Cyber basics recap: the six habits that stop most problems

"I just don't know what matters first"

A Greater Manchester small-business owner said to me recently, "I know cyber security matters — I just don't know what matters first." That's the real problem for most people. Not laziness. Not stupidity. Just noise.

Over the past couple of months we've talked about password managers, multi-factor authentication, backups, public Wi-Fi, software updates, router security, smart devices, and how to get rid of old tech safely. On paper those sound like separate topics. In real life they all come down to the same thing: closing obvious doors before something goes wrong.

At home, that means protecting your email, backing up your photos, updating your phone, and not trusting every text or call that lands. At work, it means the same habits applied to Microsoft 365, customer data, laptops, routers and staff behaviour. Cyber security gets much less intimidating when you stop thinking of it as "IT stuff" and start thinking of it as a handful of routines you actually do.

We had this conversation in a Stockport accountancy office last month — three partners around a table, worried about ransomware. Turned out none of them had 2-step verification on their email yet. That's where we started. Not with a new firewall. Not with a Cyber Essentials application. Just email, one Tuesday afternoon.

Why this matters

• At home, the NCSC's advice for individuals highlights the same core steps again and again: use a password manager, turn on 2-step verification, install software and app updates, and back up important data like photos and documents.
• At work, GOV.UK guidance for small businesses points companies to practical basics — protecting accounts and devices, backups, scam awareness and Cyber Essentials-style controls — because these are the steps that protect money, data and reputation when something does go wrong.

The fix

For businesses, these are the same habits that show up in a Cyber Essentials assessment — and they're what our SecureState framework checks against every quarter, whether or not you go on to certify. The fancy stuff — SOC, DFIR, threat hunting — only pays off once the boring stuff is in place.

Three things you can do this week

The six habits, in order

The same six habits keep showing up across NCSC, GOV.UK and Cyber Essentials guidance. Here's how they stack up on effort vs impact — most of them are low-effort and high-impact, which is why they're the ones we push first.

What this looks like locally

We've had these exact conversations with families and small businesses across Tameside, Stockport (SK1), Ashton-under-Lyne (OL6) and Sale (M33): people who thought cyber security was too technical, only to find that the biggest wins were basic things nobody had got round to yet. That's actually good news, because basic fixes are the cheapest ones — and the ones you can start on this afternoon without buying anything new.

For the business version of the same conversation, our managed IT and Cyber Essentials pages walk through exactly how these six habits get built into a working IT setup — and our recent post on what ISO 27001 actually asks of a 20-person company covers the next step up for firms that need to prove they're doing it.

Frequently asked

What's the most important cyber security step?

Start with your email. If someone gets into your email, they can often reset your other accounts too — banking, social media, work systems. Put your email behind a strong unique password and 2-step verification before anything else. Everything after that gets easier.

Do small businesses really need all this?

Yes. GOV.UK and the NCSC both frame these as practical basics for small firms, not enterprise-only controls. The same steps are what Cyber Essentials assessors look for, and they're what protect money, data and reputation when something goes wrong.

Is a password manager worth it?

Yes. It's the single change that lets you use a different strong password on every site without having to remember them. That's what breaks the chain when one site is compromised, so a single leak doesn't unlock every other account you own.

Should I turn on 2-step verification everywhere?

As a priority, yes for email, banking, and work accounts. The NCSC recommends using 2-step verification wherever it's available — but if the whole list feels daunting, those three cover the ones that would hurt most if lost.

What if I only do one thing this week?

Secure your email first — strong unique password plus 2-step verification. Then next week turn on automatic updates. Then the week after check your backups. That order gives you the biggest early win with the least effort, and it's the same order the NCSC recommends for individuals.

How does this fit with Cyber Essentials?

Cyber Essentials is the UK government's baseline certification for small businesses, and its five controls map onto exactly this kind of list: access control, secure configuration, patching, malware protection and firewalls. If you're doing the six habits properly, most of a Cyber Essentials assessment is already done.

"Most cyber security isn't clever. It's just the boring stuff done on time." — Brett Casterton, Inology IT

Previous tip: Smart-home security — how to keep connected devices from becoming the weak link.