The minimum cybersecurity measures every SME should have

MFA, backups, updates, training: most cyber attacks on an SME do not need sophisticated techniques, they exploit basic gaps left open for months. A reused password, a server that has never been updated, a backup nobody has ever tried to restore. These problems are trivial to describe and expensive to suffer.

In this guide you will find the minimum cybersecurity measures every SME should have, in order of priority: first those that close the doors attackers use most, then those that let you get back on your feet, and finally those that turn security into a habit. The checklist is based on the public guidance of Italy's National Cybersecurity Agency (ACN), ENISA's guide for SMEs and the services of CSIRT Italia. For each measure we look at what to do, what evidence to keep and how it links to the ISO/IEC 27001 controls, so that today's work becomes the foundation of a management system tomorrow.

What are the minimum cybersecurity measures for an SME?

Minimum cybersecurity measures are the basic protections that reduce the most common risks with an effort proportionate to the size of the company. They are not a product to buy but a set of rules, configurations and habits.

The ACN publishes on its website a cybersecurity guide for SMEs with separate advice for managers, employees and IT professionals or suppliers. ENISA, the European Union Agency for Cybersecurity, has published a 12-step guide for SMEs. Although worded differently, the two sources converge on the same points: strong authentication, backups, updates, anti-virus, encryption, training, supplier management and incident preparedness.

Why start with the basics rather than advanced tools

Basic measures come first because without foundations nothing else holds. An advanced monitoring system is of little use if the owner's email account is protected by a password also used elsewhere.

The reasoning is the same as an auditor's: before assessing sophisticated controls, you check that the elementary ones exist and work. An SME with 30 employees rarely has a dedicated security team. It has an in-house IT manager, often with other duties, or an external supplier. That is why the checklist below is ordered by impact and feasibility, not by technical complexity.

Who should take care of it in the company

Information security starts with top management, not with the IT department. Both the ACN and ENISA indicate the assignment of clear responsibility as the first step.

The ACN advises managers to appoint a person responsible for cybersecurity and to meet them regularly, to align security objectives with business objectives and to support the protection of vital processes, systems and data. ENISA adds that whoever holds this responsibility must have resources: people's time, tools, training, policies. In practice: a name, a budget decided by management and a fixed meeting, even just quarterly, to take stock.

Where to start: what should you protect first?

Before touching any configuration, you need to know what is vital to the business. The ACN recommends identifying critical activities, systems, services and data in order to prioritise action.

Take a typical company: an engineering workshop with 40 employees, a management system for orders and invoicing, a mailbox for each office worker, a file server with technical drawings and some remote access for the supplier of the CNC machines. If the management system stops, the company cannot invoice. If the drawings disappear, it cannot produce. If the accounts department's email is compromised, someone can send a customer a fake IBAN.

A minimum inventory answers five questions: which systems we use, where the important data sits, who accesses it, who manages it (in-house staff or suppliers) and what happens if it stops for a day. A shared spreadsheet and half a day's work with the IT manager are enough. This inventory is also the starting point of the risk assessment required by ISO/IEC 27001: you do not throw it away, you will build on it.

Priority 1: how do you protect access?

Access is the front line because a compromised account opens every door. This is where the measures with the best effort-to-result ratio are concentrated.

Multi-factor authentication (MFA)

Multi-factor authentication asks for a second proof in addition to the password: a code from an app, a notification, a physical key. If the password is stolen, it is not enough on its own.

The ACN recommends enabling MFA above all on email, cloud storage, privileged accounts and remote access. That is exactly the right order for an SME: email is the channel for payment fraud, the cloud holds the documents, administrative accounts control everything, and remote access is an open door to the outside. A typical mistake is enabling MFA for employees while leaving out the owner's account or the IT supplier's shared account, which are precisely the most attractive targets.

Passwords, passphrases and password managers

A good password is long, unique and hard to guess. ENISA suggests passphrases, that is at least three random common words combined into a phrase, easy to remember and hard to guess.

The rules, for both the ACN and ENISA, are few: do not reuse credentials on other services, do not share them with colleagues, avoid personal information that can be found online, use a dedicated password manager. The classic SME case is the single password for the management system written on a sticky note next to the reception monitor and shared by four people. When someone leaves the company, nobody changes it. Named accounts and a password manager solve the problem and leave a trail of who did what.

Administrative privileges kept to a minimum

Users should not have administrator rights on their own PC. The ACN recommends limiting privileged accounts to the system administrators who strictly need them.

Administrators, moreover, should use a standard account for everyday work and the administrative one only when needed. The reason is practical: if an employee opens a malicious attachment, the damage stays confined to their permissions. If that employee is an administrator, the malware can install itself anywhere. In many SMEs administrator rights were granted years ago "for convenience", to install a printer or a program, and never revoked.

Priority 2: how do you recover after an attack or failure?

