Cyber security for a small Irish business: the six measures, and the proof

FraudSMART, the Irish banks' fraud awareness programme, said on 27 March 2026 that Irish SMEs lost almost €19 million to email-related scams over the previous two years, with average losses of over €22,000 per incident reported by its members. It said the majority of cases were invoice redirection: an email that appears to come from a supplier says their bank details have changed.

That is why this guide starts with email and sign-in. The NCSC's own small-business guide opens with a case of the same kind: an employee asked by email, apparently from her manager, to buy gift cards. What stops invoice redirection goes through the controls in detail.

The National Cyber Security Centre's "Cyber security for small business" recommends six measures as the starting point, and suggests its older 12 Steps to Cyber Security once they are in place. Here they are with what each one looks like done.

The six measures protect your own accounts. They do not stop someone else sending email that shows your address, and that is how a fake invoice in your name reaches your customers. Three DNS records decide it: SPF, DKIM and DMARC. With DMARC set to reject, receiving servers are told to refuse forged mail from your exact domain.

The free email security check reads all three from outside and says whether forged email in your name would be delivered. The set-up steps are in our guides for Microsoft 365 and Google Workspace.

The NCSC says multi-factor authentication defends against the majority of password-related attacks, and it lists the forms it takes: a code by text, an authenticator app, a security key, a fingerprint. Microsoft 365 and Google Workspace both offer it to every user.

Offered is the weak point. An account where two-step sign-in is allowed but never set up, or set up but not enforced, signs in with a password alone. Our guide to two-step sign-in separates the three states and shows where each is set in Microsoft 365 and Google Workspace.

The NCSC draws the line between cloud storage and a cloud backup: a file synced to OneDrive or Google Drive is a copy that changes when the original does, while a backup is a snapshot from a point in time. Its guide says backups should be kept somewhere not directly connected to the business network, so an attacker who reaches your systems cannot delete them too.

A backup nobody has restored is a hope. Backups that count explains the restore test and why the GDPR expects one.

The plan is the part a small business is least likely to have and most likely to need on a Friday evening. If personal data is lost or exposed, the GDPR gives you 72 hours from becoming aware to report it to the Data Protection Commission where it is likely to put people at risk. The GDPR deadline calculator gives the exact time, and the first 72 hours gives the order of work.

If the trouble started with a click, what to do after clicking a phishing link is the first page to open.

Two kinds of letter turn this from good practice into a deadline. A cyber insurer's proposal form asks about two-step sign-in, how backups are protected (an offline copy among the options) and staff training; our guide to the questionnaire goes through Chubb's Irish forms question by question. A larger customer may send a supplier security questionnaire, and NIS2 makes the organisations it covers answerable for the security of their suppliers: what those customers ask.

Where a customer asks for a certificate, the choice is between Cyber Fundamentals, ISO 27001 and Cyber Essentials, and which one fits depends on who is asking.