your tools, book a free intro call or read about IT and automation consulting.