SME Cybersecurity Guide: A Baseline Package for My 10 to 100 Person Company

Companies with 10 to 100 employees form the backbone of the Turkish economy. In the eyes of cyber attackers, however, that size represents an appealing target. These firms lack the security budgets of large enterprises, yet they hold both customer data and a gateway into the supply chains of major brands. According to the guidance ENISA publishes for small and medium sized enterprises, SMEs have now become the primary target group for ransomware operators (source: ENISA SME Cybersecurity).

In this article, as the DSET team based at Hacettepe Teknokent in Ankara, we share what a baseline package should contain, distilled from working hands on with dozens of SMEs in the field. We will start with a clear, actionable framework that does not require investing in expensive enterprise licenses.

Why an SME Is Such an Attractive Target

The attacker's logic is simple: maximize the return on investment. Breaking into a large bank requires a custom operation that can take months. By contrast, the perimeter of a 50 person accounting firm or a supplier manufacturer often consists of an email server left on default settings, an unpatched VPN appliance, and a shared Excel folder with no MFA. For a detailed map of the waves of attacks seen across Turkey throughout 2026, see our pillar article: Turkey's Cyber Threat Landscape 2026.

Two main reasons push SMEs to the front of the line.

The first is the easy prey factor. CISA's Cyber Essentials guide notes that more than sixty percent of small businesses fail to implement at least two of the five basic controls (MFA, backup, patching, endpoint protection, secure configuration) (source: CISA Cybersecurity Best Practices). Bots running automated scans detect these missing doors within seconds.

The second is the supply chain gateway role. When a large holding company cannot be breached directly, the attacker targets its small software provider, accounting firm, or logistics partner. Once inside, they pivot to the parent company through the trusted partner channel. That is why security clauses in your vendor contracts are no longer just about compliance, they are a matter of commercial health. We have tracked through USOM bulletins how a significant share of the major data leaks in Turkey over the past two years originated from the poorly configured servers of small integrator firms.

A third factor is the changing business model. The hybrid work patterns that took hold after the pandemic turned laptops outside the office and personal phones into natural extensions of the company network. Most SMEs still build security on an "office wall" mindset, yet data now travels to the cafe, the home, and the customer's office in another city. This new reality means the zero trust approach is no longer solely an enterprise concern.

Choosing a Framework: NIST CSF 2.0 plus CIS Controls IG1

Rather than inventing a control list from scratch, leaning on internationally accepted frameworks is the fastest route. For SMEs there are two main references.

NIST CSF 2.0, in its version refreshed in 2024, added a brand new function called GOVERN. This function is essentially homework tailored for the SME: it demands written answers to questions such as who is responsible, which risk is being accepted, and what exactly we are signing in our contracts (source: NIST Cybersecurity Framework). Its six pillars, Identify, Protect, Detect, Respond, Recover, and Govern, translate comfortably for ease of reporting.

CIS Controls v8 is the model that best captures the reality of a small company. It offers three Implementation Groups (source: CIS Controls):

• IG1: Basic cyber hygiene. Sufficient for a small business. Contains 56 safeguards.
• IG2: Mid sized companies under regulatory pressure.
• IG3: Large enterprise structures and national critical infrastructure.

The goal for a 10 to 100 person company should be to complete IG1. A jump to IG2 is not mandatory unless customer contracts demand it. This streamlined approach both protects the budget and lets you speak clearly during an audit.

NIST CSF and CIS Controls are not alternatives to each other, they are complementary. CSF answers the "what should I do" question in the language of governance and risk, while CIS Controls gives the technical team a practical list for "in what order, and how do I measure it." Using CSF language when presenting to the board and CIS language when assigning tasks to the IT team makes communication smoother.

A 10 Point Minimum Security Baseline

The ten items below form a list drawn from our incident response experience in the field, with the order of implementation already tested. If an SME follows this order, it will meaningfully shrink its attack surface within the first three months.

1. MFA (Multi Factor Authentication)

The first move should always be MFA. According to combined data from Microsoft, Google, and CISA, MFA stops ninety nine percent of automated credential attempts. Microsoft 365 administrator accounts, banking portals, remote desktop access, and code repositories are the priority scope. Where possible, prefer an authenticator app or a FIDO2 key over SMS.

