Managed IT & Cybersecurity Handbook for SMEs in Belfast, Scotland & Ireland

You don’t have to fix everything overnight. Most small and medium businesses make big progress by tackling a few simple actions in each area, one step at a time.

1. Strong logins and MFA

• Make a list of your critical systems: email (e.g. Microsoft 365), banking, finance, CRM, remote access, file sharing.

• Turn on multi-factor authentication (MFA) for those first. Most cloud services have a “Security” or “Sign-in & MFA” section in settings with simple wizards.

• Stop sharing logins. Give each person their own account, even if that means paying for an extra licence or two.

• Introduce a basic password manager for staff who struggle to remember unique passwords.

2. Keep devices and software up to date

• Set devices to auto-update where possible (Windows Update, macOS, browsers, phones).

• Pick a regular maintenance window (e.g. Friday 6–7pm) where machines can reboot and apply updates.

• Make someone responsible for checking at least once a month that there are no machines stuck on very old versions (your “IT champion” if you don’t have a provider).

• Uninstall software you no longer use – fewer apps means fewer things to keep patched.

3. Managed antivirus / endpoint protection

• Make sure every device (not just office PCs) has current antivirus or endpoint protection – including laptops used at home.

• Check expiry dates and management portals to confirm that all devices are actually checking in and updating.

• Configure regular scans and alerts, not just “on access” protection.

• If you’re using a consumer solution, plan to move to a centrally managed option as you grow, so someone can see at a glance what’s protected and what isn’t.

4. Backups and recovery

• Identify your irreplaceable data: finance, customer records, key project files, anything contractual.

• Ensure this is backed up automatically to a separate location (cloud backup, external device that’s not permanently plugged in, or both).

• Run a test restore at least quarterly: pick a file or folder, delete a copy, and make sure you can recover it from backup without drama.

• Document where your backups live and who knows how to access them in an emergency.

5. Email and web filtering

• Turn on built-in spam and phishing protection in your email system – most platforms have extra filters you can enable that aren’t on by default.

• Block obvious bad stuff at the browser: enable Safe Browsing / security options in Chrome, Edge, etc.

• Create a simple rule for staff: “If an email mentions urgency + money + links/attachments, slow down and double-check.”

• Consider adding an external banner (“This email came from outside the company”) to help staff spot spoofed messages.

6. Basic access control

• List your key systems and decide who actually needs access to each – by role, not by person.

• Remove old or unused accounts for leavers, and schedule a regular (e.g. quarterly) access review.

• Reduce the number of people with admin rights – most staff don’t need them.

• Use groups or permission sets in tools like Microsoft 365 and file servers instead of ad-hoc sharing everywhere.

7. Staff awareness and simple processes

• Run a short 10–15 minute session with your team once a quarter: show examples of phishing emails, talk through a recent scam in the news.

• Set one clear reporting channel (“If you see anything odd, forward it to security@… or tell [Name].”).

• Make a one-page “What to do if…” checklist: clicked a bad link, lost a laptop, suspect a breach – and keep it somewhere visible.

• Praise people for reporting “false alarms” – you want staff to feel safe speaking up, not afraid of embarrassment.

You can absolutely implement many of these on your own or with a tech-savvy staff member. If and when it feels like too much to manage internally, that’s when a managed IT and cybersecurity partner becomes useful: not to replace your thinking, but to keep these basics running reliably in the background while you get on with running the business.