In our work with SMEs, we see the same mistakes again and again – across different industries, different company sizes, different regions. The mistakes aren't technically complex. They're human, organisational, and sometimes shockingly simple.
The insidious part: these mistakes go unnoticed until it's too late. No alarm, no warning sign. Only when the damage is done does it become clear what could have been prevented.
Mistake 1: The backup that was never tested
There are two kinds of backups: those that work – and those you believe will work. The difference only becomes apparent when you need them.
The sobering reality: in more than half the companies we accompany through security reviews, there are regular backups – but no documented proof that a full restore has ever been successfully completed. A backup that has never been tested is not a backup. It's a hope.
The second part of this mistake: backups that are accessible from the same network as the production systems. In a ransomware attack, the backups are encrypted first – then everything else.
What you can do today:
1. When was a complete restore from backup last carried out?
2. Is at least one backup copy offline or air-gapped (no network access)?
3. Is there a written backup concept with defined RPO/RTO targets?
If you can't answer any of these: that is your most urgent issue.
Mistake 2: Admin accounts without MFA – the open back door
Multi-factor authentication (MFA) is one of the most effective and cost-efficient security measures a company can implement. Microsoft estimates that MFA blocks 99.9% of all password-based attacks.
And yet: in a surprisingly large number of companies, system administrators, cloud admins and privileged accounts have no MFA. The justification is almost always the same: 'It's too inconvenient' or 'We trust our people.'
Trust has nothing to do with it. If an admin password is stolen through phishing – and that happens every day in Switzerland – without MFA the entire IT infrastructure is compromised. With MFA, it's a blocked attack attempt.
Mistake 3: Suppliers with data access and no contract
Who maintains your accounting software? Who has remote access to your servers? Which cloud provider stores your customer data? In most SMEs, there are answers to these questions. But to the follow-up – 'Do you have a confidentiality agreement and a data processing agreement with that provider?' – there is often silence.
This is not just a security problem. It's a legal one. Under the Swiss DPA (and the GDPR), you as a company are responsible for the data of your customers and employees – even if that data is held with a service provider. Without a Data Processing Agreement (DPA), you are liable for your provider's violations.
- Every service provider with access to personal data needs a DPA
- Every external party with system access needs an NDA
- Critical suppliers should be regularly assessed on their security practices
Mistake 4: Policies that don't exist – or that nobody knows
'We have an IT security policy' – we hear this often. What we typically find is one of three scenarios: no document, either a 60-page document that hasn't been updated since it was created. Or a document that exists but has never been read or signed by any employee.
A policy that isn't communicated, lived and enforced has no legal or security value. Worse: it creates a false sense of security.
What policies must achieve: short enough to be read. Clear enough to be understood. Binding enough to be enforced. And demonstrably communicated – with employee signatures.
Mistake 5: 'IT handles it' as a security concept
Information security is not a technical task. It is a leadership task. When the IT manager is simultaneously responsible for networking, helpdesk, software rollouts and information security, security will always be the last thing that gets attention – until something happens.
The absence of a dedicated security function means:
- No systematic risk management
- No defined incident response processes
- No regular reporting to the board
- No strategic planning – only reactive firefighting
The solution doesn't have to be an expensive full-time role. Many SMEs today use CISO-as-a-Service models, where experienced security experts take on the function on a mandate basis – with the necessary expertise, without the full-time overhead.
The honest self-assessment
Do we have
- ever fully tested the backup (priority: critical)?
- any admin accounts without MFA (priority: critical)?
- any suppliers without DPA/NDA (priority: high)?
- failed to communicate the policies (priority: high)?
- no dedicated security function (priority: middle to high)?
If you answer 'Yes' or 'I don’t know' to two or more of these points: you’re not alone. And there’s a clear next step.
In the next blog:
Blog 4: ISO 27001 in practice – what you really can expect
We explain what the standard actually requires – without marketing promises.
→ Your Next Step
Do you recognise yourself in one or more of these mistakes? A security review will show you in three days where your biggest risks lie – and how to address them. Contact us: security@centriq.ch