If an attack succeeds, what matters is being able to restore data within acceptable times. Backup is the measure that separates a bad day from an interruption that puts the business at risk.

The rules of a backup that works

ENISA lists four rules: backups that are regular and automated where possible, held separately from the production environment, encrypted especially if moved between locations, with the ability to restore tested regularly. The ACN adds that critical data should be prioritised and that, where possible, local and cloud copies should be combined.

Separation from the server is the most underestimated point. An external disk permanently connected to the server or a folder synchronised on the same domain can be encrypted by ransomware together with the original data. The backup must be in a place that an attacker who has entered the network cannot reach with the same credentials.

The restore test: the evidence that matters

A backup never tested is no guarantee. Both the ACN and ENISA recommend periodic tests of a full data restore.

Back to the workshop: the IT supplier backs up the management system every night, but nobody has ever tried to restore it on a clean server. On the day of the failure it turns out that the backup copied the database files but not the application configuration, and it takes days to rebuild it. A documented test, for example every six months, with date, outcome and time taken, would have revealed the problem earlier. That record is also evidence an ISO 27001 auditor is glad to see. If you want to go beyond backup and plan how the company keeps working during an interruption, the next step is a business continuity plan.

Priority 3: updates, anti-virus and encryption

This priority is about closing known vulnerabilities before someone exploits them. Attackers often use flaws the vendor has already fixed but which have not yet been installed.

Updates and obsolete systems

The ACN recommends keeping operating systems and applications up to date, either with automatic updates or with a guideline that sets priorities. ENISA adds that you should identify the software and devices that require manual updates, without forgetting smartphones and IoT devices.

The most insidious problem is unsupported systems: the old PC that runs a production machine, the NAS bought ten years ago, the firewall whose vendor no longer releases patches. The ACN recommends avoiding them. When you cannot replace them right away, isolate them from the network and record the decision with a deadline: a risk accepted knowingly is different from a risk ignored. CSIRT Italia publishes alerts and bulletins on actively exploited vulnerabilities: following them helps you understand which updates to install first.

Anti-virus, email protection and firewalls

Every device needs up-to-date anti-virus, preferably centrally managed, as both the ACN and ENISA indicate. ENISA also recommends tools that filter spam, malicious links and infected attachments, and a firewall protecting the company network from the Internet.

Central management makes the difference between "we have anti-virus" and "we know it works on every PC". From a console the IT manager can see which devices have not updated for weeks or have reported threats. Without a console, they find out only when there is a problem.

Encryption of devices and data

Encryption makes data unreadable without the key. The ACN recommends enabling it on every possible asset: PCs, servers, smartphones and removable media.

The typical case is a sales rep's laptop stolen from a car. If the disk is encrypted, you have lost a device. If it is not, you have also lost the customer list, the quotes and perhaps personal data, with possible consequences under the GDPR. Article 32 of the GDPR in fact lists encryption among the appropriate security measures, together with the ability to restore data in a timely manner and regular testing of the effectiveness of the measures.

Priority 4: why is training a technical measure like any other?

Many attacks begin with a well-crafted message: a fake invoice, a non-existent courier, a colleague asking for an urgent bank transfer. No filter blocks them all, so people need to be able to recognise them.

The ACN asks employees to take part in training initiatives, to watch out for social engineering and phishing and to report suspicious emails, calls or text messages promptly. It asks managers for something more: measuring the skills acquired, not just delivering courses. ENISA distinguishes between awareness training for everyone, based on real-life situations, and specialist training for those who manage security.

In practice, a simple cycle works for an SME: a short session when each new employee joins, an annual refresher with examples taken from the company's real mailbox, and a reporting procedure that says who to forward a suspicious message to. The typical mistake is a course run once, with the signed attendance sheet in a drawer and no check. To understand how ISO 27001 deals with competence and awareness, see our guide on competence, training and awareness.

Priority 5: suppliers, remote access and cloud

Many SMEs outsource IT, and so risk comes in through suppliers. The technician who connects remotely, the cloud management system, machine maintenance: each one is a door.

The ACN recommends choosing suppliers with adequate security levels and including in contracts requirements proportionate to the criticality of data and services, including incident management clauses. It also asks that contracts specify every type of remote access by suppliers, limited to service needs. ENISA adds that remote access tools should be reviewed regularly, applying updates, MFA and monitoring.

For the cloud, the ACN suggests clarifying what remains your responsibility among the security settings and what falls to the provider. A cloud service is not secure "by definition": if you leave a folder publicly shared, the provider can do nothing about it. The company website should also be considered: ENISA recommends regular security testing, and for exposed web applications a web application penetration test shows where the weaknesses are.

Complaion can help here too: we carry out WAPT (Web Application Penetration Testing) and help you turn the results into tracked actions in your management system.

What should you do when something goes wrong?

Sooner or later an incident happens, and preparation makes the difference. ENISA recommends a formal incident response plan, with documented roles and responsibilities.

