Digital Security Made Simple

Start with the basics

Good digital security comes from a few habits that everyone can follow. Use a unique password for every account, turn on multi-factor authentication (MFA), keep sensitive files in approved business systems and give people only the access they need.

Protect your accounts

Stolen, guessed and reused passwords can put business accounts at risk. Three habits make a difference:

1. Use unique passwords. Never reuse a password across work or personal accounts.

2. Use an approved password manager. Let it create, store and securely share passwords.

3. Use stronger sign-in methods. Choose a passkey, security key or authenticator app wherever available.

Do

• Use a unique password for every account.

• Use a long master passphrase for your password manager.

• Protect email, banking, cloud storage and administrator accounts first.

• Store recovery codes somewhere safe and separate.

• Report unexpected login alerts immediately.

Don't

• Reuse passwords or make small variations of the same one.

• Use names, birthdays, pets or company details as passwords.

• Save passwords in spreadsheets, emails or chat messages.

• Share a password when secure sharing is available.

• Approve an MFA prompt you did not request.

If you remember one thing: Give your email account a strong, unique password and protect it with MFA. Email can be used to reset access to many other accounts.

Protect sensitive information

Customer records, contracts, identification documents, employee details, financial data and confidential business files all need careful handling. Keep them in centrally managed business systems rather than scattered across inboxes, personal devices and messaging apps.

Do

• Collect only the information the business genuinely needs.

• Use approved storage with access controls.

• Give each person only the access required for their role.

• Share files with named people and set expiry dates where appropriate.

• Encrypt laptops, removable drives and sensitive transfers.

• Delete or anonymise information when it is no longer needed.

Don't

• Keep sensitive files in personal cloud drives or personal email.

• Send confidential information through ordinary chat messages.

• Create public links that anyone can open.

• Download unnecessary local copies.

• Keep information forever in case it becomes useful.

• Store payment-card details when a secure payment provider can handle them.

A simple test: If a file were forwarded to the wrong person, could it cause harm or embarrassment? If so, store and share it through an approved secure system.

Make protection part of the working day

Security works best when safe behaviour is routine, simple and supported by the systems your team already uses.

Keep devices updated

Turn on automatic updates for computers, phones, browsers and business software.

Lock and encrypt

Use screen locks, device encryption and remote wiping on portable equipment.

Limit access

Give people individual accounts and remove access promptly when roles or employment change.

Verify unusual requests

Confirm payment changes and urgent requests through a second, trusted channel.

Back up important data

Use automatic, protected backups and regularly check that files can be restored.

Make reporting easy

Encourage staff to report mistakes, suspicious emails and unexpected prompts quickly.

If something goes wrong

Act quickly. Do not hide the mistake or try to solve it alone.

1. Stop: Pause the transfer or disconnect the affected device.

2. Report: Tell the responsible person immediately.

3. Secure: Change exposed passwords and block access.

4. Recover: Restore clean data and record what happened.

Make the secure choice the easy choice.

The source guide lists the UK National Cyber Security Centre, NIST and the UK Information Commissioner's Office as its guidance basis.