Cybersecurity for small business does not start with costly software. Its foundation is multifactor authentication, tested backups, regular updates, and a clear emergency plan. Attackers usually only need a stolen email password, an unpatched system bug, or a broken backup.

Below are ten low-cost, effective steps, a guide for the first 60 minutes of an attack, and an overview of the new Cybersecurity Act (Act No. 264/2025 Coll.), the Czech implementation of the EU NIS2 Directive. You will also see how it affects unregulated small firms. This article does not replace legal advice for your specific case.

What an attack on a smaller firm looks like

Attackers look for the easiest target, not a specific one. A smaller firm lacks a security team, yet it pays invoices and stores customer data. The 2025 Verizon report for small and medium businesses confirms this: in firms under 1,000 employees, ransomware played a role in 88% of breaches (vs. 39% in large ones), and stolen credentials caused 33%. Smaller firms less often hold working backups, so attackers bet they will pay.

Three scenarios are typical:

• Ransomware: Malware encrypts or copies data and demands ransom to unlock or not publish it. Median ransom paid fell to USD 115,000, and 64% of organizations did not pay.
• Email takeover: An attacker steals a password via a fake login page and reads mail for weeks. They learn who bills whom, when, and how your team writes.
• Invoice fraud: A convincing email from a breached or lookalike address claims a supplier changed bank accounts. Such pretexting is more common in smaller firms than in large ones.

Suppliers are a fourth threat—their share in breaches rose from 15% to 30%. An attack can enter via your accountant, IT admin, e-shop, or another tool with access to your data.

Cybersecurity for small business: ten low-cost steps

Ten affordable measures cover most risks. For each, you can see how to tell when it is done.

Multifactor authentication (MFA) is the cheapest defense against stolen passwords. In a May 2023 Microsoft study on Azure Active Directory, MFA cut account takeover risk by 99.22%, and by 98.56% even when passwords had leaked. A mobile authenticator app protects better than SMS codes.

A password manager works like a vault. You remember one master password while the app generates and stores strong, unique logins for other services. If one leaks, attackers fail elsewhere.

SPF, DKIM, and DMARC act as a stamp and signature. SPF defines which servers may send mail for your domain, DKIM adds a digital signature, and DMARC tells receiving servers how to treat unsigned mail. Your admin sets them in domain DNS. Unsure who manages yours? Read how domains and hosting work.

Staff departures pose a quiet risk. A former colleague's forgotten account is an open window into the company. Keep a list of all services so you revoke access item by item when someone leaves.

Backups that actually save you

A backup saves your company only when attackers cannot encrypt it and you can truly restore data from it. Many firms discover only after an attack that backups sat on the same network, failed for months, or take a week to restore.

Follow the 3-2-1 rule:

• 3 copies of data: the original and two backups.
• 2 storage types: for instance, a local network drive and the cloud.
• 1 off-network copy: an unplugged offline drive or immutable cloud backup that cannot be overwritten or deleted for a set period.

In its ransomware defense guide, the US agency CISA recommends keeping encrypted offline backups and testing restores regularly. An untested backup is only a hope.

Back up more than a shared drive: include accounting software, your e-shop database, emails, and core system settings. In the cloud, check what the provider backs up and what falls on you. Providers usually guarantee service availability, not data you delete or an attacker encrypts.

Prepare your team and handle the first 60 minutes

The human factor plays a part in roughly 60% of breaches, Verizon reports. Short, relevant lessons and simulated phishing emails teach staff to report suspicious messages.

One rule stops most fake invoices: verify any bank account change or unexpected payment request from management by calling a phone number you already know, never the contact in the message.

During an incident, the first 60 minutes are decisive. Keep a written procedure:

1. Disconnect the device from the network. Unplug the cable and turn off Wi-Fi. CISA advises powering off only if you cannot disconnect, since shutting down can erase evidence.
2. Report the incident to the designated person. Everyone should know whom to call right away.
3. Delete nothing and do not pay. Do not reinstall the system or contact the attacker without an expert.
4. Call a specialist. They will assess the scope, secure traces, and help restore backups.
5. Change passwords from a clean device. Sign out all active sessions on compromised accounts.
6. Keep a timeline. You will need this log for your insurer, the police, and authorities.

