A practical cybersecurity checklist for Hong Kong SMEs

Most successful attacks on small and mid-sized businesses don't involve anything clever. They use a reused password, an unpatched server, or an email that looked like it came from the boss. The good news is that a short list of basics blocks most of them. Here's the list we start with.

The ten basics

1. 1Turn on multi-factor authentication (MFA) for email, cloud consoles, banking, and every admin account. App-based or hardware keys are stronger than SMS codes.
2. 2Use a password manager for the whole team, so no one reuses passwords or keeps them in a spreadsheet.
3. 3Keep software updated. Turn on automatic updates for laptops and phones, and patch servers and website plugins on a schedule.
4. 4Back up important data, keep at least one copy offline or immutable, and test a restore. A backup you've never restored is a hope, not a plan.
5. 5Give people only the access they need, and remove it the day they leave. Shared admin accounts make both of these impossible.
6. 6Protect email: set up SPF, DKIM, and DMARC for your domain so attackers can't easily send mail pretending to be you.
7. 7Train staff to spot phishing, and make it easy and blame-free to report a suspicious email.
8. 8Encrypt laptops and phones, and make sure you can lock or wipe a lost device remotely.
9. 9Keep a list of your systems and vendors — what data each one holds, and who has access. You can't protect what you don't know you have.
10. 10Write a one-page incident plan: who to call, how to isolate a device, and how you'll talk to customers if something goes wrong.

Hong Kong rules worth knowing

The Personal Data (Privacy) Ordinance (PDPO) applies to any business in Hong Kong that collects personal data — customer details, staff records, even a mailing list. It's built around six Data Protection Principles. Principle 4 requires you to take practicable steps to protect personal data from unauthorized or accidental access, processing, loss, or use. The regulator is the Office of the Privacy Commissioner for Personal Data (PCPD), which publishes practical guidance on data security and breach handling.

If you operate in a critical sector — such as banking, telecoms, energy, or transport — check whether you fall under the Protection of Critical Infrastructures (Computer Systems) Ordinance, which places specific security obligations on designated operators. Rules change, so confirm current requirements with a legal advisor.

Where to start this week

If you only do three things, turn on MFA everywhere, set up a password manager, and test a backup restore. Together they block or soften the most common ways small businesses get hurt — and none of them needs a big budget.