Cybersecurity for a very small business or an SME does not start with buying a tool: it starts with knowing what you need to protect, who has access to it and how the company reacts on the day an incident occurs. This guide sets out a concrete approach, designed for a non-specialist business owner, in Morocco and internationally.
Why cybersecurity also matters for small organisations
Email, invoicing, CRM, website, mobile app, online storage: even a small company now depends on many digital services. Each one holds data the business relies on, such as customer files, accounts, contracts or trade know-how.
An incident can take several forms: a hijacked email account, files made unreadable, an unavailable website or a leak of customer data. In every case, business continuity and customer trust are at stake. The goal is not to reach zero risk, but to reduce the most likely risks with measures proportionate to the size of the company.
Take stock of your assets and your access rights
You can only protect well what you know about. The first step is to draw up a simple inventory:
- Equipment: workstations, servers, smartphones, tablets.
- Software and online services: email, CRM, ERP, invoicing, business tools.
- Online presence: website, e-commerce shop, business accounts on social networks.
- Accounts and access: who can access what, including service providers, interns and former employees.
- Sensitive data: customer and prospect files, HR records, accounts, quotes and contracts.
This inventory is also the starting point of an IT audit for SMEs: it helps identify what is critical and set priorities.
Lock down access: passwords, authentication and permissions
Access control is the most direct measure. A few rules are enough to greatly reduce exposure:
- Passwords: long, unique for each account and never shared by email or messaging. A password manager makes this discipline easier.
- Multi-factor authentication: to be enabled first on email, financial tools, administrator accounts and critical online services.
- Least privilege: each employee only accesses the data and functions needed for their work.
- Arrivals and departures: a written procedure for creating, changing and deactivating accounts, including those of service providers.
- Administrator accounts: separate from the accounts used day to day and limited to a few people.
Keep devices and applications up to date
Updates fix known vulnerabilities. Putting them off means leaving a door open.
- Schedule updates for systems, browsers, business software and mobile devices, and apply without delay the security patches flagged as critical by vendors.
- Set rules for personal devices used for work: screen lock, encryption where the device allows it, separation of professional and personal use.
- Avoid unsecured public Wi-Fi networks when accessing company tools.
- Uninstall software and close accounts that are no longer used.
Secure your web and mobile applications
A website, a customer portal or a mobile app is exposed at all times. Their security is addressed from the design stage, then throughout their life:
- Regular updates of the components, libraries and modules in use.
- Management of roles and permissions within the application, with protected administrator accounts.
- Encryption of data in transit and protection of stored data.
- Logging of sensitive actions to understand what happened if an anomaly occurs.
- Scheduled maintenance after go-live, and not only when something breaks.
If you are preparing to move your applications to the cloud, build these points into the project: see our guide to cloud migration for SMEs.
Raise your teams' awareness of phishing
Many incidents begin with a deceptive message. Awareness training should therefore be short, regular and concrete:
- Scenarios to show: fake invoice, fake message from a bank, impersonation of a supplier or an executive, fraudulent link received by email, messaging or on social networks.
- Reflexes to instil: check the sender's address, do not click on an unexpected link, never pass on a password, have any urgent transfer request confirmed through another channel.
- Reporting: every employee must know who to report a suspicious message to, without fear of being blamed.
- Social networks: limit the sensitive information published and keep professional and personal accounts separate.
Back up and prepare your incident response
No protection is absolute. Reliable backups and a clear procedure make the difference on the day an incident occurs.
- Backups: several copies, including one off-site or offline, and regular restoration tests. Our guide to business data backup explains the method in detail.
- First steps: isolate the affected device, change the passwords concerned, alert the IT contact person and write down the facts (date, time, symptoms).
- Communication: know who informs customers, partners and, where the applicable rules require it, the competent authorities. Check the data protection obligations that apply to your business and your country.
- Recovery: list the functions to restore first, such as invoicing or customer relations, and the fallback tools planned.
Organise the approach: audit, action plan and support
A cybersecurity approach lasts over time if it is organised:
- Current state review: an audit reviews the systems, access rights, user practices and backups.
- Prioritised action plan: first the simple measures (access, awareness), then the scheduled technical actions (updates, permissions), and finally the in-depth actions (procedures, documentation).
- Designated owner: a contact person, even part-time, follows the plan and keeps the documentation up to date.
- Regular review: the checklist and the training are updated when the company, its tools or its teams change.
Unziptech is an IT consulting and development company based in Fez, working in artificial intelligence, web, mobile, custom software and consulting. Its projects come with training, documentation and maintenance contracts.
Practical cybersecurity checklist for small businesses and SMEs
- Inventory of equipment, software and online services completed.
- List of accounts and administrator access up to date.
- Password rules written down and communicated.
- Multi-factor authentication enabled on critical accounts.
- Procedure for employee arrivals and departures in place.
- Updates scheduled for systems, software and applications.
- Rules for the use of mobile devices and remote work defined.
- Phishing awareness carried out and renewed.
- Backups documented and restoration tested.
- Incident response procedure written.
- Cybersecurity contact person designated.
If several points remain open, contact Unziptech for a free personalised quote.
Cybersecurity for SMEs: FAQ
Where should we start if cybersecurity has never been addressed in the company?
With the inventory of equipment, accounts and data, then with access: unique passwords and multi-factor authentication on critical accounts. These first measures mostly require organisation.
Is my data secure because it is in the cloud?
Not automatically. The cloud shifts part of the responsibilities, but access configuration, permission management and backups still have to be organised on your side.
How can we raise awareness in a small team without holding up the business?
With short, regular sessions based on examples close to your line of work, and one simple instruction: report any suspicious message to a designated person.
What should I do if I discover a suspicious message or files that have become unreadable?
Isolate the device concerned, change the affected passwords, alert your IT contact person and write down the facts. Before any other decision, seek advice from a professional.
Is a small business concerned by data protection rules?
The rules depend on the country, the activity and the data processed. Check the texts that apply to your situation with the competent authorities or a legal adviser.
What is the purpose of an IT audit in a cybersecurity approach?
It gives a clear view of the situation, identifies the priority risks and leads to a realistic action plan, suited to the size and resources of the company.