The basic cyber skills every UK business owner should have (a plain-English guide)

The Register reported this week on the latest government skills research, and the headline figure is worth sitting with for a moment: 57 per cent of UK businesses say they lack confidence in basic technical cyber security skills, up from 49 per cent the year before. That is on the order of 808,000 businesses. The single weakest area was detecting and removing malware, where 38 per cent of businesses, and 47 per cent of charities, said they would not be confident. These are not advanced skills the survey was asking about. They are the everyday tasks that keep an ordinary small business out of trouble, and more than half the country is not sure it can do them.

I want to take that finding and do something useful with it rather than tut at it, because the gap is entirely closable, and closing it does not require hiring anyone. The survey measured confidence in nine basic tasks. What follows is each of them, in plain English, with what it actually means and what you, as the owner, should do about it, whether you do it yourself or simply know enough to make sure someone has. None of it is difficult. Most of it is free. And it maps almost exactly onto the Cyber Essentials scheme and the National Cyber Security Centre's Small Business Guide, so doing it also puts you within reach of a certification that customers increasingly ask for.

A word on tone before we start. I am not going to try to frighten you into any of this. Fear is a poor teacher and it wears off. The better frame is the one we use with our own clients: you are not buying protection from a nightmare, you are buying an ordinary uneventful morning, the kind where the business simply works and nothing has gone wrong, repeated day after day. Every skill below is a small deposit into that quiet morning. Let us go through them.

1. Storing data securely

The task the survey calls "storing data securely" comes down to two ordinary questions: where does your important information live, and who can get to it. Most small businesses have never written down the answer, which is why it feels hard. It is not; it is just unexamined.

Start by knowing what you hold and where. Customer records, financial data, contracts, the shared drive everyone dumps things into. For each, the practical skill is making sure it sits somewhere access-controlled rather than somewhere open, that the account protecting it has a strong unique password and multi-factor authentication, and that it is encrypted at rest, which for modern cloud storage and business laptops usually means turning on a setting that is already there. On a company Windows laptop that is BitLocker; on a Mac it is FileVault; on your Microsoft 365 or Google Workspace tenant it is largely handled for you provided the accounts themselves are properly secured. The owner's job is not to configure the cryptography. It is to be able to say, of every important pile of data, "that is behind a locked door, and I know who holds the key."

2. Setting up and configuring a firewall

A firewall is simply a control that decides what network traffic is allowed in and out. You already have several without realising it: the router your internet provider supplied has one, every business laptop has one built into its operating system, and your cloud services have their own. The skill the survey is testing is not building a firewall from scratch; it is making sure the ones you have are switched on and sensibly set.

In practice this means three things. The firewall on every company device should be enabled, which on Windows and macOS it is by default unless someone has turned it off. The boundary firewall, usually your router, should not be running with its factory administrator password, which is the single most common and most exploited oversight in small business networks. And any service you have deliberately opened to the internet, such as remote access to a server, should be one you can justify and have secured, rather than one that was opened years ago and forgotten. If that last point made you uneasy, that unease is the skill working.

3. Detecting and removing malware

This was the weakest area in the survey, and I understand why: it sounds like the job of an expert with specialist tools. For a small business it is mostly not. The modern version of this skill is prevention plus knowing the signs, rather than hunting through a machine by hand.

Prevention is the large part. Every Windows machine ships with Microsoft Defender, which is a genuinely capable anti-malware product, on by default and free; the skill is confirming it is running and updating on every device, not turning it off for convenience or assuming a paid product is mandatory. Restricting what can run, which is skill six below, does more to stop malware than any scanner. Keeping software updated, skill seven, closes the holes malware walks through. The detection part, for an owner, is knowing the tell-tales, a machine suddenly slow or hot, files you cannot open or that have odd new extensions, browser pages you did not choose, colleagues receiving emails you did not send, and knowing the response: disconnect the device from the network, do not switch it off if you suspect ransomware because that can destroy evidence, and call for help early. As Bridewell's Sam Thornton noted in the coverage, AI is helping attackers produce malware variants faster and harder to spot, which is exactly why the durable skill is the layered prevention above rather than trying to recognise every new specimen.

