Module 9: Small Business Cybersecurity

Learning Objectives

Identify common small-business cyber risks.
Improve account, access and email security controls.
Strengthen backup, website and supplier risk practices.
Draft a basic incident and continuity approach.

Why This Matters

Small businesses are frequently targeted because resources are limited and controls may be inconsistent.

Practical baseline controls can significantly improve resilience and customer trust.

Plain-Language Explanation

Small-business security starts with account hygiene, patching, backups, and clear staff process. Separate admin from standard access, apply MFA broadly, keep websites/plugins updated, and verify supplier requests. In NZ contexts, scam reporting and timely incident communication are important parts of response maturity.

NZ context: CERT NZ and NCSC concepts emphasise practical reporting, resilience and improvement after incidents.

Practical Examples

Require MFA for all staff email and cloud services.
Restrict admin privileges to only those who need them.
Maintain regular offline backups and restoration checks.

Common Mistakes

One shared admin account for multiple staff members.
No process for supplier bank-detail changes.
No documented continuity plan for outages.

Security Checklist

MFA is enabled for business-critical accounts. Admin privileges are limited and reviewed. Incident and continuity checklist exists and is accessible.

Module checklist progress0%

Short Knowledge Check

Question 1: Why separate admin and normal user accounts?

To reduce risk of broad compromise during routine tasks or phishing events.

Question 2: What is a key control for invoice fraud?

Independent verification of payment detail changes with a trusted contact process.

Question 3: Why is continuity planning important?

It helps business operations continue or recover faster during disruptions.

Key Takeaways

Small-business cyber resilience is achievable with baseline controls.
Staff process and technical controls must work together.
Reporting and lessons learned strengthen long-term protection.