Most small business owners know they should be taking digital security seriously. Far fewer have done anything structured about it. The standard advice — hire a specialist, commission a penetration test, bring in a consultancy — comes with price tags that most SMEs simply cannot justify. But the alternative is not burying your head. A cyber security audit for your UK small business does not require a third party billing you £1,500 a day. What it requires is a clear framework, honest self-assessment, and a few hours of focused attention.
The good news is that the UK government has already done much of the structural thinking for you. The Cyber Essentials scheme, developed by the National Cyber Security Centre, is specifically designed to address the most common attack vectors facing small and medium-sized businesses. It covers five core control areas. Work through those five areas honestly and you will have a credible picture of your current exposure.
Start With the Five Cyber Essentials Controls
Cyber Essentials is not a certification you have to buy. The self-assessment questionnaire is freely available and walking through it as a diagnostic exercise costs nothing. The five control areas are: firewalls, secure configuration, user access control, malware protection, and patch management. Each one maps directly to how attackers actually get into small business systems.
Go through each control and ask yourself a brutally honest question: do we actually do this, or do we just assume it happens? Many business owners are surprised to find that their hosted systems are reasonably well-configured, but their endpoint devices (laptops, mobile phones, tablets) are not. That gap is where most breaches start.
Email Security: The Most Overlooked Attack Surface
Business email compromise and phishing remain the most common entry points for attackers targeting UK SMEs. According to the NCSC’s annual Cyber Security Breaches Survey, phishing accounted for the majority of reported attacks in the most recent period. Yet many small businesses have done nothing beyond setting up a standard Microsoft 365 or Google Workspace account and trusting default settings.
Check whether your domain has SPF, DKIM, and DMARC records configured. These are DNS-level controls that prevent your domain being spoofed by attackers impersonating your business in emails. Free tools such as MXToolbox will check all three in under a minute. If any are missing or misconfigured, your domain can be used to send convincing phishing emails to your customers and suppliers. That is a reputational and operational problem, not just a technical one.
Also review who has admin access to your email platform. Business email accounts accumulate permissions over time. Former employees, old integrations, and forgotten third-party apps often retain access long after they should have been removed. A proper cyber security audit for your UK small business will surface these quickly.
Access Controls: Who Can Do What, and Why
The principle of least privilege sounds technical but it is simply this: every person and every system should have access to only what they need to do their job. Nothing more. In practice, most small businesses have grown organically and access permissions have accumulated messily. One way to audit this quickly is to pick your three most critical business systems and list everyone who has admin or elevated access. If you cannot explain why each person has that level of access, that is your first finding.
Multi-factor authentication (MFA) should be mandatory for every account with any form of admin access, and ideally for all staff accounts. If you are using Microsoft 365, Xero, or any cloud-based platform without MFA switched on, you are one stolen password away from a serious incident. Enabling MFA on major platforms typically takes less than 30 minutes and costs nothing.
Software Patching: The Low-Drama Discipline That Most Businesses Skip
Unpatched software is one of the most reliable routes into a business network. Attackers routinely scan for known vulnerabilities in outdated software versions. The time between a vulnerability being published and it being actively exploited has shortened considerably in recent years.
For your audit, check three things. First, are operating systems on all business devices set to update automatically? Second, are applications (especially browsers, Office suites, and any customer-facing software) on a regular update schedule? Third, is any hardware on your network — routers, network-attached storage, CCTV systems — running firmware that has not been updated since it was installed? That last category catches many businesses out. A router with three-year-old firmware sitting in the corner of an office is a credible attack vector.
Supplier and Third-Party Risk
Your security posture is only as strong as the weakest link in your supply chain. This sounds abstract until you consider that your accountant, your web developer, your payroll provider, and your IT support company all have some form of access to your systems or data. A breach at any one of them can become your problem.
A pragmatic approach for SMEs is to create a short list of suppliers who have access to your systems or sensitive data, and ask each of them a simple set of questions. Do they hold Cyber Essentials certification? How do they manage and store your data? What would they do in the event of a breach? You do not need to commission formal supplier audits at this stage. You simply need to know which suppliers represent a meaningful risk and whether they have thought about it themselves.
Documenting What You Find
An audit that lives only in your head is not an audit. Write down your findings, even in a simple spreadsheet. For each issue you identify, note the control area, the specific gap, the likely impact if it were exploited, and a rough priority for fixing it. This document serves two purposes. It gives you a to-do list with context, and it demonstrates due diligence if you ever need to respond to an incident, a client’s security questionnaire, or an ICO data breach enquiry.
The ICO expects UK businesses handling personal data to be able to demonstrate reasonable technical and organisational measures under UK GDPR. A documented self-assessment, even an imperfect one, is significantly better than nothing.
What to Do With Your Findings
Prioritise by impact and ease of resolution. Enable MFA across all platforms this week. Fix DMARC this month. Address access permissions at your next team meeting. Defer the more complex infrastructure questions until you have capacity. The goal of this exercise is not perfection; it is a clear-eyed view of where you actually stand and a plan to improve it systematically.
For businesses that want external validation without paying consultant day rates, the Cyber Essentials self-assessment certification costs around £300 to £400 for most small businesses, depending on the certification body. That is a different proposition from a full consultancy engagement, and it produces a recognised credential that some contracts and government procurement frameworks require.
Security is not a project you finish. It is a discipline you maintain. Running a basic internal review every six months, keeping a short list of known gaps, and treating each new tool or supplier as a potential risk to assess — that is the operating rhythm of a business that takes this seriously, without needing a specialist on retainer to prove it.