2. Patch Management

The vast majority of attacks come not through zero days but through vulnerabilities left unpatched for months. Build a monthly schedule for Windows, Office, browsers, VPN appliances, and NAS firmware. Microsoft Intune comes inside Microsoft 365 Business Premium for small companies and automates patch deployment alongside device inventory.

3. The 3-2-1 Backup Rule

Three copies, two different media types, with at least one copy offline or in a separate location. The single variable that determines recovery time after a ransomware attack is the quality of your backups. Because the backup infrastructure itself is an attack target, it requires separate credentials and MFA. For a detailed guide on the first steps in a ransomware scenario: The First 24 Hours After Ransomware.

4. EDR or Modern Endpoint Protection

Classic antivirus works on a signature basis, so it cannot keep up with next generation attackers. EDR (Endpoint Detection and Response) performs behavioral analysis and records anomalous process launches, privilege escalation, and suspicious network traffic in real time. For an article where we cover the difference in detail: EDR vs Antivirus: Modern Company Protection. The Microsoft 365 Business Premium subscription includes Defender for Endpoint Plan 1, a good starting point for an SME.

5. Email Security: SPF, DKIM, DMARC

Phishing is still the starting point of eighty percent of attacks. Fully defining SPF, DKIM, and DMARC records on your domain stops the bulk of spoofed mail traffic at the doorstep. Defender for Office 365, which comes with Microsoft 365 Business Premium, checks phishing links in real time and opens suspicious attachments in a sandbox. For phishing recognition on the user side: How to Recognize a Phishing Email.

6. Network Segmentation

Keep the office Wi-Fi, the guest Wi-Fi, and the production or accounting servers on different VLANs. If an attacker who gets inside cannot perform lateral movement, the damage stays limited to a single device. For a small company, entry level appliances from Ubiquiti, Mikrotik, or Fortinet are sufficient. Never give the guest network access to the company file server.

7. Vendor Risk Management

What security standard do your accounting software provider, cloud backup firm, and web agency follow? Prepare a short question list before signing a contract: incident notification time, country of data residency, use of subcontractors, and ISO 27001 or equivalent certification status. For an article where we detail how the ISO 27001 process works: What Is ISO 27001 Certification and How Do You Get It.

8. Employee Training

Technical controls cannot fully close the human weakness. Hold short, scenario based training sessions at least twice a year. Thirty minutes is enough in duration, and the content should cover current phishing examples, deepfake phone fraud, and the risk of plugging in a USB device. After training, run a simulation campaign and measure the real click rate.

9. Incident Response Playbook

A single page document that answers the "who were we supposed to call now" question in the middle of an attack is the cheapest investment that gets you out of a ransomware crisis. The essentials inside the playbook: the USOM notification line, the legal advisor's phone number, the cyber insurance policy number, the backup operator's emergency contact, and the calendar for the KVKK 72 hour breach notification window. For USOM directives and current alerts: USOM.

10. KVKK Compliance

Every company operating in Turkey holds the status of data controller under the KVKK (Turkish data protection law). VERBIS registration, explicit consent texts, a data inventory, a retention and disposal policy, and a breach notification procedure must all be in writing. Official source: KVKK. For the end to end process: KVKK Compliance Consulting.

The order of these ten items matters. Many SMEs buy EDR and go live without setting up MFA first, which is like installing an alarm system and leaving the door open. Not breaking the order, and not moving to the next item before ticking off each one, is critical for budget efficiency.

Microsoft 365 Business Premium: Broad Coverage Under a Single License

At SME scale, license confusion eats the budget. Microsoft 365 Business Premium bundles productivity and security tools under a single subscription (source: Microsoft 365 Business Premium). The pieces critical for an SME within the package are these:

• Defender for Endpoint Plan 1: Behavioral endpoint protection, automated investigation and response.
• Conditional Access: Conditionally blocking access coming from an external IP, an unmanaged device, or a risky sign in score.
• Intune MDM: Management of company devices and BYOD phones, password policy, remote wipe.
• Defender for Office 365 (Plan 1): Safe Links, Safe Attachments, phishing protection.
• Azure AD Premium P1: MFA, conditional access, self service password reset, audit logs.

