A small business can depend heavily on email, accounts and connected services even without a large IT team. Review the risk through the work that would stop and the information that needs protection.
Do not infer safety from business size
The useful planning question is not whether the business feels prominent. Identify the accounts, payment processes, customer information and suppliers it relies on. A relatively small operation can still have important dependencies and limited recovery capacity.
This guide does not assert that every small business is a prime target or quote an unsupported 2026 incident rate. For national reporting, consult the ACSC reports and statistics library and read the date, population and measure before applying a figure.
Map the interruption
Choose an important task, such as receiving orders or accessing business email. Record which accounts, devices and suppliers make it possible and what happens if one is unavailable. Include the people who can approve access changes and contact the provider.
An illustrative exercise might reveal that the only account-recovery instructions sit inside the unavailable mailbox. That is a concrete planning gap to address, without needing to predict which attack will happen next.
Review basic controls and ownership
Check named accounts, appropriate permissions, supported updates, suitable MFA and approved devices. Give staff a practical route to verify unusual requests and report concerns. These measures work together; no single product makes the business immune to incidents.
Confirm how supplier and administrator access is removed when it is no longer needed. Keep responsibility boundaries clear where the website, email and cloud service are managed by different organisations.
Prepare response and recovery at the same time
Maintain incident contacts and a controlled way to coordinate if usual accounts are affected. Define backup coverage and test restoration of representative information. Recovery readiness belongs in the initial plan rather than after every possible preventive measure has been purchased.
Agree which decisions need external expertise and who can authorise it. Review contractual, insurance and privacy requirements in the actual business context instead of assuming that one public checklist covers them all.
Prioritise a bounded next step
Choose a small set of gaps with owners and acceptance checks. A useful result might be verified recovery access for an important service, an obsolete account removed or a tested backup restoration. Record what was checked and what remains uncertain.
Our cybersecurity service page and recovery planning page explain the scoping conversation. Treat the plan as risk reduction and preparedness, not a promise that no disruption will occur.
