Cybersecurity Basics for Small Businesses in South Africa

Many small business owners assume attackers only target big companies. In reality, small businesses are attractive precisely because they are easier: fewer controls, less monitoring and often valuable data and bank access. Ransomware, invoice fraud, stolen credentials and data breaches hit businesses of every size, and recovery can be expensive and slow.

The good news is that a handful of basic controls stops most attacks. You do not need a huge budget. You need consistency.

The threats you are most likely to face

Phishing and email scams, where staff are tricked into clicking links, opening attachments or sharing passwords. See phishing and email scams.
Business email compromise, where criminals impersonate suppliers or executives to redirect payments.
Ransomware, which encrypts your files and demands payment.
Stolen or weak passwords, reused across services.
Unpatched software, exploited through known vulnerabilities.
Lost or stolen devices holding unprotected data.
Insider mistakes, such as sending information to the wrong person.
Compromised websites used to steal data or spread malware. See what to do if your website is hacked.

The essential controls

1. Turn on multi-factor authentication (MFA)

MFA requires a second proof of identity, such as a code from an app, in addition to a password. It blocks the vast majority of account takeover attempts.

Enable it for email, cloud storage, accounting, banking, remote access and admin accounts first.
Prefer authenticator apps or security keys over text message codes where possible.
Do not exempt senior staff.

2. Use strong, unique passwords

A password manager lets everyone use long random passwords without memorising them.
Never reuse passwords across services.
Change passwords immediately if a breach is suspected.
Remove shared logins where possible, so activity is traceable.

3. Keep everything updated

Attackers exploit known flaws in operating systems, browsers, plugins, routers and applications.

Turn on automatic updates for computers and phones.
Patch servers, firewalls and network devices on a schedule.
Update your website platform, themes and plugins promptly. See website maintenance plans explained.
Replace software and hardware that no longer receives security updates.

4. Protect endpoints

Every computer and phone is an entry point.

Use modern endpoint protection, ideally with detection and response capabilities, not just basic antivirus.
Encrypt laptops so lost devices do not mean lost data.
Enable screen locks and remote wipe for phones and laptops.
Limit local admin rights, so malware cannot install itself freely.

5. Back up and test restores

Backups are your best defence against ransomware and accidents.

Follow the 3-2-1 approach: three copies, two types of media, one off-site or offline.
Include cloud data, such as email and files, because cloud providers do not replace backups.
Keep at least one copy that attackers cannot reach from your network.
Test restores regularly. A backup you cannot restore is not a backup.

See online store security and backups and power outages and your business IT for related practice.

6. Secure email

Email is the main route for attacks.

Use a good spam and phishing filter.
Block or flag dangerous attachments.
Configure SPF, DKIM and DMARC on your domain so criminals cannot easily forge your address. See domains, hosting and business email explained.
Add warnings to emails arriving from outside the company.

7. Secure your network

Change default passwords on routers and devices.
Use a business-grade firewall, kept updated.
Separate guest Wi-Fi from the business network.
Use strong Wi-Fi encryption, and a strong password.
Disable services and ports you do not need.
Use a VPN or secure remote access for staff working off-site.

8. Limit access

Give people only the access they need.

Use individual accounts, not shared ones.
Review permissions regularly, and remove access promptly when people leave or change roles.
Restrict admin accounts, and do not use them for daily work.
Control who can access sensitive financial and customer data.

9. Train your people

Staff are your first line of defence and also the most common target.

Run short, regular awareness sessions, not just a yearly lecture.
Teach people to recognise phishing, urgent payment requests and suspicious links.
Run simulated phishing tests and use them to learn, not to punish.
Make reporting easy and blame-free, so mistakes are reported quickly.
Create a rule: any request to change bank details must be verified by phone using a known number.

10. Have an incident response plan

Decide in advance what you will do when something goes wrong.

Who is in charge, and who should be called: IT provider, insurer, lawyer?
How to isolate affected devices.
How to communicate with staff and customers.
When and how to notify authorities and affected people.
How to restore from backups.

Print the plan and keep contact numbers where you can reach them without your network.

Privacy law and security

South African privacy law (POPIA) requires reasonable security measures to protect personal information, and obliges you to notify the Information Regulator and affected people if there is a breach involving unauthorised access. Basic controls such as MFA, encryption and access management support compliance. See POPIA and your business website.

A simple maturity roadmap

This month:

Enable MFA on email and critical systems.
Install a password manager.
Check that backups run and test one restore.
Turn on automatic updates.

Next three months:

Deploy endpoint protection and device encryption.
Configure email authentication and filtering.
Run staff awareness training.
Review user access and remove old accounts.

Next six to twelve months:

Build and test an incident response plan.
Add monitoring and alerting.
Review suppliers and the data they hold.
Consider cyber insurance and what it requires.

Getting help

Many small businesses do not have an IT person. A managed IT provider can implement, monitor and maintain these controls for a predictable monthly fee. See what managed IT support costs per user for how pricing works, and what to ask.

The bottom line

Security is not a product you buy once; it is a set of habits and controls maintained over time. Start with MFA, updates, backups and training, and build from there. These steps cost little compared with the cost of a breach, and they make your business a much harder target.