Small & medium organisations

Build cyber resilience without a large security team

A practical baseline for SMMEs, NGOs, medical practices, schools, estate agencies, churches and local suppliers working with customer and employee information.

First actions

A small-team baseline

Choose controls that survive staff turnover, remote work and power interruptions.

Protect admin accounts

Turn on MFA for email, accounting, payroll, website admin, cloud storage and social media.

Separate payment approval

Confirm bank detail changes by voice using a known number, not a number from the email thread.

Make backups recoverable

Keep at least one backup disconnected or immutable, and test restore after load shedding or device failure.

Know your POPIA exposure

Map personal information you hold, who can access it and how you will notify people if it is compromised.

Sample guidance

Controls with high return

Email

Stop business email compromise

Use MFA, disable automatic forwarding where possible and set a clear process for supplier bank detail changes.

Continuity

Plan around unstable power

Protect routers and storage with UPS units, document shutdown steps and avoid backups that only run when power is stable.

Cloud

Secure shared drives

Use named accounts, limit public links, review external shares and remove access when staff or contractors leave.

People

Run short scam drills

Brief staff on fake tenders, courier scams, SARS messages, payroll changes and urgent payment pressure.

Checklist

Quarterly business review

  • Confirm MFA is active on every admin and finance account.
  • Test one restore from backup and record who completed it.
  • Review supplier, contractor and former employee access.
  • Verify your incident contact list and cyber insurance conditions.
  • Update your POPIA breach response note and evidence folder process.

Resources

Small-business forms and worksheets

Web form

Cyber incident intake and triage

Summarise the incident, preserve evidence and route fraud, data exposure or technical compromise.

 Web form

POPIA security compromise assessment

Track affected data, notification duties, accountable owners and deadlines after a suspected breach.

 Excel checklist

SMME quarterly cyber review

Record MFA, restore testing, access reviews, incident contacts, insurance and POPIA response status.

 Form + checklist

Business email compromise control

Capture bank-detail verification, approver trails, suspicious indicators and finance action items.

 Excel checklist

Backup and load-shedding resilience

Review backup coverage, restore tests, UPS gaps, unprotected systems and remediation owners.

 Excel register

Cloud shared-drive and SaaS access review

Find public links, external shares, leaver access, orphaned accounts and missing logging or encryption.

 Excel + supplier form

Supplier security questionnaire

Ask critical suppliers about MFA, backups, incident contacts, payment changes and data handling.