Five backup and security habits every small business needs

The five habits that protect most small businesses are daily off-site backups that you test every quarter, two-factor authentication on email, banking, hosting and social accounts, prompt software updates, a password manager so every password is unique, and staff training to spot phishing emails and fake payment requests.

Most attacks on small businesses are not sophisticated. They target weak passwords, outdated software and staff who click the wrong link. These five habits close most of those gaps and cost little or nothing to set up.

1. Back up daily, with a copy off-site

A backup protects you from ransomware, a failed hard drive, a stolen laptop and a staff member deleting the wrong folder. Follow the 3-2-1 rule: three copies of your data, on two kinds of storage, with one copy away from the office.

1. Website. Most hosts offer daily backups. Check they are kept for at least 30 days and stored apart from the server itself.
2. Files and documents. Google Drive, OneDrive and Dropbox keep version history, so you can restore a file from before it was changed or encrypted.
3. Accounting and customer data. Export a copy every week if your software does not back up automatically.

Test a restore every quarter. Until you have restored from a backup, you do not know that it works.

2. Turn on two-factor authentication

Two-factor authentication asks for a second proof after your password, usually a code from an app on your phone. A stolen password alone then no longer opens the account.

Start with email, because whoever controls your email can reset every other password. Then add banking, your website host and domain registrar, your social media pages and your payment gateway dashboard. Use an authenticator app, such as Google Authenticator or Microsoft Authenticator, instead of SMS codes where you can, because SIM swap fraud can redirect texts.

3. Keep software updated

Old software is how many websites get hacked. On WordPress sites, out-of-date plugins and themes are the most common way in.

1. Turn on automatic updates for phones, laptops and browsers.
2. Update website plugins every week, and delete plugins you no longer use.
3. Replace software that no longer gets security updates, such as old versions of Windows.

4. Use a password manager

Reusing a password means a leak from one site lets attackers into all the others. A password manager, such as Bitwarden or 1Password, creates and remembers a different strong password for every account, so staff only need to remember one. Business plans let you share logins with the team without sending them on WhatsApp, and remove access when someone leaves.

5. Train your team to spot phishing

Many attacks start with a message, not a hack. Common ones in Nigeria include fake bank alerts, emails that copy a supplier and ask for payment to a new account, and messages that pretend to be the boss asking for an urgent transfer.

1. Check the sender's address, not just the display name.
2. Confirm any change of bank details by phone, using a number you already have, not one from the message.
3. Never share one-time codes. Your bank will never ask for an OTP.
4. Make reporting easy. Staff who click a bad link should feel able to say so at once, without blame.

When something goes wrong

Act fast. The first hour matters most.

1. Contain it. Disconnect affected computers from the network, and put a hacked website into maintenance mode.
2. Change passwords for the affected accounts, starting with email, from a device you trust.
3. Restore from a clean backup taken before the problem started.
4. Find and fix the cause, such as an old plugin, a reused password or a phishing email, so it does not happen again.
5. Tell the people affected. If customer data was exposed and people are at risk, Nigeria's Data Protection Act requires you to notify the Nigeria Data Protection Commission within 72 hours. Our guide to NDPR explains what to do.

If you want to know where you stand, our security team runs check-ups for small businesses that cover backups, accounts, your website and staff awareness.