Cyber attacks are no longer something that only happens to large businesses or household names. In 2025, 43% of UK small and medium-sized businesses experienced a cyber security breach or attack, equivalent to over 600,000 companies across the country (Heimdal Security / UK Cyber Security Breaches Survey 2025).
The good news? Many of the most damaging attacks are entirely preventable. This checklist is designed to help SMB owners and office managers in Durham and the surrounding areas take stock of where they stand and take confident, practical steps forward.
The Cyber Threat Landscape for North East SMBs
It can be tempting to assume that cyber criminals target big-city firms or high-profile organisations. In reality, small businesses are frequently the most attractive targets precisely because they are less likely to have dedicated IT security resources. Attackers know this, and they exploit it.
Phishing remains the dominant threat. 93% of businesses that experienced a cyber crime in 2025 reported phishing as the attack method. These are not always obvious scam emails. Today’s phishing attempts are convincing, personalised, and increasingly difficult to spot without proper training and technical controls in place.
The financial and reputational consequences are real too. Beyond the direct costs, the average direct cost of a cyber crime to a UK business stands at £1,970, and that is before accounting for lost productivity, reputational damage, or customer churn. Additionally, 47% of businesses that suffered an attack found it harder to attract new customers afterwards. For a small firm that kind of reputational hit could be devastating.
Your 2025 Cyber Security Checklist
Work through each of the following seven areas honestly. For each one, ask yourself: do we have this in place, and do we know it is working?
Strong Passwords and Multi-Factor Authentication (MFA)
Weak or reused passwords remain one of the most common entry points for attackers. Every business account, email, cloud storage, accounting software, remote access tools, should be protected with a unique, complex password. A password manager makes this manageable for teams of any size.
Equally important is multi-factor authentication. MFA adds a second layer of verification, such as a code sent to a mobile device, so that a stolen password alone is not enough to gain access. Despite this, only 40% of UK businesses currently use two-factor authentication, leaving the majority exposed. Enabling MFA across all critical systems is one of the simplest, highest-impact steps your business can take today.
Software and System Updates
Unpatched software is a gift to cyber criminals. When developers release security updates, they are often closing known vulnerabilities, vulnerabilities that attackers actively scan for and exploit. Delaying updates, even by a few days, can leave your systems exposed.
Establish a clear patching policy. Operating systems, applications, firmware, and browsers should all be updated promptly. Where possible, enable automatic updates. This applies equally to on-premise servers and cloud-based tools.
Staff Cyber Awareness Training
Your people are your greatest asset, but without the right training, they can also be your biggest vulnerability. Phishing emails, social engineering calls, and malicious attachments are all designed to deceive real humans, not just bypass technical controls.
Despite this, only 19% of UK businesses provide staff with formal cyber security training. Regular, practical training, even short quarterly sessions, can dramatically reduce the likelihood of a successful attack. Staff should know how to spot a suspicious email, what to do if they click something they should not have, and who to report incidents to.
Secure Remote Access
Hybrid and remote working is now a fixture for many businesses across Durham and the North East. With that flexibility comes risk. Remote connections to company systems must be properly secured.
A Virtual Private Network (VPN) encrypts traffic between remote devices and your network. Remote Desktop Protocol (RDP) should never be exposed directly to the internet without strong authentication controls in place. All devices used for remote working, whether company-owned or personal, should meet a minimum security standard before being permitted access to business systems.
Data Backup and Recovery
No security measure is 100% guaranteed. Ransomware, accidental deletion and hardware failure can all result in the loss of critical business data. A robust, regularly tested backup strategy is your safety net.
Follow the 3-2-1 rule: keep three copies of your data, on two different types of storage media, with one copy stored offsite or in the cloud. Critically, backups must be tested. A backup you have never restored from is a backup you cannot rely on when it matters most.
Email Security and Phishing Protection
Given that phishing accounts for the overwhelming majority of successful cyber attacks on UK businesses, email security deserves its own focus. Technical controls, including spam filtering, anti-malware scanning, and email authentication protocols such as SPF, DKIM, and DMARC, significantly reduce the volume of malicious email that reaches your team.
Beyond filters, consider whether your email platform flags external senders, warns of unusual forwarding rules, or alerts administrators to suspicious login activity. These features are often available within existing tools such as Microsoft 365 but need to be actively configured and monitored.
Incident Response Plan
When something goes wrong, your team needs to know what to do. An incident response plan does not need to be a lengthy document. It simply needs to answer a few critical questions:
- Who is the first point of contact?
- Who needs to be notified internally and externally?
- How do we isolate an affected system?
- Where are our backups?
Having these answers written down and communicated to your staff before an incident occurs can mean the difference between a contained problem and a full-scale business disruption.
Why a Local IT Partner in Durham Makes All the Difference
Working through a checklist like this is a useful starting point, but effective cyber security is not a one-time exercise. It is an ongoing discipline. For many SMBs without a dedicated IT team, maintaining that discipline alongside running a business is genuinely challenging.
That is where a trusted local IT partner comes in.
Concept IT, based in Durham, is the only NCSC-backed Cyber Advisor in County Durham, a nationally recognised accreditation that demonstrates the team’s knowledge of the Cyber Essentials technical controls and their competence in delivering practical, hands-on support to small and medium-sized organisations.
We are also ISO 9001 and ISO 27001 certified, meaning quality management and information security are embedded in how we operate, not just something we advise others on.
As a managed IT provider with 24/7 monitoring, we provide businesses across the North East with the kind of continuous, expert oversight that most SMBs could never resource internally. Our local presence means we understand the specific context of businesses in Durham and the surrounding area, the types of organisations, the industries, and the pressures, rather than offering one-size-fits-all advice.
Cyber security for small businesses in Durham does not need to be overwhelming. With the right partner, it can be straightforward, proportionate, and genuinely effective.
Take the Next Step
If working through this checklist has raised questions about your current cyber security posture, or if you are simply not sure where to start, you do not need to figure it out alone.
Get in touch with the team at Concept IT for a no-obligation conversation about your cyber security posture.