Free resource · Basic cyber skills for small business
Nine basic cyber skills,one afternoon.
The government's 2026 research found 57 per cent of UK businesses lack confidence in basic cyber skills — around 808,000 businesses. “Basic” really does mean basic: nine ordinary tasks, most of them free, none needing a specialist. Here they are, with what each one means and what to do, plus a one-page checklist to print.
9 skills + 1Maps to Cyber EssentialsMost of it freeFree to use and share
Do the task, then tick the box.
Confidence comes from having done the thing, not from having read about it. Work down the list and tick each item only when it is genuinely in place across your business. If you do just one thing first, turn on multi-factor authentication everywhere it is offered, starting with email: it is the account attackers most want, and MFA is the single control that most reliably defeats a stolen password.
- Free
- Most items cost nothing and need no specialist
- CE
- The nine map onto the five Cyber Essentials controls
- MFA
- If you do one thing first, do this
The checklist
The nine skills, and the tenth
The nine skills, and the tenth
Work down the list. Tick each when it is genuinely done, not merely intended. The tags in brackets show which of the five Cyber Essentials controls each one belongs to, so finishing the list also puts certification within reach.
-
Store data securely (secure configuration). Know where your important data lives and who can reach it. Strong unique passwords, multi-factor authentication and device encryption — BitLocker on Windows, FileVault on Mac — turned on.
-
Configure your firewalls (firewalls). The firewall on every device switched on; the router off its factory administrator password; no service left open to the internet that you cannot justify.
-
Detect and remove malware (malware protection). Microsoft Defender, or an equivalent, running and updating on every device. Know the tell-tales, and if you suspect an infection, disconnect the device from the network and call for help early.
-
Handle personal data safely (data protection / UK GDPR). Collect only what you need, and move it by a permissioned link over https rather than as loose email attachments or on an unencrypted USB stick.
-
Restrict what software can run (secure configuration). Everyone, including you, works in a standard non-administrator account day to day. Install only from official sources, and remove what you do not use.
-
Choose secure device settings (secure configuration). Change every default password. Require a passcode or biometric on every device, phones included. Turn off features and services you do not use.
-
Keep software updated (security update management). Automatic updates on everywhere they are offered; a monthly reminder for the few things that will not update themselves; anything past its end of life replaced.
-
Manage user accounts (user access control). One account per person, never shared logins. Least access for the role. Leavers removed promptly, and the list reviewed a few times a year.
-
Back up your data (NCSC Small Business Guide). Three copies, on two types of storage, with one kept off-site or offline. Test a real restore once a quarter — an untested backup is a hope, not a plan.
-
Plan for the bad day (the skill the survey leaves out). One page, written on a calm afternoon: who to call, where the backups are and who can restore them, how to reach customers if email is down, and the fact that a personal-data breach may need reporting to the ICO within seventy-two hours.
Start this week
The five-minute wins
Turn on MFA
Multi-factor authentication on email first, then every cloud account that offers it. Free, minutes each, and it defeats most stolen passwords.
Switch on automatic updates
On every operating system, browser and phone. For an organisation without dedicated IT, letting the machines update themselves is the responsible option, not the lazy one.
Change default passwords
Starting with the router and any network equipment still using “admin”. It is the most exploited oversight in small-business networks.
Work as a standard user
Do daily work in a non-administrator account. Opportunistic malware cannot install itself if the logged-in user has no right to install anything.
Test one backup
Recover a real file from your backup today. If it works, you have a plan; if it does not, you have just avoided finding out on the worst possible morning.
Write the one-pager
Who to call, where the backups are, how to reach customers if email is down, and the ICO 72-hour clock. One sheet, written calm, kept by the door.
About this checklist
This checklist accompanies our full guide, The basic cyber skills every UK business owner should have, and turns the nine tasks in the government's 2026 skills research into something you can work through and tick off. It is free to use, print and share inside your organisation; if you publish it elsewhere, a link back is appreciated. Last reviewed September 2026. Corrections and suggestions to hello@cyber-defence.io.
Start a conversation
Want a hand getting to Cyber Essentials?
The nine skills are, almost exactly, the five Cyber Essentials controls. If certification is your goal — increasingly a condition of winning work — we can take you through it, or simply check the ground you have already covered.