Cybersecurity Best Practices for UK Businesses: 30-Day Plan

Cybersecurity best practices are the baseline controls that stop the most common attacks and limit the damage when one gets through: strong sign-in protection, timely patching, tested backups, restricted access, filtered email, endpoint detection, a known asset list, a rehearsed response plan and checked suppliers. For a UK business, the aim is to do these well, in a sensible order, rather than to buy every tool on the market.

The scale of the problem is not abstract. The government's Cyber Security Breaches Survey 2025/2026 (published 30 April 2026) found that 43% of UK businesses identified a breach or attack in the previous 12 months, rising to 65% of medium and 69% of large businesses.

This guide ranks the controls by how much risk they remove for the effort involved, checks them against NCSC guidance, and finishes with a table you can hand to whoever runs your IT.

1. Multi-factor authentication and password hygiene

Stolen or guessed credentials remain the easiest route into a business. The NCSC calls its version of this 2-step verification (2SV) and recommends it for important accounts, especially email and cloud services.

• Turn on MFA for email, Microsoft 365 or Google Workspace, remote access, finance systems and every administrator account first.
• Prefer an authenticator app or hardware key over text messages where you can.
• Use a password manager so staff can use long, unique passwords without writing them down.
• Block legacy sign-in methods that bypass MFA.

The government survey found that only 47% of UK businesses used any form of two-factor authentication for networks or applications, so this is still a gap in many firms. If you run Microsoft 365, our Microsoft 365 support team can enforce MFA through conditional access.

2. Patching and secure configuration

Attackers routinely exploit known flaws in software that has not been updated. Patching means applying vendor security updates to operating systems, applications, browsers, firewalls and routers within a defined timeframe, with the fastest turnaround for flaws that are being actively exploited.

• Keep a patch policy that sets target timeframes by severity.
• Remove or replace software that no longer receives updates. Our guide to Windows 10 end of support explains what that means for devices still running it.
• Change default settings and passwords on every device, and disable services you do not use.
• Manage laptops and phones centrally so settings are enforced rather than requested.

Security update management and secure configuration are two of the five technical controls in Cyber Essentials, the NCSC-backed scheme for UK organisations.

3. Backups: 3-2-1, immutable and tested

Backups are your last line of defence against ransomware, accidental deletion, hardware failure and disaster. The NCSC's small organisations backup guidance tells businesses to back up everything they need to operate, to keep a copy that is not permanently connected to the device being backed up, to protect online backups with 2SV and to learn how to restore and check the result.

Many IT teams add the widely used 3-2-1 rule on top of that:

• 3 copies of your data: the live version and two backups.
• 2 different types of storage, such as cloud and disk.
• 1 copy held off-site or offline.
• Immutable storage where possible, meaning a backup cannot be altered or deleted for a set period, even by an administrator account an attacker has taken over.

4. Least privilege and access control

Least privilege means people and systems get only the access they need for their role. If an account is compromised, the damage is limited to what that account could reach.

• Give administrators two accounts: one for daily work, one for administration.
• Remove access promptly when staff leave or change roles.
• Review shared mailboxes, shared drives and third-party app permissions every quarter.
• Limit who can install software or approve new cloud applications.

The ICO's October 2025 decision to fine Capita £14 million cited, among other failings, the absence of a tiering model for administrative accounts, which let an attacker move across the network after the initial compromise. It is a clear example of why admin access deserves separate treatment.

5. Email and phishing protection

Email is still the main delivery route for fraud and malware. The government survey found that 38% of UK businesses experienced phishing in the year covered, and that phishing was the only type of attack experienced by 51% of those that had any breach.

• Switch on spam, malware and impersonation filtering, and scan links and attachments.
• Publish SPF, DKIM and DMARC records so criminals find it harder to send email that appears to come from your domain.
• Add a payment-change verification step: no bank detail changes without a call-back to a known number.
• Give staff an easy way to report suspicious email.

Our explainer on phishing types and prevention covers what to look for, and a managed IT support provider can apply the filtering for you.

6. Endpoint detection and response

Traditional antivirus matches known malicious files. Endpoint detection and response (EDR) monitors behaviour on laptops, desktops and servers, flags suspicious activity such as credential theft or mass file encryption, and lets a person or service isolate the device quickly.

EDR is only as good as the response behind it. An alert at 2am that nobody reads helps no one, which is why many smaller firms choose managed EDR services where specialists monitor and act on alerts. The Capita decision above is again relevant: the ICO found a high-priority alert took 58 hours to be acted on against a one-hour target.

7. Asset inventory, incident response and supplier checks

These three are less glamorous and often skipped, but they decide how well you cope when something goes wrong.

Asset inventory

You cannot patch, monitor or retire what you do not know about. Keep a live list of devices, servers, cloud tenants, key applications and who owns each.

Incident response plan

Write down who decides, who calls whom, how you isolate systems, when you contact your insurer, the ICO and customers, and how you restore. The NCSC's incident management guidance says good preparation is the one thing that helps most in dealing with an incident. Only 25% of UK businesses had a formal incident response plan, according to the same government survey.

Supplier checks

Your security includes your suppliers' security. Just 15% of businesses reviewed the risks posed by their immediate suppliers. Start with those that hold your data or have access to your systems, and read how past incidents unfolded in our article on supply chain risks.

Your first 30 days: a priority table

This is a sensible order for a business starting from a low base. Adjust it if your risk assessment points elsewhere.

Once these are in place, the logical next step is a formal baseline. Cyber Essentials certification tests the five technical controls, and our requirements checklist shows what assessors look for. For an independent view of where you stand today, a cyber security audit identifies gaps against your own risks.

Putting cybersecurity best practices into practice

Good cybersecurity best practices are not exotic. They are MFA, patching, tested backups, restricted access, filtered email, monitored endpoints, a known estate, a rehearsed plan and checked suppliers, done consistently and owned by named people. Work through the first 30 days table, record what is done, and review it every quarter.

If you would like help prioritising or delivering any of this, speak to the NetMonkeys team.

Frequently Asked Questions (FAQs)