Cybersecurity for Small Teams Without an IT Department: Where to Start

Most cybersecurity guides are written for companies with a dedicated IT team, a security budget, and a CISO. If you run a team of 5, 10, or 20 people with no IT specialist on staff, most of that advice either doesn't apply to you or is too complex to implement without specialist knowledge.

This guide is written for you.

It covers what actually matters for a small team, what you can realistically do without technical expertise, and how to prioritize when you can't do everything at once.

Why small teams are targeted

There's a common assumption that hackers target large companies because the payoff is bigger. In reality, 46% of all cyberattacks target companies with fewer than 50 employees. Small businesses are targeted precisely because they typically have weaker defenses, less monitoring, and fewer resources to respond to an incident.

The cost of a breach for a small business is not proportionally smaller than for a large one. The average cost of a cyberattack on an SMB is over $250,000 when you include downtime, lost clients, legal fees, and recovery costs. For a 10-person company, that's often fatal.

The three real risks for small teams

Before deciding what to do, it helps to understand where the actual risk comes from for a company your size.

Human error. The majority of successful attacks on small businesses start with a person doing something — clicking a phishing link, using a weak password, forwarding sensitive data to the wrong address, connecting to a compromised network. Technical solutions reduce this risk, but training is the only thing that addresses the root cause.

Unprotected devices. Laptops, phones, and tablets that access business data without encryption, without access controls, or without monitoring are the most common entry point for attackers. For small teams using personal devices for work — which most do — the exposure is significant.

Weak or reused credentials. Password reuse is extremely common, and credential stuffing attacks — where attackers try leaked username and password combinations against business services — are among the most frequent attacks on small businesses. A single reused password across multiple services can give an attacker access to email, cloud storage, accounting software, and client systems simultaneously.

What to do first — the non-negotiables

These are the measures that provide the highest risk reduction for the lowest effort and cost.

Multi-factor authentication on everything. Enable MFA on your email, cloud storage, accounting software, and any service that contains client data or financial information. This single measure stops the vast majority of credential-based attacks. Every major service supports it. It takes 10 minutes per service to set up.

A password manager for the whole team. Get everyone on the team using a password manager — 1Password, Bitwarden, and Dashlane are all suitable for small teams. This eliminates password reuse and ensures everyone uses strong, unique passwords for every service without needing to remember them.

Device encryption. Enable full-disk encryption on all laptops and computers used for work. On macOS this is FileVault, on Windows it's BitLocker. Both are built into the operating system and free to use. If a device is lost or stolen, encryption ensures the data on it cannot be accessed.

Regular software updates. The majority of malware exploits known vulnerabilities in software that has available patches. Enable automatic updates on all devices and operating systems. This sounds obvious, but it's one of the most commonly skipped measures in small teams.

What to do next — reducing ongoing risk

Once the fundamentals are in place, the next priority is reducing the risk from the things your team does every day.

Security awareness training. Regular, short training sessions are more effective than annual compliance courses. The goal is to help your team recognize phishing attempts, understand why certain behaviors are risky, and know what to do when something seems wrong. This doesn't require a specialist — structured training tools can be set up in an afternoon and run automatically.

A clear policy for working from public networks. If any of your team members work from cafes, hotels, coworking spaces, or client offices, you need a clear policy for how they should connect. This means either requiring a VPN, using a hardware security device like Roam, or both. The policy should be written down, shared with the team, and reviewed when someone joins.

Access control. Not everyone on the team needs access to everything. Apply the principle of least privilege: each person should have access only to the systems and data they need for their specific role. When someone leaves the team, revoke their access on the same day.

Regular backups. Back up all critical business data — client files, financial records, project work — to at least two locations, one of which is off-site or cloud-based. Test your backups periodically by actually restoring a file. A backup you've never tested is not a backup you can rely on.

How to handle NIS2 if it applies to you

If your company supplies services to organisations in critical sectors — healthcare, finance, logistics, government — you may be required to demonstrate basic cybersecurity compliance as a condition of continuing those contracts. The measures described in this article cover most of what NIS2 requires at the SMB level. What you additionally need is documentation: written policies, training records, and evidence of the technical measures you've put in place.

The free NIS2 readiness checklist helps you identify exactly which documentation you're missing and what each item needs to contain.

What you don't need right now

A SIEM platform. A dedicated security operations centre. Enterprise endpoint detection and response tools. Penetration testing. These are valuable for larger organisations with larger attack surfaces and dedicated security teams. For a team of under 20 people, they add complexity without proportional risk reduction.

Start with the fundamentals. Get MFA, password management, encryption, and training in place. Then add network-level protection for team members who work remotely. Then document what you've done.

That's a security posture that would put you ahead of the majority of small businesses in the Netherlands — and above the basic threshold for NIS2 compliance.