Cybersecurity for small business: the basics, what to do if it happens and what applies in October 2026

Published on 4 November 2026by Tauro Lab9 min read

In short Cybersecurity for a small business comes down to a few protections done well: two-step verification on email, different passwords in a password manager, a backup kept off the network and actually tested, updates switched on, and care with urgent messages. You also need to know in advance who to call, because with customer data the breach notification to the authority is due within 72 hours. And since 2026, customers subject to NIS2 ask small suppliers for guarantees too.

A cyber incident in a small business is rarely spectacular: the same password on email and the management system, an attachment opened at 5 pm on a Friday, the wi-fi password in the office WhatsApp group, a backup nobody has ever opened. Cybersecurity for small business starts here, with no IT department. Below are five checks you can do today, what to do if it happens, and what changed in the rules in 2026.

An honest word first: we write software, we are not system administrators. This is a list of what to check yourself and what to ask your technician.

Cybersecurity for small business: what is really at risk

There are three typical kinds of damage. Your data gets locked and someone demands a ransom: that is ransomware. Someone gets into your email and writes to your customers in your name, perhaps with a new bank account number. Or the data of customers, staff and suppliers ends up where it should not. Being small does not protect you: many attacks pick nobody in particular.

The numbers bear this out. According to the Clusit 2026 report by the Italian cybersecurity association, presented in March 2026, known serious incidents worldwide in 2025 numbered 5,265 (up 49% on 2024) and in Italy 507 (up 42%, from 357), 9.6% of the total. In Italy, phishing and social engineering caused 12.4% of incidents, up 66%, helped by AI-written messages that are ever more convincing.

Five checks to do today, five minutes each

Two-step verification on email. Open the security settings of the company email account and check it is on. Email is the key to the house: from there, almost every other password can be reset.
Who still has access. Write down on a sheet of paper who can log into email, the management system, the bank, the website hosting and social accounts. If there is a name of someone who no longer works with you, or an 'office' account everyone knows, you have found your first job.
Restore one file from the backup. A random one, now. See how long it takes and whether it opens. A copy nobody has ever opened is a hope, not a backup.
The router password. If it is still the one printed under the device or the provider's default, change it and ask your technician to update the firmware.
The 'if it happens' sheet. Name and number of the technician, the privacy adviser and the insurer if you have one, and where the emergency credentials are kept. Printed, not only on the computer that might be locked.

Backups: if you only do one thing, do this

A good backup gets you going again after ransomware, a broken disk or a file deleted by mistake. It is good if it meets these points:

several copies: the 3-2-1 rule means three copies, on two different kinds of storage, one away from the office;
at least one copy kept off the network, because a permanently connected drive gets encrypted with everything else;
automatic, because backups that depend on someone remembering get skipped sooner or later;
tested, as in point three above, with a fixed date in the calendar.

If your data lives in an online service, the question goes to the supplier: how often they back up, where the copies are kept, how fast everything can be restored. If they cannot answer, you have learned something.

Passwords, access and updates

a different, long password for every service, stored in a password manager: not in the browser of a shared computer, not in a file called 'passwords';
two-step verification on email, bank, management software, domain and website hosting;
one account per person, so you know who did what, and different permissions for different roles: whoever answers the phone should not open invoicing. If your software cannot do that, it is a serious limit: a system built around your processes has it from day one;
access removed the same day someone leaves, contractors and suppliers included;
automatic updates on computers, phones, browsers, the router and the website. A computer that no longer gets updates from its maker should be replaced or kept away from data. On a website every plugin counts: see our comparison of WordPress and custom development.

Phishing: the email with the new bank account

Phishing is a message, by email, text or WhatsApp, posing as someone you trust to make you click, pay or type in a password. A made-up case: a building firm gets an email, apparently from its materials supplier, with a new bank account number for the next invoice. A call to the usual number is enough to expose the scam. Before acting, check:

the urgency ('pay today', 'account about to be closed');
the real sender address, not the displayed name: often one letter is different;
where a link goes, by hovering over it without clicking;
attachments you were not expecting, even from a sender you know.

