An SME’s cybersecurity is not decided by the number of tools installed. It comes down to a handful of simple decisions, made in the right order, and kept up over time. This article gives you that list.
Ten measures, ranked from the best effort-to-protection ratio to the least urgent. You do not need to apply all of them this week. You need to start with the first one.
Why this order, and not another?
The attacks that hit Swiss SMEs are almost never custom-made operations. They are automated campaigns that sweep through thousands of companies and stop on the ones with a known weakness: a reused password, software that was never updated, an attachment opened too quickly.
So you do not have to defend yourself against a determined adversary. You have to stop being the easiest target in the batch.
In 2025, the National Cyber Security Centre received 64,733 voluntary reports of cyber incidents, compared with 62,954 the year before. At the same time, only 42% of Swiss SMEs consider their protection sufficient, compared with 55% a year earlier. This growing awareness is good news, provided it turns into action. The detail behind these figures, and what should or should not be concluded from them, is covered in our overview of cybercrime in Switzerland in figures.
The ranking below rests on three criteria: the severity of what the measure prevents, the frequency of the attack concerned, and the real effort it demands from a company of a few people. It follows the logic of the ICT minimum standards published by the Confederation and of the guides aimed at micro and small businesses.
| # | Measure | Set-up | Maintenance | What it blocks | Impact |
|---|---|---|---|---|---|
| 1 | Backup with an offline copy, tested restoration | High | Medium | Ransomware, outage, deletion | Decisive |
| 2 | Two-factor authentication (email, banking, admin) | Low | None | Password theft, mailbox takeover | Decisive |
| 3 | Automatic updates everywhere | Low | Low | Exploitation of known vulnerabilities | High |
| 4 | Unique passwords via a password manager | Medium | Low | Reuse, cascading breaches | High |
| 5 | Access removal when an employee leaves | Low | Low | Residual access, insider misuse | High |
| 6 | Accounts without administrator rights day to day | Medium | None | Spread of malicious software | High |
| 7 | Email protection (filtering, SPF, DKIM, DMARC) | Medium | Low | Phishing, spoofing of your domain | High |
| 8 | Annual awareness session for the whole team | Medium | Medium | CEO fraud, risky clicks | Medium to high |
| 9 | Written procedure for an attack, printed out | Low | Low | Wasted time and mistakes on the day | Medium |
| 10 | Inventory of personal data and hosting providers | Medium | Low | Non-compliance, blind spots | Medium |
1. Back up, with an offline copy and a tested restoration
What it is. Copies of your data kept elsewhere, including at least one that nothing on your network can reach, and that you have verified actually restores.
Why it matters. This is the measure that turns a catastrophe into a bad week. Faced with ransomware, it is the one that gives you the right to refuse to pay. In the second half of 2025, 57 ransomware-related incidents were reported to the NCSC, and these figures only count the cases that were reported.
The real effort. This is the most demanding measure on the list: a few hours of set-up, a subscription or dedicated hardware, and regular verification. It is also the only one whose absence cannot be made up for afterward.
The first step. This month, restore a random file from your backup and check that it opens. Then read the 3-2-1 backup rule to fill in whatever is missing.
The external drive permanently plugged into the server will be encrypted along with everything else. And the backup that has been silently failing for months is discovered on the morning of the attack. A disconnected copy and an annual restoration test are worth every security product on the market.
2. Turn on two-factor authentication for critical accounts
What it is. In addition to the password, a second proof of identity: a code generated by an app on your phone, or a physical security key.
Why it matters. A password always ends up circulating, whether through a provider breach or through phishing. Two-factor authentication makes that stolen password useless on its own. It is the measure with the best ratio between five minutes of configuration and the risk removed.
The real effort. A few minutes per account, generally at no extra cost. The day-to-day inconvenience is low: most services only ask for the second factor on an unrecognized device.
The first step. Today, turn it on for management’s and accounting’s mailboxes, then for e-banking and administrator accounts. The rest will follow. More detail is available in our dedicated article on two-factor authentication.
3. Let updates happen automatically
What it is. The automatic installation of security patches on computers, phones and business software, but also on the router, the server, the NAS and connected devices.
Why it matters. Automated campaigns exploit publicly documented vulnerabilities, often patched months earlier. A company that stays up to date is simply not affected by most of that background noise.
The real effort. Low: it is a checkbox on workstations. The real difficulty lies elsewhere, in the equipment nobody monitors: the internet provider’s router, the network printer, the surveillance camera.
The first step. List everything connected to your network, including whatever is not a computer, and check the date of the last update for each item. The topic is covered in detail in updates.
4. One unique password per service, in a manager
What it is. Software that remembers and fills in passwords for you. You only need to remember one, the one for the manager itself.
Why it matters. The real danger is not a weak password, it is a reused one. When a third-party site is breached, the stolen credentials are automatically tested against hundreds of other services. A unique password per service confines the leak to a single account.
The real effort. Medium, because it involves a change of habit. Allow one to two hours to install the tool and migrate your important accounts, followed by a net time saving day to day.
The first step. Test the strength of your current passwords with our password test, and check with the email check whether your addresses appear in known breaches. Then migrate email and banking first. See passwords.
5. Remove access when an employee leaves
What it is. A systematic step in your departure process: disabling accounts, recovering equipment, changing shared passwords, removing remote access rights.
Why it matters. This is the most common blind spot in small organizations. Accounts remain active for months, sometimes years, after someone leaves. They make an ideal entry point for anyone who gets hold of those credentials.