The ACN suggests identifying in advance internal roles and supplier and emergency contacts, and running specific exercises during the year. For an SME the plan can fit on two pages: who decides, who calls the IT supplier, who assesses whether personal data is involved, who talks to customers and employees, where the useful numbers are even if the network is down. Keep a printed copy: if ransomware encrypts the file server, a plan saved on the file server is useless.

Remember two channels. CSIRT Italia, the ACN team for incident response, provides a form to report a cyber incident. If the incident involves personal data, assess with whoever handles privacy the obligations towards the Italian Data Protection Authority under the GDPR; if you have no one in-house, you can rely on Complaion's outsourced DPO service. If your company falls within the scope of the NIS2 directive, specific obligations on measures and notification apply. In Italy the ACN has defined baseline measures for NIS2 entities: if you are in scope, this checklist is only a starting point.

The checklist at a glance: measures, evidence and link to ISO 27001

The table summarises the measures in order of priority, with the minimum evidence to keep and the ISO/IEC 27001 control theme they relate to.

How do minimum measures relate to ISO 27001?

Minimum measures are a natural subset of the controls of ISO/IEC 27001. If you apply them well, you have already covered part of the road to certification.

Annex A of ISO/IEC 27001 lists 93 controls, grouped into four themes: organisational, people, physical and technological, as the ISO/IEC JTC 1/SC 27 committee Journal recalls. The standard, however, does not require you to apply them all regardless. It requires you to start from a risk assessment, select the necessary controls and justify inclusions and exclusions in the Statement of Applicability. That is the difference between a checklist and a management system: the checklist tells you what to do, the system makes you decide why, check it and improve it over time. For the full structure of the standard and its controls, see our complete guide to ISO 27001.

This is where Complaion's way of working comes in. A dedicated Lead Auditor follows the company, starts from what you already have (the measures in this checklist, the inventory, supplier contracts) and proposes the route best suited to your needs: consolidating the basics, preparing for ISO 27001 or integrating NIS2 obligations. The platform collects evidence, such as restore test records or training logs, manages documents, keeps the schedule of periodic checks and prepares the audit. That way security does not remain a one-off project but becomes an activity with owners and deadlines.

How Complaion helps you put security in order

Minimum cybersecurity measures do not require large upfront investments, but they do require consistency and method. The real risk is not failing to know what to do: it is doing it once and then no longer checking it.

Complaion supports more than 1,000 clients with a model that combines people and tools. Your Lead Auditor assesses the starting point, sets priorities and, if it makes sense for your company, guides you towards ISO/IEC 27001 certification. The platform keeps documents, evidence and deadlines together, so you always know what has been done, by whom and when. The investment depends on size, number of sites, scope and the standards involved: for an assessment of your situation, contact us and receive a quote.

Frequently asked questions about minimum cybersecurity measures

What are the minimum cybersecurity measures for a small business?

Minimum measures include multi-factor authentication, strong and unshared passwords, limited administrative privileges, separate and tested backups, regular updates, anti-virus, device encryption, staff training, security requirements for suppliers and an incident response plan. These are the points on which the ACN's guidance and ENISA's guide for SMEs converge. Order matters: you start with access and backups.

Are minimum cybersecurity measures mandatory?

It depends on your company. The GDPR requires anyone processing personal data to adopt security measures appropriate to the risk, so some of these measures concern almost every business. Companies within the scope of NIS2 have specific obligations set by the legislation and by the ACN. For the others they remain good practice, but they are often required by customers, insurers and tenders.

Which measure should you start with?

It is best to start with MFA on email and administrative accounts, because it takes little time and blocks many logins with stolen passwords. Right after comes the backup restore test, which often reveals hidden problems. Both measures can be launched without lengthy projects, even with an external IT supplier.

Is anti-virus enough to protect an SME?

No, anti-virus is only one of the measures. It does not protect against stolen passwords, a bank transfer authorised at the request of a fake supplier or a backup that does not work. It works as part of a set that includes protected access, updates, backups and training.

How often should backups be tested?

Official sources speak of regular testing, without setting a single frequency valid for everyone. The frequency depends on how critical the data is and how often systems change. A good rule is to test after every significant change to the infrastructure and in any case at a defined interval, recording date, outcome and time to restore.

If I apply these measures, am I compliant with ISO 27001?

No, minimum measures cover part of the Annex A controls, but ISO/IEC 27001 requires a complete management system. You need a risk assessment, a Statement of Applicability, objectives, internal audit and management review. The measures in this guide are, however, a solid base to start from.

What should I do if my company suffers an attack?

Activate the incident response plan, isolate the affected systems and contact your IT supplier. You can report the incident to CSIRT Italia through the ACN form; if your company falls under NIS2, notification is mandatory and has set deadlines, starting with an early warning within 24 hours. If personal data is involved, immediately assess the notification obligations under the GDPR. Keep the evidence: you will need it for the analysis and for any communications.