Cyber Essentials for a 10-30 Person Business: The Minimum Viable Security Baseline

If your company has 10 to 30 staff and no IT department, your minimum viable security baseline is five things: know what you own, control who can reach it, keep it patched, back it up, and write down what you will do on the day something goes wrong. That is not a beginner's simplification — it is essentially the structure of the Cyber Security Agency of Singapore's Cyber Essentials mark. A small business that genuinely does those five things is ahead of most of its peers. The work is measured in weeks, not quarters, and the majority of it is configuration you have already paid for inside Microsoft 365 or Google Workspace and never switched on.

What does ‘Cyber Essentials level’ actually mean for an SME?

Cyber Essentials is CSA's entry-tier certification, designed for organisations that are starting out on cybersecurity and have limited in-house expertise. The tier above it, Cyber Trust, is risk-based and aimed at larger or more digitalised organisations. For a 20-person firm, Cyber Essentials is the correct ceiling, not a stepping stone you should feel embarrassed about.

The mark organises controls into five groups, and the plain-English version is worth memorising because it doubles as an agenda for your next management meeting:

• Assets — you have a list of your people, hardware, software and data.
• Secure — malware protection, access control and sensible default configuration.
• Update — software and firmware get patched on a known cadence.
• Backup — essential data is backed up and the restore has been tested.
• Respond — there is an incident response plan that a non-technical person can execute.

Certification itself is optional and is done through CSA-approved certification bodies. Plenty of SMEs implement the controls without ever paying for the audit. The certificate matters when a customer, insurer or government buyer asks for evidence; the controls matter regardless.

Which controls should a small team do first?

Order matters, because attention is your scarcest resource. Start with access, because compromised credentials are the most common way small Singapore businesses actually get hurt — not sophisticated intrusion, but someone's email password being reused on a breached third-party site.

Multi-factor authentication on every account that touches email, finance or customer data. This is free in both major productivity suites. Enforce it, do not merely offer it. If you do only one thing from this article, do this one.

An asset list. A single spreadsheet with four tabs: staff and what they can access, company devices and who holds them, software and cloud services you pay for, and where customer data lives. Most SMEs discover during this exercise that two ex-employees still have active accounts and that nobody knows who administers the CRM. That discovery alone justifies the afternoon.

Administrator hygiene. Nobody should do daily work from an account with admin rights. The owner's account is usually the worst offender, because it accumulated every permission over ten years and is also the account most likely to be phished.

Backups you have actually restored. A backup nobody has tested is a belief, not a control. Pick one file and one mailbox each quarter and restore them. Note the date in the asset spreadsheet. That note is also your audit evidence if you later certify.

Patching on a calendar. Enable automatic updates on laptops and phones, and set one recurring monthly slot to check the things that do not auto-update — the office router, the NAS, the CCTV recorder, the accounting server nobody has logged into since 2023.

What does this cost a 20-person company?

Less than most owners expect, because the expensive part is not software. MFA, conditional access, device encryption and basic logging are included in the business-tier licences you almost certainly already hold. The real costs are three:

Time. Budget roughly two to three days of concentrated work to build the asset register, tighten accounts and document the response plan, then a half-day per quarter to maintain it.

Backup and endpoint tooling. Expect a modest per-user monthly figure for proper cloud-to-cloud backup and managed endpoint protection, on the order of a few tens of dollars per user per month depending on vendor and coverage.

Certification, if you pursue it. This is a four-figure engagement with an approved certification body, plus preparation effort. Check whether current SME digitalisation support schemes offset part of it before you commit, as programme scope changes from year to year.

Compare that against the downside. A ransomware event that encrypts your shared drive during a quotation-heavy month does not just cost the ransom you should not pay; it costs the fortnight of revenue you cannot invoice because nobody can find the job files.

How does this connect to your PDPA obligations?

Directly. The PDPA's Protection Obligation requires reasonable security arrangements to protect personal data in your possession, and the Data Breach Notification Obligation requires you to assess and, where the breach is notifiable, inform the PDPC and affected individuals within defined timeframes. You cannot assess a breach you cannot see, and you cannot notify within a deadline if you spend the first four days working out which system was involved.

Cyber Essentials' asset register and incident response plan are, in practice, the operational half of PDPA compliance. Your data protection officer's policy documents describe what should happen; these five controls determine whether it can. Firms that treat the two as separate projects end up doing both badly.

What should you do in the next 30 days?

Pick three deadlines and put them in the calendar now, before Q4 volume absorbs everything. Week one: enforce MFA across all staff accounts and disable every account belonging to someone who has left. Week two: build the asset spreadsheet and identify the single person accountable for each system — this also surfaces the key-person risk that bites during December leave. Week three: confirm backups are running, restore one file to prove it, and write a one-page incident response plan naming who calls whom, in what order, with which phone numbers.

That is a baseline a 20-person company can hold without an IT department. Anything more sophisticated built on top of a missing foundation is decoration.

Frequently asked questions

Is the Cyber Essentials mark mandatory for Singapore SMEs?

No. It is a voluntary certification. However, an increasing number of larger customers and government-linked buyers ask about security posture during vendor onboarding, and the mark is the cheapest credible answer. The underlying controls are effectively mandatory in substance, because PDPA's Protection Obligation requires reasonable security arrangements whether or not you hold a certificate.

We use Microsoft 365 — isn't our data already backed up?

Not in the way most owners assume. Microsoft and Google operate on a shared responsibility model: they guarantee the platform, you remain responsible for your data. Retention windows for deleted items are limited, and neither protects you from a staff member deleting a folder in March that you need in September. Third-party cloud-to-cloud backup closes that gap and is inexpensive at SME scale.

How long does implementation take without hiring anyone?

For a 10-30 person business with straightforward systems, two to three focused days of work spread across three or four weeks is realistic, plus a recurring half-day each quarter. The constraint is almost never technical difficulty — it is getting one accountable person to own the list and hold the calendar slots.

Digital Perpetual helps Singapore SMEs put this baseline in place without an IT hire. If you want a second pair of eyes on where your data actually sits, that conversation takes about thirty minutes.