4. Storing and transferring personal data securely

This is skill one's stricter cousin, and it has the law standing behind it. Personal data, anything that identifies a living person, carries obligations under UK GDPR and the Data Protection Act 2018, and the skill is handling it deliberately rather than by habit. The everyday version is undramatic: do not email spreadsheets of customer details to your personal address to "work on at home", do not carry them on an unencrypted USB stick, and use a proper shared system with access controls rather than attachments pinging around inboxes.

The two practical habits that matter most are minimisation and encryption in transit. Minimisation means not collecting or keeping personal data you do not need, because the safest record is the one you never held. Encryption in transit means that when personal data does move, it moves over something protected: a link to a permissioned folder rather than an attachment, a website address that begins https, a file with a password sent separately from the file itself. If your business handles a meaningful amount of personal data, this is also where a conversation with a data protection specialist earns its keep, but the daily skill is simply treating personal data as something that is borrowed rather than owned.

5. Restricting which software can run

Most people have never thought of this as a security control, but limiting what software is allowed to run on your machines is one of the most effective things a small business can do, because a great deal of trouble arrives as a program a user was persuaded to run. The skill has two ordinary parts.

The first is not working as an administrator day to day. Everyone, including you, should do their normal work in a standard user account that cannot install software, keeping the administrator account for the moments installation is genuinely needed. This one change stops most opportunistic malware, because it cannot install itself if the logged-in user has no right to install anything. The second part is being deliberate about what gets installed at all: software from official sources rather than a search-engine advert, browser extensions kept to the few you actually use, and old applications removed rather than left to rot. On managed devices the technical control that enforces this is called application allow-listing, and it is worth asking your IT support whether they run it, but the owner's version is cultural: the default answer to "can I install this?" is "why, and from where?"

6. Choosing secure device settings

Equipment does not arrive secure. It arrives convenient, which is not the same thing, and "secure configuration" is the skill of closing the gap. The good news is that it is a one-time task per device rather than an ongoing burden, and the list is short.

The essentials are these: change every default password, on routers, on network equipment, on anything that came with "admin" and "password" printed in the manual. Turn off features and services you do not use, because each one is a door. Require a passcode or biometric to unlock every device, phones included, since a phone with your email on it is a key to the business. And enable the device's built-in encryption and firewall as covered above. For a small business the single highest-value habit here is multi-factor authentication on every account that offers it, especially email, because email is the account attackers want most: it is where password resets for everything else are sent. If you do one thing after reading this guide, turn on MFA everywhere, starting with your email.

7. Keeping software up to date

Almost every serious incident we investigate involves, somewhere in the chain, a piece of software that had a known flaw with an available fix that nobody had installed. "Security update management" is the skill of making sure fixes arrive promptly, and for a small business the honest best practice is to let the machines do it for you.

Turn on automatic updates everywhere they are offered: operating systems, browsers, phones, and the applications that support it. Automatic updating is not a lazy option; for an organisation without a dedicated IT team it is the responsible one, because the alternative is relying on a human to remember, and humans are busy. The parts that will not update themselves, such as network equipment or specialist software, need a simple recurring reminder, once a month, to check. And keep an eye on the calendar for things reaching end of life: an operating system or application the vendor has stopped supporting will receive no more fixes and should be replaced or removed, because it is a permanently open window. This is the same lesson that plays out at the top end of the market, where unpatched internet-facing systems are the way in for the most serious attacks; the principle is identical whether the box is a bank's gateway or your bookkeeping laptop.

8. Creating and managing user accounts securely

"Access control" sounds corporate, but for a small business it is just good housekeeping about who can do what. The skill is granting people the access they need for their role and no more, and keeping that tidy as people join, change roles and leave.

Three habits carry most of the value. Give each person their own account rather than sharing logins, because a shared login is one nobody is responsible for and nobody can safely revoke. Grant the minimum access the role requires, so that a compromised account can reach less. And remove access promptly when someone leaves, which is the step most often missed and the one that produces the ex-employee who can still read the shared drive months later. Keeping a simple list of who has access to what, and reviewing it a few times a year, is the whole of the skill. Add multi-factor authentication on top, and you have made a stolen password far less useful to whoever steals it.

9. Backing up your data

The ninth skill, and the one I would not let any business be without, is keeping backups you have actually tested. Backups are what turn a ransomware attack or a failed hard drive from a catastrophe into an inconvenience, and the skill is not merely having them but being able to rely on them.