Every change of bank details is checked by phone, on a number you already have. And anyone who has clicked must be able to say so at once, without fear: if nobody admits the mistake, the damage grows.

What to do if it happens

Take the affected computer off the network: unplug the cable or switch off wi-fi. Do not delete anything.
Change the passwords of the affected services from another, clean device.
Call the technician on your 'if it happens' sheet.
Write down what happened and when: times, messages, screenshots.
Do not pay any ransom before talking to an expert: paying does not ensure you get the data back.
Restore from backup only after you understand how they got in.

If personal data is involved, the GDPR comes into play: the breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless a risk to the people concerned is unlikely (Article 33). In Italy this is done only online, through the data protection authority's portal, which also offers a self-assessment tool to work out whether notification is needed. Every breach, notified or not, must be recorded in an internal register. Brussels is discussing changes to thresholds and timing in the Commission's 'Digital Omnibus' proposal (November 2025), but at the end of October 2026 it is still a proposal: the 72 hours stand.

NIS2 in 2026: why it reaches small companies too

NIS2 is the EU directive on the security of networks and systems, transposed in Italy by Legislative Decree 138/2024. It directly concerns medium and large companies in sectors listed by the law, which register on the portal of the Italian National Cybersecurity Agency between 1 January and 28 February each year. For entities placed on the list in 2025, the duty to notify significant incidents started in January 2026 (early warning within 24 hours, full notification within the following 72) and the basic security measures must be in place by October 2026.

This is where you come in. Those measures include supply chain security: according to the agency's FAQ, NIS entities must assess the risk of their suppliers, give them security requirements and check compliance, and contracts signed, renewed or extended from that deadline onwards must contain those requirements. If a large customer sends you a security questionnaire or a new clause to sign, this is why.

Another 2026 date: since 11 September the Cyber Resilience Act requires manufacturers of software and connected devices sold in the EU to report actively exploited vulnerabilities and severe incidents; the bulk of its obligations arrives on 11 December 2027. If you sell software or connected products, talk to an adviser.

Website, software, automations: questions for your supplier

where the data is, who can reach it and how an access is removed;
who applies updates after handover, and whether that is in the contract;
whether development takes into account the OWASP Top 10, the list of the most critical risks for web applications, renewed at the end of 2025: the newcomer in third place is software supply chain failures, meaning unchecked third-party libraries and plugins;
how you export your data if you change supplier.

The same questions apply to a chatbot or an automation that touches customer data. For more, ENISA, the EU cybersecurity agency, publishes a guide for small businesses.

The minimum for this week

Do the five checks, put the next backup test in the calendar and write the 'if it happens' sheet. It takes a few hours and changes how heavy an incident will be.

Networks and computers are not our trade, so you need a technician you trust. If instead your company's data is scattered across spreadsheets, emails and programs that do not talk to each other, we can look at it together: our management software and custom development page explains how we work, and you can write to us for a first opinion.

Frequently asked questions

Is antivirus enough?

No. It stops the malicious software it recognises, but it cannot stop someone typing a password into a fake page and it does not recover lost data. It works alongside backups, updates and tidy access.

Is data online safer than on my own computer?

It depends. A serious service has facilities a small business cannot afford, but access remains yours: with a weak password and no two-step verification the door stays open. Ask the supplier where the data is and how backups are done.

How do I know whether an incident is a personal data breach?

It is one when people's data is lost, stolen, altered or seen by someone who should not have seen it: a stolen laptop with the customer list, an email with personal data sent to the wrong person, ransomware on client files. Not every breach has to be notified, it depends on the risk to the people involved. The 72 hours start when you find out.

A customer is asking me to sign a cybersecurity clause: is that normal?

Yes, and in 2026 it will happen more often. Companies subject to NIS2 must set security requirements for their suppliers and check them, and new or renewed contracts must contain them. Read it with your technician and an adviser before signing: it usually asks for reasonable things, two-step verification, backups, updates and a contact to alert.

Sources

Written by the Tauro Lab team, a web agency and software house in Turin. About us