If an attack affects personal data, GDPR requires reporting the breach to the Czech Data Protection Authority (ÚOOÚ) without undue delay and, where feasible, within 72 hours of discovery, unless a risk to people's rights is unlikely. Firms regulated under the new law must also report incidents within 24 hours of discovery. Suspected crimes can be reported to the Police of the Czech Republic.

Does NIS2 in the Czech Republic apply to you?

The new Cybersecurity Act (Act No. 264/2025 Coll., effective November 1, 2025) implements the EU NIS2 Directive—Directive (EU) 2022/2555—in the Czech Republic. Directly, it mainly covers medium and large firms in regulated sectors; small and micro businesses fall under it only rarely.

Decree No. 408/2025 Coll. defines regulated services (such as energy, transport, healthcare, digital infrastructure, selected manufacturing, food, and postal and courier services). Under European Commission Recommendation 2003/361/EC, a firm is no longer small once it has at least 50 employees, or both annual turnover and balance sheet total above EUR 10 million. Linked and partner enterprises count too unless their technical assets are fully separated (Section 7)—so a small subsidiary of a large group can fall in scope.

The law relies on self-identification: your company assesses whether it provides a regulated service and reports it to NÚKIB within 60 days of meeting the criteria (Section 6). For most firms, the deadline passed on December 31, 2025. You submit notifications on the NÚKIB Portal, which also offers a guide to the new law and a regime calculator. NÚKIB registers the service and places you in one of two regimes.

From delivery of registration, you have one year to introduce security measures and incident reporting (Sections 13 and 15). Incidents must be reported within 24 hours of discovery, with fuller details within 72 hours (Section 16). The full text of Act No. 264/2025 Coll. is public, though the NÚKIB guide is enough for an overview.

Out of an estimated 6,000 organizations, 4,825 had registered by February 8, 2026, per a NÚKIB press release of February 11, 2026. The authority also contacts likely regulated firms directly—reaching over 4,400 by October 2026, Česká justice reported. Fines reach up to CZK 250 million or 2% of global annual turnover, though NÚKIB stresses it aims primarily to help firms comply rather than punish them.

NIS2 supply chain requirements for unregulated firms

The new Cybersecurity Act indirectly affects unregulated firms too. Under Section 13(5), regulated companies must demand security from their suppliers and write it into contracts.

For the lower regime, Decree No. 410/2025 Coll. (Annex 2) lists 14 contract areas, including audits, subcontractors, incidents, continuity, and software development. For the higher regime, Decree No. 409/2025 Coll. lists 18 and requires evaluating significant suppliers before signing, according to a May 2026 Sedlakova Legal analysis.

If you supply IT, accounting, logistics, or anything connected to a regulated client's systems and data, expect:

• a security questionnaire (MFA, backups, training, encryption, subcontractors),
• new contract clauses on audits, incident reporting, confidentiality, and data handover upon termination,
• short incident reporting deadlines—often within 12 hours, according to Sedlakova Legal.

Prepare a one-page security profile in advance: measures, owners, backups, access rules, and incident contacts. You can then complete questionnaires without empty promises. The 10 steps above cover most questions.

Your software, suppliers, and a 30-day plan

Websites, e-shops, and internal apps are often a smaller firm's weakest spot—nobody owns their security, and software ages. Exploited vulnerabilities caused 20% of breaches, Verizon reports, and that share is rising.

Clarify three points for every system:

• Who updates: Specify in contracts who updates the system, plugins, and server, and how fast critical bugs get patched.
• Who has access: Give each admin and supplier an individual account, canceled when work ends. Store API keys—such as for connecting an e-shop with accounting and inventory—securely and rotate them when a vendor leaves.
• Who monitors vulnerabilities and logs: Someone must watch known software flaws and login records.

The same applies to artificial intelligence: an AI assistant over company documents may show only what the asking user is allowed to see. Security belongs in every business digitalization project from day one.

Your first 30-day plan:

When we build web applications and business systems, we factor company security into the initial design. If you want a practical review of your website, e-shop, or internal system, schedule a consultation with us.

Frequently asked questions