The real effort. Very low once the list exists: fifteen minutes per departure. The effort lies in creating the initial list of access rights.
The first step. Write down today the list of access rights granted to a typical employee, and check that people who left last year no longer appear on it. See access management. The same list, read in reverse, is useful the day someone joins: that is the subject of our article on onboarding a new employee.
Measures 5, 6 and 9 cost nothing beyond a document kept up to date. A simple access table, reviewed twice a year, resolves a good share of account-related risks on its own. Start with what you write down, before buying what you install.
6. Work with an account that has no administrator rights
What it is. Everyone uses a standard account day to day. Administrator rights are reserved for a separate account, used only to install or configure things.
Why it matters. Malicious software inherits the rights of whoever runs it. Opened from a standard account, it stays confined. Opened from an administrator account, it can install itself permanently, disable protections and spread across the network.
The real effort. Medium at set-up, none afterward. You need to create the accounts and accept a few password prompts during installations.
The first step. Check whether the account you use every day is an administrator account. If so, create yourself a standard account and keep the other one for technical operations.
7. Protect email, technically
What it is. Two distinct things: serious anti-phishing filtering on the way in, and configuring SPF, DKIM and DMARC records on your domain name, on the way out.
Why it matters. Email is the dominant entry point. Filtering reduces what reaches inboxes. SPF, DKIM and DMARC prevent third parties from sending messages that appear to come from your company, which is the mechanism behind CEO fraud and fake transfer orders sent to your customers.
The real effort. Filtering is often already included in your business email offering and mostly needs to be switched on and configured. The SPF, DKIM and DMARC part requires technical work at your hosting provider, usually a few hours for a service provider.
The first step. Ask your provider whether your domain has all three records, and get the answer confirmed in writing. See email security.
8. Raise the whole team’s awareness once a year
What it is. A short, annual session that shows real examples of fraudulent messages and clearly states who to report doubts to.
Why it matters. No filter blocks everything, and the most dangerous messages are the ones with no attachment and no spelling mistakes. Management must take part: it is the prime target of transfer fraud, and its absence would send the opposite message from the one intended.
The real effort. One hour per year per person, plus preparation. The national S-U-P-E-R campaign, run by the Confederation and its partners, provides free, memorable material: Save, Update, Protect with antivirus software, E-mails handled with caution, Reduce risk with strong passwords.
The first step. Set a date in the company calendar and announce that reporting a doubt will never be held against anyone. See why raise awareness. If you want to go further than a single session, our article on the annual awareness programme offers a ready-to-use calendar of short sequences.
In most preventable incidents, someone had a doubt but said nothing, afraid of looking naive. The time between the click and the report determines the extent of the damage. Tell your team explicitly that an unnecessary report is always better than silence.
9. Write the procedure to follow in the event of an attack
What it is. One printed page stating who to call, in what order, with which numbers, and the first three actions to take.
Why it matters. On the day of the incident, email may be inaccessible and files may be encrypted. Decisions then get made under pressure, and bad ones get made within minutes: shutting down a server destroys evidence, paying a ransom in a panic guarantees nothing.
The real effort. One hour to write it, one review per year. This is the cheapest measure on the list.
The first step. Write the page and print three copies, including one kept off-site. Note down your IT provider’s number, your insurer’s number and the reporting link to the NCSC. See the first hours after an attack, and the full framework in the incident response plan.
10. Inventory your personal data and its hosting providers
What it is. A list of the categories of personal data you process (customers, employees, candidates), where it is located, and who has access to it.
Why it matters. You cannot protect what you do not know about. This inventory brings forgotten copies and foreign service providers nobody remembers back into view. It is also the basis of your data protection obligations, and the document you will be asked for in the event of an incident.
The real effort. Half a day for a small organization, more if you use many online services. To be reviewed once a year.
The first step. List the software and services where customer or employee data is stored, along with the hosting country. The framework is explained in your FADP obligations. For an assessment tailored to your business, seek the help of a professional.
Where to start depending on your size?
The order above applies to every company, but the realistic pace does not depend only on budget: it depends on headcount. The three paths below are developed sequence by sequence in our action plan by company size.
From 1 to 9 people. Your advantage is simplicity, your constraint is time. Handle measures 2, 3 and 4 this month: they require no service provider. Then tackle measure 1, even if you need to outsource it. Measures 9 and 5 each fit on a single page. You can reach a solid level within a quarter, without a significant budget.
From 10 to 49 people. Organizational measures become a priority, because access multiplies faster than oversight. Handle measures 5, 6 and 7 alongside the first three. Appoint a person responsible for the topic, even on a very part-time basis, and give them an identified annual budget. Without a named owner, these measures fade away.
50 people and above. The ten measures are your foundation, not your programme. Formalize things: a written policy, an annual access review, a crisis exercise, and security requirements toward your suppliers, who become an entry point in their own right. Your customers and insurers will start asking you for evidence.
What can you do this week?
Do not try to tackle all ten points at once. This week, do three things: turn on two-factor authentication for email and banking, restore a file from your backup to check that it works, and write the “who to call in case of a problem” page.
These three actions add up to less than half a day and already cover the most destructive scenarios. The rest can be spread over the year, at a rate of one measure per month.
To find out where you stand, the cyber check-up turns these ten measures into a short questionnaire and gives you an overview in a few minutes. The detailed articles for each measure are grouped in the Best practices pillar.