Cybersecurity for small businesses in Saudi Arabia: 10 steps
Small businesses often assume they're not a target, but most attacks are automated and don't pick victims by name. They look for a weak password or an unpatched system. The good news is that most protection is simple and inexpensive.
1. Turn on two-factor login
On email, website admin panels, banking and social accounts. This is the biggest step for the least effort. Use an authenticator app instead of text messages where you can.
2. Use a password manager
A different password for every account, kept in a password manager. And no shared team logins.
3. Keep things updated
Operating systems, browsers and website plugins. Many breaches exploit a flaw that was patched months ago. Turn on automatic updates and remove plugins you don't use.
4. Backups you've actually tested
Back up regularly, and keep one copy separate from your main system so ransomware can't reach it. Most importantly, test restoring it. An untested backup is only a hope.
5. Access limited to what people need
Each employee sees only what they need. When someone leaves, close their accounts the same day. Keep a list of every system so nothing gets missed.
6. Watch for fraud
Most attacks start with a message. Train your team to spot these signs:
- An urgent request to transfer money.
- A supplier's bank details changing by email or WhatsApp.
- A link asking you to log in.
- Someone claiming to be the manager or technical support.
The rule: any change to payment details gets confirmed by a call to a number you already have.
7. Protect your company email
Set up SPF, DKIM and DMARC on your domain so it's harder to impersonate your company, and so your messages reach customers instead of spam.
8. Protect your website
- HTTPS on every page.
- A web application firewall (WAF) for important sites.
- Limits on login attempts.
- Don't store card details yourself. Let the payment gateway handle them.
9. Monitor and log
Turn on new-login alerts and keep access logs for important systems. You can't investigate what wasn't recorded.
10. A one-page incident plan
Who to call, who decides to disconnect systems, and who talks to customers. If personal data is affected, you have 72 hours to notify SDAIA in the cases the law requires, covered in the PDPL checklist.
What about the National Cybersecurity Authority's controls?
The Essential Cybersecurity Controls (ECC) cover government entities and private organisations that own, operate or host critical national infrastructure. Financial institutions follow the Central Bank's framework. If you provide services to these entities, they'll often require you to meet some of these controls in your contract. The controls get updated, so check the Authority's site for what applies to you.
Where to start today
Steps 1, 4 and 6 give you the most protection for the least time. Start on them this week.
If your company uses AI tools, read how to use AI safely.
Want a security review of your site or systems? Get in touch.