Information Security: A Practical Guide to Your Business Resilience

Most small and medium businesses do not fall to sophisticated attacks but to ordinary things: a reused password, a phishing email opened in a hurry, a system left unpatched, or a backup nobody knew had stopped working. The good news is that those same ordinary things can be fixed without big investment — through a structured, disciplined approach.

This article is a practical, checklist-style guide. If you first want the conceptual picture — what information security actually is and where to start — we cover that separately in information security: what it is and where to start. Here we go straight to the measures that build your business resilience.

The CIA triad: what you are actually protecting

Before any tool, it helps to know what you are defending. Information security comes down to three properties, known as the CIA triad:

• Confidentiality — information reaches only those entitled to see it. A publicly exposed customer database breaches this property.
• Integrity — information stays accurate and unaltered. A fraudulently changed invoice or a corrupted file are integrity problems.
• Availability — information is accessible when you need it. A ransomware attack that locks your files hits availability directly.

Every security measure ultimately serves one or more of these three properties. When you assess a risk, the useful question is: "what would happen if this information were seen by the wrong people, were modified, or became unavailable?" The answer shows you where to invest first.

The basic measures that actually move the needle

Not all security measures have the same effort-to-effect ratio. For an SME, the following few reduce risk the most, at the lowest cost:

• Access control and MFA. Apply the least-privilege principle — everyone has access only to what their task requires — and enable two-step authentication (MFA) on email, admin accounts and critical applications. MFA is one of the cheapest and most effective barriers against unauthorised access, even when a password has been compromised.
• Updates and patching. Known vulnerabilities are exploited quickly, often within days. Keeping operating systems, applications and network equipment up to date closes the doors attackers look for first.
• Backups with tested restore. A backup that has never been restored is an assumption, not a guarantee. Make regular backups, keep at least one isolated copy (offline or immutable), and test the restore periodically. This is your safety net against ransomware.
• Phishing awareness. Human error remains the leading cause of incidents. Regular training on real examples turns the team from a weak point into a first line of defence.
• Incident response plan. Write down, before the crisis, who does what if an incident occurs: who decides, who you notify, how you isolate the problem and in what order you restore services. A rehearsed plan dramatically shortens reaction time.
• Supplier risk. Your data often passes through cloud, accounting or IT service providers. Check what security measures they have and what happens to your data if they are compromised.

Notice that most of these measures are about process and discipline, not expensive technology. That is the good news for an SME.

Security is not just IT

One of the most costly misunderstandings is to treat security as a purely technical problem left to IT. In reality, information security covers three dimensions: people, processes and technology. A flawlessly configured firewall does not help if an employee emails a password to an attacker posing as the company director.

The human dimension is often the most vulnerable and, at the same time, the cheapest to strengthen. This is where training, clear onboarding and offboarding procedures, and a culture in which reporting a mistake is encouraged rather than punished all come in — because an incident reported quickly does far less damage than one that is hidden. We wrote at length about the people side in our article on human resource security in ISO 27001.

The link to GDPR (Art. 32) and ISO 27001

Information security is not just good practice but also a legal obligation. Art. 32 GDPR requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk — and it explicitly mentions the confidentiality, integrity, availability and resilience of systems, as well as the ability to restore access to data after an incident. In other words, the GDPR requires exactly the resilience we are discussing here.

The key word is "appropriate": the law does not impose a fixed list of tools, but measures proportionate to the risk. A small business does not need the same infrastructure as a bank; it needs to show that it assessed the risks and took reasonable measures against them.

This is where ISO/IEC 27001 comes in, the international standard for an information security management system (ISMS). It does not tell you which button to press; it gives you a framework: you identify risks, choose proportionate measures, document them, apply them and review them regularly. In effect, it turns security from a set of isolated actions into a continuous, demonstrable process — exactly what you need to show a partner or the authority that your measures really are "appropriate".

Resilience = prevention + detection + recovery

Many people reduce security to prevention: ever higher walls so no one gets in. But no wall is perfect, and real resilience rests on three legs:

• Prevention — you reduce the likelihood of an incident: MFA, patching, access control, training. Rightly, most of the effort goes here.
• Detection — you assume that, even so, something will get through. You want to find out fast: logs kept and reviewed, alerts on suspicious activity, a clear channel through which employees can report something odd.
• Recovery — once the incident has happened, you recover with minimal loss: tested backups, a rehearsed incident plan, clear roles. The difference between a business that bounces back in hours and one stuck for days almost always lies here.

An honest check of the three pillars usually shows where you are out of balance. Many organisations invest heavily in prevention and almost nothing in detection and recovery — then are surprised at how hard they recover from an incident they "should have prevented".

Where to start, concretely

If you were to do just one thing this week, enable MFA everywhere you can and check whether your last backup actually restores. Then work through the list above, one item at a time, and note where you are and are not covered. You don't have to do everything at once; you have to do it in order of risk.

An audit or risk assessment carried out by an external partner shortens this path considerably: it spots the weak points before they become breaches and gives you a priority order proportionate to your real risk, not to a generic model. For what such a check looks like, see our audits and testing page.

Frequently asked questions