IT security for small businesses: what really matters

Why are small businesses hit?

In its IT security report, the BSI (Germany’s Federal Office for Information Security) names small and mid-sized businesses as one of the three main target groups of attackers, alongside IT service providers and municipalities. They are attacked more often than their share would suggest. The reason is rarely that they are especially interesting. They are simply easier to break into: no IT department of their own, old passwords, untested backups.

Which attacks are the most common?

• Ransomware: Data is encrypted and a ransom is demanded for its release. According to the BSI, one of the two biggest threats to businesses.
• Phishing and CEO fraud: fake emails, invoices or calls, increasingly using AI and deepfakes.
• Stolen credentials: one reused password is enough to get into an email account or the cloud.
• Attacks via service providers: anyone with access to your systems can also become an entry point.

What protects the most?

You don’t have to do everything at once. These basics have the biggest effect:

1. Two-factor authentication (MFA) for email, cloud, banking and all admin accounts.
2. Automatic updates for operating systems, programs, routers and your website.
3. Backups following the 3-2-1 rule: three copies, two storage locations, one of them offline. And test regularly that restoring works.
4. Tidy up access rights: Everyone gets only what they need. Lock the accounts of former employees immediately.
5. A password manager instead of notes on paper and the same password everywhere.
6. Train your staff: recognise phishing, report suspicious emails, always confirm payment changes by phone.
7. An emergency plan: Who is responsible, whom do we call, which systems matter most? One page is enough to start.

What does NIS2 mean for my company?

The law implementing the NIS 2 directive came into force on 6 December 2025. It generally affects companies with more than 50 employees or more than €10 million in annual revenue that operate in one of the listed sectors, for example manufacturing, food, waste management, postal and courier services or digital services. Companies must check for themselves whether they are covered, and then register with the BSI.

The obligations include risk management (for example encryption and two-factor authentication), reporting duties for incidents and training for management. Even companies that are not covered often notice NIS2 indirectly: large customers increasingly ask their suppliers for proof.

How do I find out where I stand?

For small companies without their own IT department there is the CyberRisikoCheck according to DIN SPEC 27076, developed with the BSI. In an interview, 27 requirements from six topic areas are covered. Afterwards you receive a report with a risk assessment and a list of the most important measures.

A simple inventory is also a good start: Which devices, programs and accounts exist, who has access to what, where is the important data?

What does IT security cost, and who pays?

The basics are cheap: two-factor authentication and automatic updates often cost nothing, a password manager and a backup service a few euros per person per month. The emergency is more expensive: downtime, recovery, lost orders.

For larger security projects there is funding, for example through the KfW digitalisation loan: for IT security there is an additional grant.

How do we work at Kosmo Team?

• In the IT-Check we review security and GDPR at a basic level: accounts, access rights, backups, updates.
• We implement the most important measures in the order with the biggest effect.
• Our partner trains your team to handle phishing.
• For companies subject to NIS2 and for funding applications, we plan projects so that the requirements are documented.