Measuring Cybersecurity Progress in a Small Business
You cannot improve what you do not track. Five simple measures a small business can check monthly to see whether its security is getting better.
CyberWatch AI4 October 2026 · 2 min read
Security work is easy to start and easy to forget. A handful of simple measures, checked monthly, show whether you are improving and where to focus next.
Five measures
| Measure | Target |
|---|---|
| Accounts with two-step verification | All business accounts. See enforcing two-step verification. |
| Devices up to date | All devices within a short window of updates being released. |
| Last successful backup restore test | Within the last three months. See testing backups. |
| Suspicious messages reported | Rising reports is a good sign. See report buttons. |
| Access review completed | Every quarter. See access reviews. |
How to use them
- Record the numbers monthly in a simple table.
- Discuss anything red in a short management meeting.
- Decide one action for the next month.
Avoid vanity numbers. Counting blocked emails says little. Behaviour and controls matter more. See security metrics that mean something.
For more, see our complete guide to small business cybersecurity.
Frequently asked questions
Why measure at all?
Measures show whether changes are working, keep security on the agenda, and help when customers or insurers ask.
How much time does this take?
Around 30 minutes a month once set up.
Who should see the results?
The owner or management team, briefly, with any decisions needed.
Sources
- Cyber Security Toolkit for Boards, UK National Cyber Security Centre
- Cyber Essentials, US Cybersecurity and Infrastructure Security Agency
- Small organisations guide to cyber security, UK National Cyber Security Centre
