Key takeaways
- Most attacks on small and mid-sized businesses use the same paths: stolen passwords, phishing emails, unpatched systems and exposed remote access.
- Fifteen essentials, from MFA and patching to EDR, email security and tested backups, close most of these paths without a large budget.
- In Saudi Arabia, these controls also support PDPL requirements and align with the NCA Essential Cybersecurity Controls.
Small and mid-sized businesses are attacked because they often have valuable data and weaker defenses. The good news is that most attacks use a few common paths. This checklist covers the fifteen essentials we recommend to every SME.
Accounts and access
- 1. Multi-factor authentication on email, VPN, remote desktop and every admin account.
- 2. Separate admin accounts, used only for administration.
- 3. Remove accounts of staff who leave on their last day.
- 4. A password manager and no shared passwords.
Devices
- 5. Automatic updates for Windows, macOS, browsers and Office.
- 6. Endpoint protection with EDR on every laptop, desktop and server.
- 7. Disk encryption on laptops.
- 8. Users without local administrator rights.
Email and network
- 9. Email security with anti-phishing, plus SPF, DKIM and DMARC on your domain.
- 10. A business firewall with current firmware and no unnecessary open ports.
- 11. A separate guest Wi-Fi network.
- 12. No remote desktop exposed directly to the internet; use VPN with MFA.
Data and recovery
- 13. Backups following the 3-2-1 rule, with an immutable or offline copy and regular restore tests.
- 14. Know where personal data is stored, as required under the PDPL.
People and response
- 15. Short, regular phishing awareness training, and a simple plan for who to call and what to do in an incident.
How Thoughts House can help
We help SMEs across Saudi Arabia put these essentials in place: firewalls, EDR, email security, MFA, backup and support, with a short assessment to show you where to start.
Frequently asked questions
What is the most important cybersecurity step for a small business?
Turning on multi-factor authentication for email, remote access and admin accounts. It blocks most attacks that rely on stolen passwords.
Do small companies in Saudi Arabia need to follow the NCA controls?
The ECC are mandatory for national entities, such as government organizations and critical infrastructure. Other companies are encouraged to adopt them, and the PDPL requires appropriate security for personal data whatever the company size.
How much should a small business spend on cybersecurity?
It depends on size and risk. Many essentials, such as MFA, patching and Microsoft 365 security settings, cost little; EDR, email security and backup are modest per-user costs compared with the cost of an incident.