In this guide · 8 sections
Short answer
Start with MFA on email and admin accounts, automatic updates, tested backups, endpoint protection, SPF/DKIM/DMARC on your domain and basic staff training. Then run CSA's free ten-minute health check and work toward the Cyber Essentials mark.
Why small businesses are a target
Attackers do not need to pick you out. Most attacks on small firms are automated: password lists tried against every Microsoft 365 login, phishing emails sent to thousands of addresses, scans for unpatched websites and routers. A small business with no IT staff is simply easier to get into.
CSA's Singapore Cyber Landscape 2025/2026, published on 30 June 2026, reported 165 ransomware cases in 2025 and said SMEs were the most affected. It also noted a sharp rise in infected systems, driven partly by devices with unpatched firmware or default passwords. Our summary of the report for SMEs maps each trend to a control.
The six controls that matter most for SMEs
These six controls block the attacks small firms actually suffer. They also line up with the requirements of CSA's Cyber Essentials mark, so the work counts twice.
| Control | What it stops | Typical cost |
|---|---|---|
| MFA on email, admin and banking | Account takeover with stolen passwords | Free in Microsoft 365 and Google Workspace |
| Automatic updates on PCs, phones, website, router | Attacks on known flaws | Free; replace unsupported devices |
| Backups kept separate and tested | Ransomware and accidental deletion | Backup service or storage subscription |
| Endpoint protection on every device | Malware and ransomware on laptops | Built-in or paid per device |
| SPF, DKIM and DMARC on your domain | Others sending email as you | Free DNS settings |
| Staff phishing and payment-fraud training | Fake invoices, fake bosses, credential theft | Free CSA toolkits or paid course |
If you only do one thing this week, turn on MFA for every mailbox and admin account. Our MFA set-up guide walks through Microsoft 365 and Google Workspace. Where your platform supports them, passkeys go one step further because they resist phishing.
Your first 30 days: a step-by-step plan
This order front-loads the free, high-impact changes and leaves the paid items for when you know what you need.
Week 1: list your accounts and devices
Write down every laptop, phone, server and online account the business uses, who owns it and who has admin rights. This is also the Assets area of Cyber Essentials.
Week 1: enforce MFA and remove ex-staff
Turn on MFA for all users, starting with admins, finance and the owner. Delete or block accounts of people who have left.
Week 2: switch on updates and retire old kit
Turn on automatic updates for Windows, macOS, phones, browsers and your website. Plan to replace anything that no longer gets security updates.
Week 2: check backups actually restore
Back up email, shared files and accounting data to a copy attackers cannot delete. Restore one file to prove it works.
Week 3: protect devices and the domain
Make sure every PC has endpoint protection running, and publish SPF, DKIM and DMARC records for your email domain.
Week 4: brief staff and write a one-page plan
Show staff how to spot fake invoices and login pages, and agree who to call and what to do if something goes wrong.
Free CSA tools to use before you spend money
CSA publishes several free resources under its SG Cyber Safe Programme.
- Cybersecurity Health Check tool: a ten-minute questionnaire based on Cyber Essentials that produces a plain-language report and recommendations. See CSA's health check page.
- Cybersecurity toolkits: separate packs for business owners, employees and whoever handles IT, with templates and guiding questions.
- Cyber Essentials self-assessment template: the same spreadsheet assessors use, free to download and work through on your own.
- Cyber Essentials in Action: a tabletop card game to rehearse your response to an incident with your team.
The health check is the best first step if you are unsure where you stand. It turns a vague worry into a short list of gaps.
When to go for Cyber Essentials certification
The Cyber Essentials mark is CSA's baseline certification for organisations. It covers five areas: Assets, Secure/Protect, Update, Backup and Respond. A CSA-appointed certification body reviews and verifies your self-assessment, and the mark is valid for two years.
Certification is worth it if you
- Bid for government or corporate tenders that ask for it
- Handle health, financial or large volumes of customer data
- Want proof for clients, insurers or overseas partners
You can wait if you
- Have not done the six basic controls yet
- Are a sole proprietor with no customer data at risk
- Have no client or tender asking for it this year
Our Cyber Essentials checklist explains each requirement and the self-assessment. The funding guide for after PSG lists the CSA fee support, CISO-as-a-Service co-funding and EDGE support still available.
How much to budget
Budgets vary with headcount, but the shape is predictable: the first month is mostly settings and time, then a small monthly cost per user for protection, backup and someone to keep it all current.
Our cybersecurity budget guide breaks down typical tool and service costs per user, so this page does not repeat them.
Do it yourself or get help?
An owner who is comfortable in the Microsoft 365 or Google admin console can do most of the first month alone. Help pays off when nobody owns IT, when you need evidence for a tender, or when you want the controls kept up each month instead of drifting.
Basic cybersecurity checklist for SMEs
Our Security Health Check (S$290) gives you a written, risk-ranked fix list for your domain, email and Microsoft 365 or Google Workspace. Protect Standard (S$19 per user a month) keeps endpoint protection, encryption, password manager and staff lessons current, and the CSA Cyber Essentials Readiness package (from S$990) prepares you for certification.
Frequently asked questions
Turn on multi-factor authentication for every email and admin account. Account takeovers usually start with a stolen or reused password, and MFA means a password alone is no longer enough to get in. It is free in Microsoft 365 and Google Workspace and takes an afternoon for a small team. Then remove accounts belonging to people who have left.
Yes. CSA's Cybersecurity Health Check tool is a free questionnaire of about ten minutes, based on the Cyber Essentials requirements. It produces a plain-language report on your organisation's cyber hygiene and recommendations for what to improve. CSA also publishes free toolkits for business owners, employees and IT staff.
No. Cyber Essentials is voluntary. It is useful when clients, tenders or insurers ask for evidence of basic security, or when you handle sensitive customer data. Do the six basic controls first, then decide. CSA offers fee support for an organisation's first certification until 6 February 2028.
No. Antivirus or endpoint protection only covers devices. Most attacks on small businesses go through email accounts, stolen passwords and fake payment requests, which antivirus does not stop. Combine it with MFA, updates, separate backups, email authentication on your domain and staff training to cover the common attack routes.
The six basic controls can be in place within about a month for a business of 5 to 30 people, if someone owns the work. Certification takes longer because you need documented evidence and an assessment by a certification body. Security is never finished, so plan a short monthly check afterwards.