National Cybersecurity
Association of Ukraine

Cyber preparedness minimum for NGOs and SMEs.

For small organisations without a security team. Ten items on one printable page: backups, a second login step, updates, staff awareness and a plan for when something goes wrong.

Guide G7 · updated

Why these ten items

The UK NCSC's small-business guide (reviewed on 21 July 2026) centres on backups, protecting devices and accounts, and spotting scams. Many of the steps take about five minutes, and security is not one person's job 1 2.

The ten items

  1. 1Backups. Make them regularly, keep at least one offline copy, and test that a restore works. CISA advises restoring from offline, encrypted backups 3.
  2. 2A second login step wherever it matters, starting with email 4. See the guide “Protecting your accounts and digital identity”.
  3. 3Updates. Patch internet-facing systems first, and check CISA's Known Exploited Vulnerabilities (KEV) catalogue for what you run. KEV is one input to prioritisation, not the only one 5.
  4. 4Admin accounts: keep few, keep them separate from daily accounts, and protect them with a second login step.
  5. 5Scam spotting. Give staff a short briefing and agree how scams are reported 2.
  6. 6Money rule: confirm any change of payment details by callback (see the guide “Voice clones and fake calls”).
  7. 7AI tools rule: decide what may go into AI tools, because sensitive data can leak through model output 8. See the guide “AI security checklist for small organisations”.
  8. 8Incident contacts card: CERT-UA 6, the Cyber Police 7, your bank and your IT provider. Take current contact details from the official sites.
  9. 9Incident basics: isolate, preserve logs, report, restore from backups and write down the lessons 3. Decide in advance who does what.
  10. 10Practise once a year: run a 30-minute tabletop exercise on an incident scenario.

Notes

  • CERT-UA advises organisations to make contact in advance, because without prior contact the process may take longer. It is not a punitive body 6.
  • Data-protection basics are covered in the Digital Rights and Privacy section.

Limits

This is a guide, not legal advice and not a service. NAK cannot assess your systems, restore data or investigate an incident. This text was last checked on 22 Oct 2026; the sources used are listed below.

Sources

  1. 1UK National Cyber Security Centre (NCSC). Small business guide: cyber security · accessed 2026-10-22
  2. 2UK National Cyber Security Centre (NCSC). Phishing and scams: guidance for individuals and small businesses · accessed 2026-10-22
  3. 3CISA. #StopRansomware guide · accessed 2026-10-22
  4. 4CISA, Secure Our World. Turn on multifactor authentication · accessed 2026-10-22
  5. 5CISA. Known Exploited Vulnerabilities catalog · accessed 2026-10-22
  6. 6Cabinet of Ministers of Ukraine. How CERT-UA responds to cyber incidents, from report to recovery · accessed 2026-10-22
  7. 7Cyber Police Department, National Police of Ukraine. Cyber Police: incident form and appeals · accessed 2026-10-22
  8. 8OWASP GenAI Security Project. LLM02:2025 Sensitive Information Disclosure · accessed 2026-10-22

Read next.