A suspicious email, an unnoticed outdated server or a lost administration password can also have a significant impact on a small business. IT security therefore does not just start with a specialized department. It arises from a few fundamental decisions that are reliably implemented in everyday life and regularly checked.

This is about reducing risks, not guaranteeing complete security. Measures must match data, business processes and available resources. A sensible start focuses on important systems and the consequences of a disruption. The recommendations in this article do not replace an individual protection needs analysis or examination of legal obligations.

Know what needs to be protected

A simple inventory overview captures devices, applications, accounts and relevant service providers. This also includes cloud services, shared mailboxes and externally maintained websites. A responsible person should be designated for each important system. Without this overview, you can easily end up with access or applications that no one actively supports anymore.

The consequences are then considered: What work will stand still if the system fails? Which data would be particularly critical if lost? Who could be affected by an unauthorized change? These questions help to use scarce resources wisely. A rarely used system with particularly confidential data may require greater protection than a frequently visited public information site.

Secure accounts and login

Important services should use individual accounts rather than shared logins. In this way, rights can be assigned and specifically revoked in the event of a change in personnel. Strong, diverse passwords can be managed with a suitable password manager. Reused passwords, on the other hand, increase the consequences of a single data leak.

Multi-factor authentication adds different factors to a login. The BSI and OWASP treat them as an important protective measure. The specific method and its recovery must fit the risk. Two passwords entered one after the other are not automatically two different factors. Additionally, recovery codes and replacement procedures require secure, documented handling.

Favor phishing-resistant methods where possible

Not every MFA method provides equal protection against deceptive login pages. For particularly important access, it is worth checking phishing-resistant procedures. Still, account recovery remains a potential weak point. Strongly secured access is of little help if the reset process runs through a weakly protected mailbox. Account protection must therefore be viewed as a coherent process.

Updates with responsibility and return path

Security updates should not depend on the casual attention of individuals. What is required is responsibility, an overview of components used and a procedure for evaluating urgent reports. In addition to operating systems, this includes CMS, extensions, browsers and libraries. Components that are no longer supported require planned replacement.

Updates can also cause functional changes. For important applications, a test environment, short functional tests and a recovery path help. However, that does not justify indefinite postponement. The urgency of a security breach and the consequences of a disruption must be assessed together. Decisions and temporary protective measures should be recorded in a comprehensible manner.

Plan backups against real failures

A backup must include important data and the components necessary for its operation. This can include databases, documents and configurations. Consistency and recoverability are crucial. A file named Backup is not proof that a complete business process can be resumed.

Copies should be protected against relevant failures and unauthorized changes. If a compromised administrative account can delete all backups, the separation may be insufficient. Restores are regularly tested using a documented process. This not only checks whether data is available, but also whether the application works correctly with it.

Limit rights to tasks

The principle of least privilege means that people and services only receive the access they need to do their job. An editorial content account typically does not require full server access. Technical integrations also do not require blanket administration rights if narrower access is sufficient.

Rights must be maintained throughout the course of employment or contract. Entry, role change and exit should trigger defined steps. Particularly privileged accounts require additional attention and, if possible, separation from the normal work account. Regular checks help to identify historical authorizations that are no longer justified.

Secure email as a process

Technical measures against unwanted or fake news are important, but do not solve every deception. Employees should know how to report suspicious messages. A simple, well-known reporting method is more helpful than the expectation of being able to reliably detect every sophisticated counterfeit yourself.

An independent confirmation method helps with sensitive changes, such as new bank details. The query should not be made using the contact details from the same suspicious message. Such rules must fit the workflow and be supported by managers. Time pressure and exceptional urgency must not automatically override the planned examination.

Separate networks and devices sensibly

Guest access, personal devices and business-critical systems should not be given the same access options without review. Proper isolation can limit the impact of a single compromised device. How it is implemented depends on the infrastructure and usage. General technical instructions without knowledge of the surroundings would be inadequate here.

For mobile devices, screen locking, updating and, if necessary, encryption are important topics. In addition, a procedure for loss or theft is required. Which accounts must be blocked and which data can be withdrawn? The answer should be known before the device disappears. Externally managed systems must also be included in this process.

Be prepared for an incident

A short emergency plan names contact persons, communication channels and first organizational steps. It should be available even without access to the potentially affected network. Not every person needs to know technical forensics. It is important that abnormalities are reported, decisions are documented and suitable experts are involved at an early stage.

Exercises can start small: an important account is unreachable, an application reports unusual changes, or a server needs to be restored. This shows whether telephone numbers are correct and access is available. Legal reporting requirements depend on the specific incident and applicable regulations; they should be taken into account in the prepared process with professional support.

Review representation and recovery together

A secure account can become an operational risk if only one person knows its recovery procedure. An appropriate representation rule is therefore needed for important services. This does not mean sharing passwords generally. Instead, controlled emergency access and protected documents with clear responsibility are provided.

A small test can show whether an authorized representative could even handle a problem. Are the hosting provider’s contacts known? Can backups be accessed regardless of the failed system? Can important access data be restored under the intended conditions? The results should be documented and any noticeable gaps closed.

External service providers also belong in this consideration. After the end of the contract, required documents and access must be handed over and authorizations that are no longer required must be withdrawn. A technical account that has existed for years without a responsible person is an avoidable uncertainty. Ideally, changes are tracked using a recurring list.

The documentation itself often contains sensitive information. It therefore needs access protection and suitable security. A fully public emergency manual with login details would obviously be wrong; Instructions stored exclusively in the failed portal do not help either. We are looking for a protected solution that can actually be achieved in the event of an emergency.

Security as recurring work

  • Keep inventory overview and responsibilities up to date.
  • Protect important accounts individually and with suitable MFA.
  • Evaluate, test and install updates in a timely manner.
  • Regularly check authorizations and track exits.
  • Practice recovery and provide an accessible reporting channel.

GRITTMANN can include security requirements for websites and individual applications in the design and operation. If necessary, specialized security service providers should be called in for the entire company. The Hosting Choices is a building block; What remains crucial is the interaction between technology, people and binding processes.

Sources and further documentation

Technical basics and additional information from the respective editors. Links last checked on 10.08.2026.