Basic IT Security for Small Businesses: Passwords, Backups, Access Rights

Why are antivirus and a firewall not enough?

Whoever asks about IT security in a small company usually hears: we have antivirus, the router has a firewall, and the IT service provider takes care of it. That is a start. The situation is still serious. In the 2026 business protection study by the German digital association Bitkom, 67 percent of companies surveyed with ten or more employees confirmed a successful attack in the previous twelve months. How such attacks unfold and through which entry points they come is described in the article on cyberattacks on small businesses.

That article also sets out the order of the first protective measures. This article goes deeper into three of them that are most often neglected in daily work: passwords, backups, and access rights. This leads to the guiding question: Which rules on passwords, backups, and access rights does a small company need so that a single mistake does not lead to a standstill?

To answer it, we first clarify the security goals and the thinking model of least privilege. Then we look at how small companies assess their risk and weigh two perspectives. This is followed by the three rule areas, a note on obligations and assessment offers, and a step for this week.

A backup that has never been restored is not a safeguard but an assumption.

What does basic IT security mean? The three security goals

Germany’s Federal Office for Information Security (BSI) uses the term IT-Grundschutz, basic IT protection, for a method and an extensive compendium with which organizations reach an appropriate level of security. For a small company, the full compendium is too large. The idea behind it is transferable, however: first the basic measures that protect against the most common threats, only then the special cases.

All measures serve three security goals that have long been used in information security. Confidentiality means that only authorized people can see data. Integrity means that data is not changed unnoticed. Availability means that data and systems are there when needed. The three rule areas of this article can be assigned to these goals.

The thinking model: the principle of least privilege

In 1975, Jerome Saltzer and Michael Schroeder described principles for protecting information in computer systems that still apply today. One of them is the principle of least privilege: every program and every person should have only the rights needed for the respective task. The idea is simple. If a login is misused, by an attacker, malware, or a mistake, the damage reaches only as far as that login’s rights.

An analogy from the workplace makes this tangible. Nobody would give every employee a master key to all rooms, the safe, and the warehouse just because it is more convenient. Everyone gets the keys they need. In IT, the exact opposite often happens tacitly: everyone works with administrator rights, everyone sees all folders, and former employees still have a cloud login.

The principle complements the Swiss cheese model described in the article on cyberattacks. That is about layering several protective layers so that a hole in one layer does not go all the way through. Least privilege ensures that the damage stays small if all the holes do line up for once.

How small companies assess their risk

Why precisely the simple rules are missing was examined by Wilson and McDonald (2025) in the UK. They interviewed 30 participants: ten small businesses that depend on IT, ten whose business is based on IT, and ten providers of IT security. Their framework was the Health Belief Model from health research, according to which people take protective measures when they consider themselves at risk and rate the benefit higher than the barriers.

Three findings are revealing for small companies. First, many considered themselves too insignificant to be attacked because they expected targeted attacks. In fact, many attacks run indiscriminately and automatically; they look for open doors, not for particular companies. Second, the businesses relied mainly on technology: 13 of the respondents named technical measures such as antivirus, 11 named procedures such as off-site backups, while staff training hardly came up. Third, the security providers criticized that backups were often never restored, so that nobody knew what state the data would be in when it counted.

The limits of the study are clear: 30 interviews in one country, no measurement of actual incidents. But it shows a pattern that matches the experience of many IT service providers, and it explains why the three rule areas of this article are so often missing. They are not a product you can buy.

Buy technology or set rules? Two perspectives

There are two readings of where the lever lies. The first says: small companies have neither the time nor the expertise for rules. They should buy technology that protects automatically and leave the rest to the service provider. In its favor is that automatic updates and two-factor login do indeed work without daily effort.

The second says: technology without rules is a lock without key management. The backup runs, but nobody checks it. The password manager has been bought, but the password for the banking software is stuck to the screen. Access rights were set up once and never looked at again. The findings of Wilson and McDonald support this, as does the field experiment by Baillon and colleagues (2019) described in the article on cyberattacks: even after being informed, some employees entered their password on a fake page. Technology must therefore be set up so that such a mistake is not enough, and that is a question of rules.

I consider the second reading more robust without rejecting the first. Technology is the precondition; the rule determines the effect. For a small company, this means: few rules, in writing, with one person responsible and a fixed review date.

The three rule areas: what to do concretely

Passwords and login

• Each person has their own logins; shared accounts exist only where there is technically no alternative.
• A team password manager stores all passwords; nobody writes them on notes or in spreadsheets.
• Passwords are long and unique. The BSI advises against changing them regularly without cause, but they should be changed when misuse is suspected.
• Email, bank, accounting, cloud, and remote access are protected with a second factor, for example via an app.

Backups

• There are at least three copies of important data on two different media, one of them off-site or disconnected from the network. This so-called 3-2-1 rule is widely used.
• One copy is unreachable for an attacker on the network, for example because it is disconnected after backup or cannot be modified.
• Once a quarter, a restore is tested: one file, one folder, once a year a whole system.
• Cloud services are backed up too, because a folder deleted by mistake is gone there just as it is locally.

Access rights

• Nobody works with administrator rights in daily work. There is a separate account for installations.
• Folders with personnel, financial, and customer data are open only to the people responsible, as the filing charter provides.
• When an employee leaves, all logins are disabled on the last working day, following a fixed list.
• Every six months, a responsible person checks who has which rights and removes what is no longer needed.

The rules on filing and access rights are closely related. What a folder structure with three levels and restricted access to personnel files looks like is shown in the guide to digital filing. And separate logins for deputies instead of shared passwords are also a rule from the article on deputy coverage. Whoever uses fewer tools also has fewer logins to manage, another reason to reduce tool sprawl.

Obligations and assessment offers: NIS2 and the CyberRisikoCheck

Since December 6, 2025, the German law implementing the European NIS2 directive has been in force. It obliges companies in certain sectors and of certain sizes, generally from 50 employees or 10 million euros in revenue, to take risk management measures, report significant incidents, and register with the BSI. Most small companies are not directly covered. They can be indirectly affected if customers covered by the law pass security requirements on to their suppliers. Whether your company is affected can be clarified using the BSI’s information and with your advisors.

For companies with up to 50 employees, the BSI, together with the SME association BVMW and the German standards institute DIN, has created a dedicated entry point: the CyberRisikoCheck under DIN SPEC 27076. In a one- to two-hour conversation, an advisor checks 27 requirements against a fixed questionnaire and derives recommendations. No certification is involved. For a small company, this is often a more suitable path than full IT-Grundschutz or ISO 27001 certification.

Conclusion: which rules does a small company need?

The question was
rules on passwords, backups, and access rights a small company needs so that a single mistake does not lead to a standstill. The answer follows from the three security goals and the principle of least privilege: individual logins with a second factor, backups that are kept separately and tested, and rights that are tied to tasks and reviewed regularly.

As shown, small companies often underestimate their risk and rely more on purchased technology than on rules. Together, both explain why precisely the simple measures are missing. This calls not for a major project but for a short list with one person responsible and fixed review dates. The sober observation is: a small company’s most effective protective measures cost little money but require regular attention.

How to get started

1. Have your IT service provider restore a single file from the backup and measure how long it takes.
2. Check whether email, bank, and accounting are protected with a second factor, and turn it on wherever it is missing.
3. Get a list of all accounts with administrator rights and reduce them to what is necessary.
4. Disable all logins of former employees and create an exit checklist for the future.
5. Check whether a CyberRisikoCheck under DIN SPEC 27076 makes sense for your company.