The rule worth remembering is three copies of anything important, on two different types of storage, with one kept off-site or offline. In practice, for a small business, that often means the working copy on your systems, a copy in a reputable cloud service, and a copy that is disconnected from the network so that ransomware cannot reach and encrypt it too. The part almost everyone skips is the test: a backup you have never restored from is a hope, not a plan. Once a quarter, try to recover a real file from your backup and confirm it works. The morning you actually need the backup is the worst possible time to discover it was never running.

How this adds up to something recognised

Read back over those nine skills and you have, almost exactly, the Cyber Essentials scheme, the UK government-backed certification built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. You have also covered most of the NCSC's Small Business Guide, which adds backing up, protecting against malware, keeping devices safe, using strong passwords and recognising phishing. In other words, the "basic skills" the survey found missing are not a random collection; they are a coherent, well-documented standard, and both the NCSC Small Business Guide and the Cyber Essentials scheme lay them out for free.

There is a commercial reason to close the gap as well as a safety one. Cyber Essentials certification is increasingly a condition of winning work, required for many public-sector contracts and asked for by a growing number of private buyers as part of their own supply chain checks. So the same effort that gives you the quiet morning also, quite often, opens a door to a contract. If certification is your goal, our Cyber Essentials practice takes organisations through it, but you do not need us to start: the controls above are the substance of it, and most of them you can put in place this week.

The one skill the list leaves out

There is a tenth skill the nine-task survey does not directly measure, and it is the most important of all: knowing what to do when something goes wrong anyway. Even a business that does everything above will, one day, have an incident, because no defence is perfect and the people attacking you are inventive. The skill is having thought about it in advance. Who do you call? Where are the backups and who can restore them? How do you reach your customers if your email is down? Do you know that a personal data breach may need to be reported to the Information Commissioner's Office within seventy-two hours? None of that requires technical depth; it requires a single sheet of paper written on a calm afternoon rather than improvised on a bad one. If you take the good-morning framing seriously, the incident plan is the umbrella you keep by the door precisely so that most mornings you do not need it.

The survey's finding is genuinely a concern at national scale, because a great many small weaknesses add up to a fragile whole, and Sam Thornton is right that closing the gap will need affordable, practical support for smaller organisations. But at the level of your own business it is not a cause for alarm. It is a short, ordinary to-do list, most of it free, none of it requiring a specialist, and every item on it buying you the same thing: an uneventful morning, tomorrow and the day after.

Frequently asked questions

I am not technical. Can I really do these things myself? Most of them, yes. Turning on automatic updates, enabling multi-factor authentication, using a standard account for daily work, checking your backups and changing default passwords need no technical training, only a little time. For the few that benefit from a hand, such as configuring a firewall properly or setting up application allow-listing, the skill you need as the owner is knowing the task exists and making sure someone competent has done it. The guide above is written so you can hold that conversation.

What is the single most valuable thing to do first? Turn on multi-factor authentication everywhere it is offered, starting with your email and your most important cloud accounts. Email is the account attackers most want, because it is where password resets for everything else arrive, and MFA is the single control that most reliably defeats a stolen password. It is free and takes minutes per account.

Is Cyber Essentials worth it for a small business? Usually, yes, on two counts. The process itself walks you through exactly the controls in this guide, so it improves your security whether or not you certify. And the certificate is increasingly required to win contracts, particularly in the public sector and within larger firms' supply chains, so it can pay for itself commercially. It is designed to be achievable by small organisations without a dedicated IT team.

We use Microsoft 365 / Google Workspace. Does that mean we are covered? It gives you good tools, but only if they are switched on and the accounts are secured. Both platforms can store data securely, enforce multi-factor authentication and handle a great deal for you, but out of the box they favour convenience. The skills above are largely about turning on and configuring what you are already paying for, especially MFA, access control and secure sharing rather than email attachments.

How often should we revisit all this? Treat the one-time tasks, secure configuration and default passwords, as done once per device and rechecked when you buy new equipment. Treat access reviews and a backup restore test as quarterly habits. And put a monthly reminder in the calendar to check that anything which does not update itself has been updated. Beyond that, an annual look at the whole list, perhaps alongside a Cyber Essentials renewal, keeps it current.