Cyber security guidance for business
Source: gov.uk (2025-12-03)

Guidance to help businesses and organisations improve online security and protect against cyber threats.

All organisations should take urgent action to protect themselves online

You can take some simple steps to protect your business against online security threats. Having good cyber security measures in place will help protect your cashflow, your customer data and your reputation.

A full range of guidance and support can be found on the National Cyber Security Centre website (https://www.ncsc.gov.uk/). Some of the key pieces of advice are outlined below.

Don’t delay - take action to protect your business now.

Get the basics right

Stop! Think Fraud (https://stopthinkfraud.campaign.gov.uk/) offers simple advice to help small businesses and citizens stay safe online.

Cyber Action Toolkit (https://cybertoolkit.service.ncsc.gov.uk/?utm_source=DSIT&utm_medium=Email&utm_campaign=PublicBeta) offers sole traders & small businesses clear, bite-sized actions to protect your business’s money and reputation from cyber criminals.

Check your cyber security (https://checkcybersecurity.service.ncsc.gov.uk/?utm_source=hmg&utm_medium=cycs&utm_campaign=CA23) is a new tool to quickly check and fix for vulnerabilities in your IT.

Free Online Training - Top Tips for Staff (https://www.ncsc.gov.uk/training/top-tips-for-staff-scorm-v2/scormcontent/index.html#/) This newly updated online learning module helps you and your staff understand why cyber security is important and shows how to take practical steps to protect against fraud and cyber crime. It’s totally free, easy-to-use and takes less than 30 minutes to complete. Further background information on this training can be found on the NCSC website (https://www.ncsc.gov.uk/blog-post/ncsc-cyber-security-training-for-staff-now-available).

Small Business Guide to Response and Recovery (https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery) helps small to medium sized organisations prepare their response to, and plan their recovery from, a cyber incident.

Home and remote working (https://www.ncsc.gov.uk/guidance/home-working) Prepare your organisation and staff for secure working from home and remote working.

Get a Cyber Essentials certificate

Cyber Essentials (https://www.cyberessentials.ncsc.gov.uk/) protects your business against the most common online threats. A Cyber Essentials certificate demonstrates to customers your business takes this issue seriously and also enables you to apply for government contracts. Organisations with a Cyber Essentials certificate are 92% less likely to make a claim on their cyber insurance.

Cyber Advisors (https://iasme.co.uk/cyber-advisor/) can provide your business with government-approved cyber security advice and help you work towards a Cyber Essentials certificate. Small and medium sized businesses can currently get a free 30-minute cyber security session with a Cyber Advisor.

Get free online training for you and your staff

Cyber security training for businesses (https://www.gov.uk/government/collections/cyber-security-training-for-business) This page details a range of free e-learning courses to help businesses and staff protect themselves online.

Cyber Governance Training (https://www.ncsc.gov.uk/cyber-governance-for-boards/training) is a free package from the National Cyber Security Centre to help boards and directors manage their digital risks.

Introduction to Cyber Security (https://www.futurelearn.com/courses/introduction-to-cyber-security) This course developed with the Open University and FutureLearn offers a comprehensive introduction to cyber security and how to protect your digital life online. Anyone with an interest can take part. Study is around two hours per week over eight weeks.

Report cyber crime and online fraud

Action Fraud (http://www.actionfraud.police.uk/) is the UK’s national fraud and internet crime reporting centre. Use the online tool to report online fraud or cyber crime to the police.

Report a cyber security incident (https://report.ncsc.gov.uk/) to the National Cyber Security Centre using this online reporting tool.

Where to report a cyber incident (https://www.gov.uk/guidance/where-to-report-a-cyber-incident): if you’re not sure where to report a cyber incident, use this tool to find out.

Ask for help

24/7 live cyber reporting for businesses (https://www.actionfraud.police.uk/campaign/24-7-live-cyber-reporting-for-businesses) - If you are a business, charity or other organisation which is currently suffering a live cyber attack (in progress), please call xx-xxxx-xxxx immediately.

Cyber Resilience Centres (https://nationalcrcgroup.co.uk/regional-centres/) are based around the country in nine regions to provide free and affordable, high-quality cyber resilience help and services to smaller organisations in their locality.

Find IT and cyber security companies in the UK (https://cyberexchange.uk.net/database/) This directory lists UK cyber security companies by name, by services or by products so you can find the help you need.

Cyber Advisors (https://iasme.co.uk/cyber-advisor/) can provide your business with government-approved cyber security advice and help you work towards a Cyber Essentials certificate. You can also book a free 30 minute free consultation (https://iasme.co.uk/cyber-advisor/free-advice).

Certified Cyber Consultancy (https://www.ncsc.gov.uk/scheme/certified-cyber-consultancy) helps larger organisations get the right cyber security consultancy services to protect their information and do business online safely.

Advice for larger businesses

The Cyber Governance Code of Practice (https://www.gov.uk/government/publications/cyber-governance-code-of-practice) shows boards and directors how to manage digital risks and protect their business from cyber attacks.

Cyber Governance Training (https://www.ncsc.gov.uk/cyber-governance-for-boards/training) is a free package from the National Cyber Security Centre to help boards govern cyber risks with confidence.

The Board Toolkit (https://www.ncsc.gov.uk/collection/board-toolkit) is a new set of resources designed to encourage essential cyber security discussions between the Board and their technical experts. Board members don’t need to be technical experts, but they need to know enough about cyber security to be able to have a fluent conversation with their experts, and understand the right questions to ask.

The 10 Steps to Cyber Security (https://www.ncsc.gov.uk/collection/10-steps) shows larger businesses and organisations how to put a comprehensive cyber security risk management plan in place. This guidance is recommended by Government for all larger organisations operating online.

Protecting against ransomware (https://www.ncsc.gov.uk/ransomware). Ransomware is the key current cyber threat facing facing businesses and organisations. Make sure you’re protected by using the NCSC guidance on ransomware (https://www.ncsc.gov.uk/ransomware).

Protect against ransomware in your supply chain (https://www.gov.uk/government/publications/supply-chain-resilience-against-ransomware). This guidance helps organisations build resilience into their supply chains, reducing the likelihood and impact of ransomware incidents.

Cyber Assessment Framework (https://www.ncsc.gov.uk/collection/caf/cyber-assessment-framework) provides cyber security guidance for organisations responsible for vitally important services and activities.

Early Warning System (https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning) - sign up to free alerts from the NCSC to warn you if malicious cyber activity is targeting your organisation’s IP address.

Get specialised cyber security guidance

Cyber insurance (https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance): this guide from the NCSC sets out what organisations should think about when considering buying cyber insurance.

Software Security Code of Practice (https://www.gov.uk/government/publications/software-security-code-of-practice) sets out the cyber security standards which software developers and vendors should follow.

AI Cyber Security Code of Practice (https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice) sets out the measures AI developers should use to address the cyber security risks to artificial intelligence (AI) systems.

The National Cyber Security Centre (https://www.ncsc.gov.uk/guidance) offers a wide range of useful guides on all areas of cyber security including password guidance, Bring Your Own Device (BYOD) and network encryption, as well as advice on how to deal with issues such as phishing, social engineering, patch management, denial of service (DoS) attacks and cloud computing security.