A UK Small Business Cybersecurity Checklist for the 2025 Tax Year

A UK Small Business Cybersecurity Checklist for the 2025 Tax Year

March is a busy month for any small business. There are payroll runs, VAT returns, accountant queries, and the quiet hope that nothing else lands on your desk before 6 April. That is exactly why cybersecurity tends to slip. It is not urgent until it is, and by then the cost is measured in lost trading days, not just lost files.

This checklist is designed to be worked through in a few short sessions rather than a single marathon. It covers the basics that matter most to UK small firms: backups, phishing, passwords, access, and insurance. None of it requires an enterprise budget. Most of it requires an hour, a decision, and someone to own the task.

Backups: test the restore, not just the backup

A backup that has never been restored is a hope, not a plan. Before the tax year turns, pick one critical system — your accounts package, your customer database, your shared drive — and restore a file or folder from backup. If you cannot do it without help, that is the gap to fix.

Aim for three copies of important data: one on-site for quick recovery, one off-site or in the cloud, and one that is offline or immutable so ransomware cannot encrypt it. Check that backups run when they should and that someone receives failure alerts. If your backup tool sends a weekly email, make sure it goes to a person who reads it, not a shared inbox nobody opens.

For a UK small firm, the accounts package often sits with the accountant, payroll might be cloud-based, and customer records might live in a CRM. Decide which systems would stop you trading if they vanished for a week. Those are your priority backups. If you use a cloud service, do not assume the provider backs up everything you need. Microsoft 365 and Google Workspace have retention and recovery features, but they are not a full backup of every file, mailbox, or configuration. Check what is covered and fill the gap. For local machines, use an encrypted external drive and rotate it off-site. For cloud data, consider a third-party backup tool that keeps a separate copy. Label your backup drives, store them somewhere dry and secure, and never leave the only copy in the office over a bank holiday weekend.

If the restore test takes longer than your business can survive without the system, the backup plan is not finished.

Write down the restore process. Include who to call if the primary contact is on holiday. Test again next quarter. Backups are not a one-off tax-year chore; they are a habit.

Phishing training: little and often beats a long annual session

Phishing remains one of the most common ways small businesses are breached, and it rarely arrives as an obvious spelling mistake. It comes as a supplier invoice with new bank details, a delivery notification, a payroll query, or a message from a colleague asking for a quick favour. Train people to pause, check, and report.

Short monthly reminders work better than a two-hour annual workshop. Use real examples — stripped of blame — from emails your team has received. Run occasional simulated tests, but keep the tone supportive. The goal is a culture where someone can say "I think I clicked something" within minutes, not hours.

• Unexpected urgency, threats, or secrecy: treat as a warning sign.
• Changed bank details: verify by phone using a number you already have, not one in the email.
• Mismatched sender domains or reply-to addresses: check the full email address, not just the display name.
• Unexpected attachments, especially invoices, remittances, or "secure message" links.
• Requests to bypass normal process, such as paying a new supplier without a purchase order.
• HMRC, Companies House, or bank messages that ask you to click a link and enter credentials. Go to the official website yourself, never through the link.

Make reporting easy. A dedicated mailbox or a message in your team chat is enough. When someone reports a suspicious email, thank them and close the loop: tell them what you found. If a click happens, focus on speed. Disconnect the device from Wi-Fi, change the password if credentials were entered, and call your IT contact. Minutes matter. A small business that reports a suspicious payment to its bank quickly has a much better chance of recovering funds than one that discovers it at month-end. Also consider payment approval workflows: two people to authorise new bank details, a call-back to a known number, and a rule that no one changes supplier bank details by email alone.

Passwords, MFA and access: the keys to the building

Passwords are still the front door, but they should not be the only lock. Use a password manager to create and store unique passwords for every account. That removes the temptation to reuse the same password across email, banking, and your CRM. If one site is breached, the others stay safe. For any account that matters — email, banking, payroll, cloud storage, accounting software, domain registrar — turn on multi-factor authentication (MFA). An authenticator app or a hardware key is stronger than SMS codes, but SMS is still better than nothing. Do not let anyone share MFA codes over chat or email.

Review who has access to what. In a small business, it is common for everyone to be an administrator because it is quicker. That is also how a single compromised laptop becomes a company-wide problem. Give people the access they need to do their job and no more. Keep a list of admin accounts: who has them, why, and when they were last reviewed. If you use a shared mailbox or a generic login, change the password when someone leaves and avoid using it for banking or payroll.

Joiner, mover, leaver

Access control is not only about technology. It is about people. When someone joins, create their account with the right permissions from day one. When they change role, remove old access before adding new. When they leave, disable their account, forward their email to a manager for a short period if needed, collect devices, and remove them from password managers and shared drives. Do this on the last working day, not the following week. If you use contractors, give them time-limited accounts and review them monthly. A departing employee with a live email account and access to the accounts package is a risk that costs nothing to close.

1. List every system that holds customer, supplier, or payroll data.
2. Mark who has admin rights and remove unnecessary ones.
3. Turn on MFA for email, banking, and accounting first.
4. Set a calendar reminder to review access each quarter.

Cyber insurance and a one-page incident plan

Insurance will not stop an attack, but it can pay for the recovery. Read your policy before you need it. Check what is covered: ransomware, business interruption, data restoration, legal costs, notification costs, and crisis communications. Check the excess, the limits, and the conditions. Many policies require you to have backups, MFA, and a documented incident response plan. If you do not meet those conditions, a claim may be reduced or refused. Keep your policy number and insurer's incident hotline somewhere you can find it without a computer — a printed one-page plan in the office safe or a manager's folder.

A one-page incident plan should answer a few questions. Who do you call first? Who speaks to customers and the press? Who contacts the bank? Who reports to the Information Commissioner's Office (ICO) if personal data is breached? Under UK GDPR, certain breaches must be reported to the ICO within 72 hours of becoming aware of them. That clock starts when you have a reasonable degree of certainty that a breach has occurred, not when you finish the investigation. Have a template ready for customers and suppliers. Decide in advance whether you will pay a ransom — most advisers say no, and paying can be illegal if it funds sanctions. The plan does not need to be long; it needs to be known.

Also consider Cyber Essentials. It is a UK government-backed scheme that helps small firms put basic controls in place, and certification can be useful when bidding for public sector work or reassuring larger customers. You do not need to certify to benefit from the checklist, but it gives you a structured target. If you handle card payments, check your obligations under PCI DSS. If you store personal data, make sure your privacy notices and retention rules are still accurate. Cybersecurity and data protection overlap, but they are not the same thing. Good security makes compliance easier.

Put it in the diary before 6 April

None of this matters if it stays in a document. Give each item an owner and a date. Book a two-hour session this month for backups and access. Book a 20-minute slot next month for phishing reminders. Put a quarterly restore test in the calendar. Ask your accountant or IT provider what they need from you before the tax year turns. If you use an outsourced IT company, confirm what they monitor, what they back up, and what they will do if ransomware hits. Get it in writing.

Finally, keep the checklist short enough to use. A small business does not need a 40-page security policy. It needs a handful of habits that survive a busy March: tested backups, sceptical staff, strong passwords, MFA, tight access, and a plan for the worst. Do those things, and you can get back to the payroll runs and VAT returns with a little less to worry about.

Photo: judyback / Pixabay