Cybersecurity for Small Business: The Minimum You Need to Do Today

Why Small Businesses in Uzbekistan Are in the Crosshairs

According to Kaspersky Lab, Uzbekistan has become one of the most targeted countries since the beginning of 2023. The reason is simple: the market is growing fast, digitalization is moving quickly, and data protection culture is still lagging behind.

Important context: In March 2026, the President of Uzbekistan signed the Cybersecurity Strategy for 2026–2030. From April 1, 2026, government agencies are required to establish cybersecurity departments. Businesses are not yet required to — but businesses bear the majority of the damage.

Three Reasons Small Businesses Ignore Security

"We're too small to be attacked"

Wrong. Hackers don't attack by size — they attack by vulnerability. Automated scripts simultaneously scan thousands of websites for common vulnerabilities — and find them at small companies precisely because they don't update or change passwords.

"We have nothing worth stealing"

Every business has customer data, access to bank accounts, partner correspondence, and financial documents. This is worth money on the dark market. Moreover, through an infected computer at a small company, hackers can attack its larger partners.

"It's expensive and complicated"

Basic protection — no. Most actions in this article are either free or cost under $10 per month. The expensive and complex story only begins when corporate infrastructure is being built — that's not what we're talking about here.

Checklist: 9 Steps That Cover 80% of Risks

This is the priority minimum — actions with the highest "protection / time spent" ratio. Start with the first five if you don't have time for everything at once.

What Changed in Legislation: April 2026

From April 1, 2026, government agencies in Uzbekistan are required to have cybersecurity departments. Private businesses are not yet required — but:

• If your business handles personal customer data — you are responsible for its safety
• If you work with government agencies as a contractor — cybersecurity requirements for you will tighten
• The Cybersecurity Strategy 2026–2030 plans to extend requirements to critical information infrastructure entities — including fintech, telecom, healthcare, and retail

If You Get Hacked Anyway: Action Plan

Even with basic protection, incidents happen. It's important to know what to do in the first few hours — that's what determines the scale of the damage.

1. Isolate the infected device — disconnect from the network, do not turn off (data may be needed for investigation)
2. Change passwords — from a clean device, starting with email and bank accounts
3. Notify your bank — if financial data was on the compromised device
4. Restore from backup — this is exactly why backup is item #4 on the checklist
5. Contact the Cybersecurity Center of Uzbekistan — UZCERT accepts incident reports
6. Analyze the cause — weak password? Clicked a link? Outdated plugin? Eliminate the entry point

When the Basic Minimum Isn't Enough

The checklist above covers typical risks for a company of up to 20 people without complex IT infrastructure. You need a professional security audit if:

• You store personal client data — passport details, medical records, financial information
• You have a corporate server or your own database
• Your product is an IT system: an app, web service, or SaaS
• You integrate with banks or payment systems (Click, Payme, Humo)
• You work with government agencies as a contractor or data provider

In these cases, you don't need a checklist — you need a full penetration test and architecture audit.

Conclusion

In Uzbekistan in 2025, cyberattacks caused 2 trillion soums in damage to businesses. Detection rate — 8%. Most of these losses could have been prevented with basic measures.

No IT department needed. No big budget needed. Three things are required: enable two-factor authentication, stop using one password for everything, and set up automatic backups. This can be done today — literally in an hour.

Everything else — follow the checklist above. Step by step.