It's easy to give cyber security a burst of attention before an assessment or after a worrying email. Keeping it working in an ordinary week is harder. Someone changes roles, a laptop misses an update and a backup stops running while its owner is on holiday.
To maintain cyber security, give the recurring jobs an owner, check that they actually happened and act on the exceptions. A small business can start with a short shared task list. The useful part is knowing what still needs attention, who will deal with it and when.
The routine below is a practical starting point, not a required timetable or a promise that a business following it cannot be attacked. Adjust the frequency to your risks, systems and contractual requirements.
Start with the services you cannot do without
List the systems that keep work moving. Include email, payroll, customer records, shared files, banking, your website and the account that controls your domain name. Add the people, devices and suppliers with access to them.
For each service, record a business owner and the person or provider who maintains it. These can be different people. An IT provider may manage the settings while the finance manager decides who should access payroll.
Use this list to choose priorities. If you can't agree which systems matter most, work through the small business cyber security risk assessment first. It helps connect technical tasks to the work and information you need to protect.
Each working day: deal with urgent exceptions
Nominate someone to review important security alerts, failed backups and updates needing attention. Give them a deputy and a clear route to technical support. Your monitoring arrangements may need to run outside working hours too, depending on the services and risks involved.
A useful handover describes the unresolved problem, rather than simply saying that the dashboard was checked. For example, in a fictional design studio: "The accounts laptop hasn't reported since Monday. Priya will check with its user before midday."
If an alert suggests an active compromise, switch to the cyber attack response guide. Don't leave it in a routine maintenance queue. Staff should be able to report a concern promptly without first proving that it is an attack.
Each week: check whether updates are finishing
Automatic updates save work, but enabling them doesn't prove every device is current. The NCSC's device update guidance describes common obstacles such as low storage, missing power or network access, and a restart that never happens.
Ask your administrator to identify devices that are behind, unreachable or awaiting a restart. Include applications and relevant firmware as well as the operating system. Arrange a safe time to complete each update and check the result. Track unsupported products with a replacement or removal plan.
The weekly review is a catch-up check, not permission to delay an urgent fix. Respond promptly to vendor security advice. If you are working towards Cyber Essentials, use the patching workflow alongside the current scheme requirements.
When people or suppliers change: review access immediately
Don't wait for a monthly meeting to deal with a leaver, an expired contractor engagement or access that is no longer needed. Follow an authorised process that closes access while preserving records the business still needs.
The NCSC's identity and access management guidance recommends managing access throughout its lifecycle and limiting it to what a person needs for their role. Apply that thinking when somebody changes jobs internally as well as when they leave.
Keep administrator access separate from ordinary work. Include suppliers and shared services in reviews, and identify who can approve any continuing access. An old support account shouldn't survive indefinitely because everyone assumes somebody else owns it.
Each month: check account protection and recovery
Review a manageable set of important services, with a plan that covers them all. Check the actual sign-in settings, the people with access and how the business would recover a locked account.
The NCSC's important accounts guidance recommends passkeys where available, and strong unique passwords with two-step verification where passwords remain in use. Check recovery arrangements too. A business should not depend entirely on the phone of a person who has left.
Keep recovery codes and other secrets in approved secure storage, not in the maintenance spreadsheet. The spreadsheet can say who checked the arrangements and where authorised staff find the instructions.
Plan a restore check, not just a backup check
Choose how often to practise recovery based on how much work you could afford to lose and how quickly you need it back. The NCSC's backup guidance stresses knowing how to restore data and checking that the backup includes what matters.
Arrange a small restore with the authorised administrator into a separate safe destination. Check that files open and that the expected versions are present. Don't delete live data or overwrite working files to create a test.
Cloud storage needs attention too. The NCSC advises keeping an independent copy of critical cloud data. File synchronisation and version history alone may not cover the recovery you need. Record what was tested and its limits. Recovering one folder doesn't prove that every system can be restored.
Make the maintenance record short enough to use
For each check, keep:
- The service or device covered.
- The date and person completing the check.
- What they actually verified and a reference to the evidence.
- Any unresolved issue, its owner and its target date.
- The next check or event that should trigger a review.
"Backup checked" is hard to act on. "Tuesday's payroll backup completed, test files restored to the approved test location, older versions not tested" tells the next person much more.
Review overdue actions with someone who can approve time or spending. If a problem cannot be fixed immediately, record the temporary precautions and who accepted the remaining risk. Keep that decision under review rather than allowing an exception to become permanent by accident.
Start with the next week: name the owner and deputy, agree how urgent alerts reach them, and choose the first check you can verify. A modest routine that people complete is a useful foundation for keeping the rest of the work moving.