10 cybersecurity measures any small business can apply today

Many small businesses assume they aren't targets because they're small. In practice, most attacks are automated and look for any vulnerable system. These ten measures reduce risk considerably, without major investment.

The measures

• Enable multi-factor authentication (MFA) on email, online banking and cloud tools.
• Use a password manager and a different password for every service.
• Keep operating systems, browsers and apps up to date.
• Run automatic backups, with at least one copy off-site — and test recovery.
• Change the router's default credentials and keep its firmware updated.
• Keep customer Wi-Fi separate from your work network.
• Give each person only the access they need and remove it when they leave.
• Train your team to recognise phishing emails and suspicious payment requests.
• Confirm by phone any request to change bank details or make an urgent payment.
• Have a simple incident plan: who to call, what to disconnect, how to recover.

What next?

These measures are a good starting point, but every business has its own risks. An authorised security assessment with a defined scope helps identify your priorities. In Portugal, the National Cybersecurity Centre (CNCS) also provides useful resources and alerts.