Cyber security for UAE SMEs: a practical 12-point checklist

Most small and mid-sized businesses in the UAE assume they’re too small to be a target. Attackers don’t see it that way. Phishing emails, password attacks and ransomware are largely automated: they hit thousands of companies at once and exploit whoever has left a door open.

The good news is that a handful of basic controls block the vast majority of these attacks. This checklist is written for business owners and office managers, not security specialists. Work through it in order.

The threats UAE businesses face most

• Phishing: fake emails and messages that steal passwords or install malware, often pretending to be Microsoft, a courier, a bank or a government service.
• Business email compromise: an attacker takes over or imitates an email account and sends a “change of bank details” request on a real invoice. These scams can cost a business a large payment in a single email.
• WhatsApp and phone impersonation: messages that appear to come from the CEO or a supplier asking for urgent transfers or gift cards.
• Ransomware: malware that encrypts your files and demands payment, often after quietly stealing data first.
• Account takeover: reused or weak passwords leaked in someone else’s breach and tried against your email, banking and cloud accounts.

The 12-point checklist

1. Turn on multi-factor authentication everywhere

Enable MFA on email (Microsoft 365 or Google Workspace), banking, accounting software, social media, domain registrar and any admin panel. Prefer an authenticator app or passkeys over SMS codes. This one step stops most account takeovers.

2. Use a password manager

Give every staff member a business password manager so they can use long, unique passwords without remembering them. Ban password reuse between work and personal accounts.

3. Keep everything updated

Turn on automatic updates for Windows, macOS, phones, browsers and business software. Replace devices and firewalls that no longer receive security updates. Unpatched systems are one of the most common ways in.

4. Protect every device

Install modern endpoint protection (EDR) on every laptop and desktop, enable disk encryption (BitLocker or FileVault), and set screens to lock automatically. Manage company phones and laptops centrally so you can wipe them if they’re lost.

5. Back up the right way

Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy offline or immutable so ransomware can’t reach it. Back up Microsoft 365 or Google Workspace too, since their built-in retention isn’t a full backup. Test a restore every quarter.

6. Secure your email

Set up SPF, DKIM and DMARC on your domain so attackers can’t easily send email pretending to be you. Use advanced email filtering, and add a warning banner to emails from outside the company.

7. Verify every payment change

Make it a firm rule: any request to change bank details or make an urgent payment is confirmed by phone, using a number you already have on file, never one from the email or message. This single process prevents most invoice fraud.

8. Limit admin access

Staff should use standard accounts for daily work. Keep administrator accounts separate, few in number and protected with strong MFA. Remove access promptly when people leave or change roles.

9. Secure your network and Wi-Fi

Use a business-grade firewall, change default passwords on routers and devices, separate guest Wi-Fi from the office network, and use a secure remote access solution instead of exposing remote desktop to the internet.

10. Train your team

Run short security awareness sessions and simulated phishing tests a few times a year. Make it easy and blame-free to report a suspicious message. Your team is your best early warning system.

11. Know your data protection duties

Map what personal data you collect (customers, staff, website forms), where it’s stored and who can access it. In the UAE:

• Most onshore businesses fall under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
• DIFC and ADGM companies follow their own data protection regimes.
• Healthcare, financial services and some other sectors have additional requirements, including rules on where data is stored.

Publish a clear privacy policy, collect only what you need and take legal advice where you’re unsure.

12. Write a one-page incident plan

Decide now, not during a crisis:

• Who makes decisions, and who calls your IT or security provider, bank, insurer and lawyer.
• How to isolate infected devices and which accounts to lock.
• How you’ll keep working: backups, spare devices, offline contact lists.
• Who needs to be informed, including any regulator or affected customers.

Keep a printed copy. If your systems are encrypted, you won’t be able to open the file.

Quick self-assessment

Answer yes or no:

• MFA is on for every email and admin account.
• We use a password manager.
• Devices update automatically and have endpoint protection.
• We have an offline or immutable backup and tested a restore this quarter.
• SPF, DKIM and DMARC are configured on our domain.
• Payment changes are always verified by phone.
• Staff had security training in the last six months.
• We have a written incident plan.

Every “no” is a priority.

Getting help

Many SMEs don’t have a full-time IT security person, and that’s fine. A managed IT services provider can run updates, backups, endpoint protection and monitoring for a predictable monthly fee, while a security assessment shows where your real risks are.

Our cyber security services in Dubai include assessments, Microsoft 365 hardening, email security, endpoint protection, backup and incident response for businesses across the UAE. As certified partners of vendors including Microsoft, Cisco and Acronis, we can help you pick tools that fit your size and budget. Book a free security review.