Cybersecurity is no longer an optional investment reserved for large companies. Accelerated digitalisation since Covid, tighter regulation (Law 09-08 in Morocco, NIS2 in Europe) and increasingly sophisticated attacks require every SME to have a minimum level of protection. This guide sets out the 10 actions to deploy, ranked by priority and sized for SME budgets.
Multi-factor authentication on email, ERP, online banking and VPN. Microsoft Authenticator and Google Authenticator are free and can be rolled out in a day. This measure alone blocks 99% of compromised-password attacks (Microsoft Security Report, 2025).
Three copies, on two different media, with one copy off site (encrypted cloud). Restores must be tested every month — an untested backup is not a backup. It is the only credible insurance against ransomware.
Windows, Linux, routers, business applications. 80% of successful attacks exploit known flaws that vendors have already patched. Turning on automatic updates is the simplest and cheapest measure of all.
Separate the guest network, the internal network and critical servers. A FortiGate or pfSense (open-source) firewall for SMEs costs between MAD 5,000 and 15,000 — a trivial investment compared with the cost of an intrusion.
90% of attacks start with a phishing email. Two-hour sessions every quarter, with phishing simulations, turn the weakest link (people) into the first line of defence.
At least 14 characters, unique to each service. Deploy Bitwarden (open source, free) or 1Password. Banning passwords on sticky notes or in shared Excel files is not a detail — it is a documented attack vector.
These three protocols stop people impersonating you by email (spoofing). Free to set up, they protect your reputation and your customers from phishing campaigns that spoof your domain.
OpenVAS or Nessus Essentials (free for up to 16 IPs) find flaws before attackers do. An automated monthly scan turns your security posture from reactive to proactive.
A 2-3 page document that answers the essential questions: who does what in an attack? Isolation procedure, emergency numbers, crisis communication, notification of the data-protection authority. This simple but structured document can cut response time by 70%.
A record of processing activities, a DPO (even part time), documented consent and a procedure to notify the data-protection authority within 72 hours. Beyond legal compliance, it is a selling point in large companies' tenders.
WEVAL works in France, Belgium, the Netherlands, Germany, Sweden, Spain, Italy, the United Kingdom, the United States, Morocco, Tunisia and Egypt. The approach described here applies everywhere; the regulatory framework, however, changes from one country to the next:
In Europe, the NIS2 directive also extends cybersecurity obligations to many medium-sized companies. The figures quoted in this article relate to Morocco.
Need a security audit tailored to your SME?
Our consultants carry out a full cybersecurity assessment in 5 working days.
Request a cybersecurity audit →