Introduction

Small and medium-sized businesses (SMBs) in South Africa face growing cyber threats: phishing, ransomware, stolen credentials and non-compliance with POPIA. Many attacks exploit basic gaps rather than sophisticated zero-day flaws. This checklist gives practical, prioritised steps that South African SMBs can apply immediately to reduce risk, protect customer data and keep operations running. RandTech IT brings experience resolving urgent incidents quickly — use this as a working guide and contact us if you need hands-on help.

1. Establish basic cyber hygiene

Cyber hygiene is the foundation. These measures are low cost and high impact.

Use strong, unique passwords and a password manager

Ensure all employees use strong passwords and unique credentials for work accounts. A business-grade password manager makes this manageable and enables secure sharing of logins.

Enable multi-factor authentication (MFA)

MFA should be enabled on email, cloud services, VPNs and remote admin tools. Even SMS-based MFA is better than none, but consider authenticator apps or hardware tokens for higher-risk accounts.

Keep software and devices updated

Apply operating system and application updates promptly. Configure Windows Update and macOS updates to install automatically, and patch network devices and printers.

2. Protect email and communications

Email is the most common attack vector for SMBs. Focus on prevention and detection.

Train staff to recognise phishing

Run short, regular awareness sessions and simulated phishing exercises. Teach employees to verify payment requests, check sender addresses and avoid clicking unexpected links or attachments.

Deploy email filtering and anti-spam

Use a reputable email gateway or cloud email security service to block malicious attachments and links. For Microsoft 365 users, enable Exchange Online Protection and Advanced Threat Protection if possible.

3. Secure endpoints and networks

Devices and networks are obvious targets. Implement layered controls.

Install and manage endpoint security

Use centrally managed antivirus/EDR (endpoint detection and response) on all desktops and laptops. Ensure it is configured to update signatures and report incidents to IT.

Segment your network

Separate guest Wi-Fi from corporate networks. Use VLANs to restrict access between departments and sensitive systems like accounting or servers.

Use secure Wi-Fi and strong router settings

Change default router credentials, use WPA3 or at minimum WPA2-PSK strong passphrases, and keep firmware current. For remote workers, consider company VPNs rather than open remote desktop exposure.

4. Backup and recovery

Backups are essential. Treat them as the last line of defence against ransomware and data loss.

Implement the 3-2-1 backup rule

• Keep at least three copies of important data
• Store them on two different media (on-site NAS and cloud)
• Keep one copy off-site or immutable (cloud archive or air-gapped)

Test restores regularly

Backups are only useful if you can restore. Schedule quarterly restore tests for critical systems and ensure recovery time objectives are realistic for your business.

5. Limit access and manage privileges

Restricting who can access what reduces the blast radius of an incident.

Apply the principle of least privilege

Users should have only the access needed to do their jobs. Regularly review permissions for file shares, cloud apps and admin accounts.

Separate administrator accounts

Admins should have distinct accounts for admin tasks and daily email/use. Monitor and audit privileged account activity.

6. Prepare policies and incident plans

Written policies and tested plans enable a faster, more organised response when things go wrong.

Create clear IT and security policies

Document acceptable use, remote work, device management and password rules. Make policies easy to find and enforce consistently.

Develop an incident response plan

Define who to contact, containment steps, backup access and communication templates. Include local partners (IT, legal, PR) and contact details for RandTech IT for rapid support if needed.

7. Comply with POPIA and protect customer data

POPIA sets expectations for lawful processing and safeguarding of personal information. Compliance reduces legal and reputational risk.

Map personal data and justify processing

Identify what personal data you hold, why you hold it and how long you retain it. Limit collection to what you need.

Secure data in transit and at rest

Use TLS/HTTPS for websites and email where appropriate. Encrypt backups and sensitive databases. Maintain records of processing activities.

8. Consider managed security services

Many SMBs benefit from outsourcing specialised security tasks to experienced providers.

What managed services can help

• Managed detection and response (MDR) for continuous threat monitoring
• Patch management and software lifecycle services
• Backup as a Service (BaaS) with tested restores
• Security assessments and vulnerability scans

Managed services translate into predictable costs and access to experienced engineers who resolve incidents quickly rather than learning on your time.

9. Practical roadmap for the next 90 days

1. Week 1–2: Enforce MFA, update critical systems and change default passwords.
2. Week 3–4: Enable business password manager, deploy endpoint protection and configure email filtering.
3. Month 2: Implement regular backups, segment networks and run staff phishing training.
4. Month 3: Review access rights, finalise incident response and test restores.

FAQ

How much will basic cybersecurity cost for a small business?

Costs vary by size and complexity. Many baseline protections (MFA, software updates, basic email filtering) are low cost. Managed services and advanced monitoring increase monthly spend but can be more cost-effective than dealing with an incident.

Does POPIA require full encryption of all data?

POPIA does not mandate specific technologies but requires appropriate security measures. Encryption is commonly recommended for protecting sensitive personal information.

Can I handle cybersecurity in-house?

Some basic measures can be managed internally if you have skilled staff. For continuous monitoring, rapid incident response and complex threats, partnering with a managed security provider gives access to experienced engineers.

What should I do if I suspect a breach?

Contain the incident (disconnect affected devices), preserve logs and ask employees to change credentials. Contact your IT provider immediately to investigate and start recovery steps.

How often should we run security training?

Short refresher sessions and phishing simulations every quarter are effective. Reinforce with concise tips and real-world examples relevant to your team.

Conclusion

Small-business cybersecurity in South Africa is achievable with practical, prioritised steps: enforce MFA, maintain updates, secure backups, train staff and consider managed services for specialist tasks. RandTech IT focuses on fast resolution by experienced engineers, helping clients reduce risk without lengthy learning curves on their time.

If you want a tailored cybersecurity checklist, an on-site assessment in Johannesburg/Gauteng or managed protection for your business systems, contact RandTech IT for practical, experienced assistance.