The 'Not Today' Security Sprint: A 25-Minute Cyber Reset for UK One-Person Businesses

You do not need a security policy with a cover page. You need a few boring switches flipped before your coffee goes cold.

If you run a one-person business in the UK, you are the IT department, the data protection officer and the person who remembers the bank password. That is a lot of hats. The good news is that most small-business cyber attacks are not clever. They are opportunistic. Someone guesses a reused password, a phishing email gets a click, a laptop goes missing, or a file gets encrypted by ransomware. The fix is not an enterprise toolkit. It is a minimum viable defence: two-factor authentication on the accounts that matter, a password manager so you stop reusing the same login, and one offline backup that is not permanently connected to your computer.

Here is a 25-minute sprint you can do this week. No jargon, no consultant, no new monthly subscription unless you want one.

Why a one-person business needs a cyber baseline

Sole traders often assume they are too small to be targeted. In reality, size is not the issue. Opportunity is. If your email account is taken over, an attacker can reset passwords for other services, send invoices from your address, or read client conversations. If your laptop is stolen, customer names, addresses, quotes and payment details may go with it. If ransomware locks your files, you may lose the only copy of your accounts.

You also have legal duties. If you hold personal data about customers, suppliers or staff, UK GDPR applies to you. That is true whether you are a limited company or a sole trader. A cyber incident can become a personal data breach, and that brings reporting rules into play. The basics below make those rules easier to meet because you will know what you hold, who to call and what to say.

The 25-minute sprint

Set a timer. Do not aim for perfect. Aim for done.

1. Two-factor authentication: 10 minutes

Two-factor authentication, usually shortened to 2FA, means a password alone is not enough to get into an account. After you type your password, you enter a second code from your phone or an authenticator app. It is the single most useful security switch for a small business because it blunts the damage of a stolen or guessed password.

Start with the accounts that would ruin your week: your main email address, online banking, accounting software, and the admin login for your website. If you use a payment platform, do that too. Turn on 2FA in the security settings of each account. Use an authenticator app where possible rather than text messages, but text messages are far better than nothing.

Save the backup codes somewhere safe. Print them or put them in your password manager. Do not leave them in the same email inbox that the codes protect.

2. A password manager: 8 minutes

A password manager is a locked digital notebook for your logins. You remember one strong master password, and the manager remembers the rest. It also generates long, random passwords so you are not tempted to reuse the same one across your bank, email and software accounts.

Pick a reputable manager — Bitwarden, 1Password and Dashlane are common choices, and browsers and phones have built-in options too. Install it, create a long passphrase for the master password, and start saving your most important logins. You do not have to import everything today. Do email, banking, accounting and your website first.

Write the master passphrase on paper and keep it somewhere sensible, not on a sticky note stuck to your screen. This is one of the few times a piece of paper is a reasonable backup.

3. One offline backup: 7 minutes

Cloud storage is useful, but it is not a backup if it syncs deletions and encryption instantly. You need one copy of your key files that ransomware and a stolen laptop cannot reach. That means an external hard drive or USB stick that you plug in, copy your important folders to, and then unplug.

Copy the things you would panic about losing: accounts, customer records, quotes, invoices, contracts, website files and photographs. Keep the drive somewhere dry and separate from your laptop. Once a week, plug it in, copy the changed files, and unplug it again. Test that you can open one file from the backup. A backup you have never opened is a rumour, not a backup.

The ICO's 72-hour clock, in plain English

Under UK GDPR, if you suffer a personal data breach that is likely to result in a risk to people's rights and freedoms, you must report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it.

In plain English: if customer data is lost, stolen, exposed or accessed without permission, and it could cause harm, you may need to tell the ICO. Examples include a lost laptop with client records, an email account taken over by a scammer, or an invoice sent to the wrong person with personal details attached. If the risk is unlikely, you may not need to report it, but you should still record what happened. If you are unsure, call the ICO helpline and ask. The clock starts when you have a reasonable degree of certainty that a breach has happened, not when you finish a full investigation.

You may also need to tell affected individuals if there is a high risk to them. Keep the language simple and explain what happened, what you have done, and what they can do to protect themselves.

Your 'if this happens' incident card

Print this page or copy the list onto a card and keep it near your desk. When something goes wrong, panic makes people forget phone numbers and say the wrong thing.

First: contain, do not wipe. If you suspect malware or ransomware, disconnect the device from the internet and use a different phone or computer to make calls. Do not reset, wipe or delete anything until you have taken advice. Preserve the evidence.

Who to call

• ICO helpline: 0303 123 1113
• Action Fraud: 0300 123 2040
• Your bank's fraud line: use the number on the back of your card or the app
• Your insurer, if you have cyber cover
• Your solicitor, if you need legal advice
• Suspicious emails: forward them to [email protected]

What to say

My name is [your name] from [business name]. I noticed [what happened] on [date and time]. The data involved may include [customer names, emails, addresses, payment details]. I have [disconnected the device, changed passwords, called my bank]. I need advice on whether to report this and what to do next.

What to write down

• When you first noticed the problem
• Which devices, accounts or systems are affected
• What personal data may be involved
• How many people could be affected
• What you have done so far
• Who you have spoken to and when

The point is not perfection

The point is to make the easy attacks fail. A scammer who steals a password still cannot get in without your phone. A reused password stops being a master key. A ransomware infection meets a backup it cannot encrypt. And if the worst does happen, you have a card that tells you who to call while your brain is busy panicking.

Twenty-five minutes will not make you unhackable. It will make you a much less attractive target — and that is a very good use of a coffee break.