Cyber security and resilience checklist
Small companies are real targets. Use this checklist to set practical controls before a lost laptop, compromised inbox, ransomware incident or supplier breach becomes a company-threatening problem.
Why it matters
UAE SMEs form the backbone of the non-oil economy; use current UAE cyber-risk benchmarks from official sources.
UAE cybersecurity authorities consistently warn that SMEs are frequent targets of phishing, credential theft and ransomware campaigns.
The five controls to implement first
- Back up critical data. Back up accounts, documents, code, customer records, invoices and product data. Keep at least one backup separate from day-to-day devices and test restoration.
- Protect devices. Turn on automatic updates, screen locks, encryption where available, anti-malware protection and remote wipe for phones and laptops.
- Secure email. Use a reputable business email provider, turn on MFA, set SPF/DKIM/DMARC where possible, and limit who can change payment details or forward mail externally.
- Secure important accounts. Use password managers, unique passwords, MFA, admin-role limits, recovery-code storage and an offboarding process for founders, contractors and suppliers.
- Spot cyber attacks. Train the team to report phishing, fake invoices, account-reset emails, unusual login prompts and urgent payment-change requests.
Startup-specific risk areas
Investor decks, customer contracts, payroll, bank alerts and domain renewals often sit in founder email. Protect it like production infrastructure.
Remove API keys from repos, rotate shared passwords, use least privilege and protect deployment accounts with MFA.
Freelancers and agencies should have scoped accounts, not shared founder logins. Remove access when work ends.
Verify bank detail changes by a second channel. Use two-person approval for large payments where possible.
Map what personal data you hold, why you hold it, who can access it and how quickly you could notify if breached.
Keep a short contact list: hosting, email provider, bank, insurer, legal adviser, key customers and NCSC reporting links.
Evidence customers and insurers may ask for
- Cyber Essentials or a clear security-basics checklist.
- Backup and restoration test dates.
- Access-control list for admin systems.
- Incident response plan and breach decision log.
- Data processing records and supplier list for GDPR due diligence.
If you think you have been hacked
Do not quietly keep operating and hope it passes. Preserve evidence, secure accounts, contact your provider or security adviser, assess customer/data impact, and use NCSC response guidance and reporting routes where appropriate.