Cyber security
The security basics that stop most attacks.
Most attacks on small New Zealand businesses are not sophisticated. They are a reused password, a fake invoice email, a laptop that missed its updates or a backup nobody had tested. The National Cyber Security Centre keeps coming back to the same short list of basics that stop most of them. We put those basics in place for you, keep them working, and include them in every managed plan.
The controls that matter most
The NCSC's guidance for New Zealand organisations comes down to a handful of habits: update software quickly, require multi-factor sign-in, give people only the access they need, keep backups an attacker can't reach, record what happens on your systems, and know what you would do if something went wrong.
None of them is expensive, and together they block the attacks that actually hit small businesses. Every managed plan includes them as standard.
Your obligations under the Privacy Act 2020
If you hold personal information about clients or staff, the Privacy Act 2020 requires you to protect it with reasonable security safeguards. If a privacy breach is likely to cause someone serious harm, you must tell the Privacy Commissioner and the people affected as soon as practicable.
For a small business, reasonable safeguards means the basics above. Having them in place, and being able to show it, is what protects you if something does happen.
Email is where most attacks start
Fake invoices, changed bank details and lookalike sign-in pages arrive by email. Mail filtering, warnings on messages from outside senders, and a simple habit of phoning to confirm any change of bank account stop most of them. Short, practical training for staff a few times a year does the rest.
When something goes wrong
Every managed plan comes with a one-page incident plan: who to call, what to switch off, how to restore from backup, and when the Privacy Act requires you to report. If the worst happens, you follow a plan instead of making one up.
Questions people ask
Before you get in touch
- We are a small business. Are we really a target?
- Not personally, and that is the problem: attacks are automated and aimed at everyone. Small businesses are hit because they are easier, and an invoice fraud or ransomware attack costs as much to recover from with five staff as with fifty.
- What should we do first?
- Turn on multi-factor sign-in for email and for anything that touches money. It is free, takes an afternoon, and stops most account takeovers.
- Do we need cyber insurance?
- It is worth considering. Insurers now ask whether you have multi-factor sign-in, backups and updates in place, and the baseline in every managed plan lets you answer yes.
- Do we have to report a breach?
- Under the Privacy Act 2020, if a privacy breach is likely to cause someone serious harm, you must notify the Privacy Commissioner and the people affected as soon as practicable. We can help you work out what happened and gather what a report needs. The decision to notify is yours.
- Can you check how secure we are now?
- Yes. The free IT health check covers security, and you get the gaps in plain English, in the order to fix them.
Next step
Start with a free IT health check.
Give us an hour, on site or on a call, and we'll give you a one-page report with the five things worth fixing first. No obligation.
Managed IT