16 min
Creating an IT Security Concept: A Guide for SMEs
An IT security concept is mandatory for SMEs in 2026. Step-by-step guide with risk analysis, protective measures, emergency plan, and cost overview.
Read moreSix building blocks that fit together
Security doesn't come from a single product but from several layers. You don't have to implement everything at once – but each layer should fit the next.
Firewall & endpoints
The first layer: whatever comes from outside is filtered. Whatever runs on your devices is monitored and kept up to date.
- Firewall selection and clean configuration
- Antivirus and endpoint detection on every device
- Automatic updates for systems and applications
- Separate networks for guests, printers and smart devices
Access & identities
Most attacks start with a stolen password. So we define who may access what – and how.
- Multi-factor authentication and passkeys
- A password manager for the whole team
- Permissions on a need-to-know basis
- Orderly onboarding and offboarding of staff
Backup & emergency plan
If something happens anyway, the backup decides between standstill and carrying on.
- Automatic backups following the 3-2-1 rule
- Regular restore tests instead of hope
- Recovery plan with clear responsibilities
- Backups that a ransomware trojan cannot reach
Awareness & training
Technology catches a lot, but not everything. Your team recognises phishing once it knows what to look for.
- Short sessions instead of hour-long lectures
- Phishing examples from a real inbox
- Clear reporting paths when something looks off
- Refreshers at sensible intervals
Data protection technology
The technical measures the GDPR requires – documented so you can demonstrate them to customers and authorities.
- Encryption of devices and connections
- Logging and access control
- Deletion concept and retention periods
- Documentation of technical measures (TOMs)
Monitoring & operations
Security isn't a project with an end date. We keep an eye on updates, alerts and anomalies.
- Monitoring of systems and backups
- Patch management without disrupting the working day
- Regular security review
- Reports in plain language, not jargon
EUData and backups in European data centres
6Building blocks – implement them individually or together
How you know it's time
None of these points is a reason to panic. Together they are a good reason to take a closer look.
One password for everything
The same password for email, shop and bank – and no second factor anywhere.
Backup? Somewhere on the hard drive
There is a backup, but nobody has ever tried to restore it.
Everyone can access everything
Trainee and managing director have the same rights to every folder.
Suspicious emails end up in the team chat
Staff aren't sure whether an email is genuine – and ask a colleague instead of IT.
Updates get dismissed
Because there's no time right now. For months.
Customers or insurers are asking
An IT security questionnaire is on the table and nobody knows what to answer.
How we proceed
Not a blanket overhaul, but a sequence that fits your risk and your budget.
01
Assessment
We look at what's there: devices, access, backups, contracts. Just the facts first, no judgement.
02
Priorities
We sort by risk and effort. Whatever delivers a lot for little effort comes first.
03
Implementation
Step by step while you keep working. Every change is explained and documented.
04
Operations
Updates, monitoring and refreshers – so today's state still holds next year.
Further reading
Three articles from our blog that go deeper into the most important topics.
14 min
Recognizing Phishing: 10 Signs of Dangerous Emails
Phishing emails keep getting more sophisticated. 10 concrete signs to spot dangerous emails – plus technical protection for businesses.
Read more13 min
Backup Strategies 2026: The 3-2-1-1-0 Anti-Ransomware Rule
The classic 3-2-1 rule is no longer enough. Learn how immutable backups and the extended 3-2-1-1-0 strategy protect against modern ransomware.
Read moreFrequently asked questions about IT security
Related
What builds on security
These services build directly on the topic of this page — not a standard bundle, just the sensible next step.
Ongoing IT support
One named contact, monitoring and maintenance instead of firefighting.
Security only holds if someone looks after it continuously.
Learn moreNetwork & Wi-Fi
A stable company network, clean Wi-Fi and separate guest access.
A cleanly segmented network is the basis for every firewall rule.
Learn moreWorkplace & devices
Laptops, desktops and accessories – set up, secured and ready to use.
Secured devices from day one instead of retrofitting.
Learn more