The approximate monthly cost per employee, when totaled separately, comes to a third of the cost of buying these tools individually. For a 25 person company, the single decision to move to this subscription resolves six of the ten items above in one go.

Cyber Insurance and an External MDR Retainer Alternative

At the point where the budget does not stretch to technical controls, a financial transfer mechanism comes into play. There are two complementary options for an SME.

A cyber insurance policy can cover items such as ransom payments, business interruption, legal costs, defense against KVKK penalties, and crisis communication. In Turkey, companies such as Allianz, Anadolu, and AXA offer SME policies. The limit you take ranges from 250,000 TL to 5 million TL. Before issuing a policy, the insurer typically asks about basic controls (MFA, backup, EDR), so having already done the technical baseline lowers the premium.

An external MDR retainer (a Managed Detection and Response contract) is a smart model for companies that cannot maintain a 24/7 SOC. In exchange for a fixed monthly retainer, a response team springs into action within minutes when an incident occurs. If no attack happens, the cost is low; if one does, it guarantees rapid recovery.

You do not need to take both; depending on budget, the pairing of cyber insurance plus a well configured Microsoft 365 is enough for many SMEs as a first priority.

KAOS: An Accessible Alternative for SMEs with a Homegrown AI Engine

KAOS, the homegrown artificial intelligence engine we developed at DSET, is designed for companies that want continuous security assessment at SME scale without paying enterprise penetration testing fees. Unlike a classic annual penetration test, KAOS:

• Periodically scans your external footprint and catches a newly opened port, a certificate change, or a default login screen at midnight.
• Monitors vendor domains as well, providing early warning against supply chain surprises.
• Presents its findings in a Turkish annotated report, in language an SME manager can understand.
• When a critical finding emerges, prepares an automatic USOM/KVKK compliant incident record draft.

The fact that it is a homegrown engine, meaning data is not carried abroad and there is no time zone problem in technical support, is especially critical for SMEs that take on public sector work. A KAOS subscription stays far below the cost of building a separate technical team, and it produces reports in a format directly aligned with the VERBIS breach process.

Implementation Roadmap: The First 90 Days

Based on our field experience, SMEs get stuck most often when they try to do everything at once. The three month plan below offers a realistic starting point.

Days 0 to 30: MFA mandatory on all administrator accounts, the Microsoft 365 Business Premium subscription active, the 3-2-1 backup verified, USOM and KVKK contact details written into the playbook.

Days 30 to 60: Device enrollment completed with Intune, Conditional Access policies live, Defender for Endpoint reporting across all endpoints, the first employee training session done.

Days 60 to 90: Network segmentation applied, the vendor questionnaire sent, the cyber insurance policy signed, the first incident drill (a tabletop exercise) carried out, and KVKK policies put in writing.

By the end of 90 days you will have checked off more than eighty percent of the CIS Controls IG1 list. From this point on, the goal is continuous improvement: an annual drill, quarterly scanning, and an annual independent assessment.

The most frequently skipped step in the roadmap is the tabletop exercise. It takes an hour, costs nothing, yet it forces answers to questions such as who picks up which phone, who tests the backup, and who approves the press release, all before a real crisis. We strongly recommend this exercise to SME owners, and repeating it twice a year keeps the playbook alive.

Conclusion and Contact

SME cybersecurity is not a scaled down version of enterprise security. It requires its own prioritization, budget discipline, and a streamlined framework. When the ten point baseline built on NIST CSF 2.0 and CIS Controls IG1, the coverage Microsoft 365 Business Premium provides under a single license, cyber insurance, and the continuous monitoring layer of the KAOS homegrown AI engine come together, a 10 to 100 person company stops being a target and becomes a waste of time for the attacker.

The DSET team is based at Hacettepe Teknokent in Ankara. Our SME package brings together the turnkey rollout of the ten items above, a KAOS continuous monitoring subscription, three months of coaching, and an annual drill service in a single contract.

You can reach us to arrange a discovery call tailored to your company: +90 536 662 38 09. The first assessment call is free, and a budget and priority map will be in your hands within two business days.