Seven cyber security questions every small business should ask

For a small business, cyber security is as much about clear responsibilities and everyday habits as specialist technology. An IT provider should be able to explain what it protects, what it monitors and what it needs your staff to do.

Make cyber security a business responsibility

Small businesses do not need a large internal security department to ask sensible questions about their exposure. They do, however, need to understand who owns important decisions and what their IT supplier has agreed to manage. Start by listing the business systems holding customer information, confidential files, payment details or operational records.

Ask who authorises user access, checks important security alerts and makes decisions when suspicious activity occurs. An IT provider can support those activities, but responsibility should not become unclear simply because an external company administers the technology.

Ask for evidence, not only assurances

If a provider says backups are working, ask when a restoration was last tested and what was recovered. If it says software is patched, ask which systems are covered and how failed updates are identified. If monitoring is included, establish whether the supplier only sends alerts or also investigates and resolves problems.

A short written security review can be more valuable than a vague promise that everything is protected. Record agreed actions, their owners and due dates so that important gaps do not disappear between contract meetings.

Agree what happens during an incident

Have a contact list that does not depend entirely on the affected IT systems. Define who can isolate devices, communicate with employees, speak to customers and obtain specialist advice when necessary. The correct response depends on the incident and legal obligations, so a generic technical checklist should not replace a properly considered plan.

Businesses should also understand which work is part of their support agreement and which requires specialist incident-response services. Clear arrangements are especially important when separate suppliers manage connectivity, cloud systems and endpoint security.

1. Do we use multi-factor authentication everywhere important?

Ask about business email, administrator accounts, cloud applications and remote access. Find out which accounts are protected, whether exceptions exist and who reviews them.

2. Who installs security updates, and how quickly?

Updates should cover operating systems, business applications, network equipment and devices. Ask how your provider identifies unsupported systems and reports outstanding risks.

3. Are our backups protected and regularly tested?

A backup isn’t a recovery plan unless important information can be restored. Ask what data is backed up, how often, where copies are held and when restoration was last tested. The NCSC’s backup guidance gives a useful starting point.

4. What happens if an employee clicks a malicious link?

Your team should know how to report an unexpected login prompt, suspicious payment request or malware warning. Ask who responds, what evidence should be kept and whether your business has a written incident plan.

5. How are laptops, phones and remote workers protected?

Find out whether devices are encrypted, centrally managed and capable of being locked or wiped if lost. Clarify how staff working from home access business systems securely.

6. Who can access our systems, and who removes access?

Ask about administrator privileges, employee leavers, supplier accounts and access reviews. These processes matter just as much as security software.

7. Can you show us what is included in our security service?

Request a plain-English description of what your provider monitors, how incidents are escalated, what reporting you receive and which risks remain your responsibility. Beware of assuming that one cyber security product covers everything.

Turn the answers into a practical action plan

List the gaps, rank them by business impact and agree an owner for each action. Start with access to critical accounts, backup recovery and devices used every day. Then consider specialist support and independent assurance where necessary.

For official advice, the NCSC Small Organisations Guide is a helpful reference.

How Supplier Synergy helps

Supplier Synergy helps businesses identify suitable third-party cyber security and IT support providers, assess their proposed services and clarify responsibilities. Our matching service is supplier-funded, with no additional consultancy fee for that matching service. Services themselves are contracted directly with the selected provider.

Explore our Cyber Security and Cyber Essentials service information.