If you have read up on where the cyber risk sits for a trade business, you already know the shape of the problem. The business runs from a phone, the invoices are the target, and a lost device or a reused password can open the door. Knowing the risk and doing something about it are two different things, and most owners get stuck on the second part because it is never obvious what to do first.
This is the practical follow-up. A 90-day plan that takes a trade business from knowing the gaps to actually closing them, in the order that gets the biggest protection for the least disruption. None of it requires you to become technical, and most of it uses tools you are already paying for.
The First 30 Days: Lock the Front Doors
The first month is about the two controls that stop the attacks that actually hit trade businesses. Start with multi-factor authentication on email and your core accounts. If a password leaks, and they leak constantly in breaches of unrelated websites, MFA means a stolen password alone gets nobody in. Turn it on for email first, then your accounting and job management apps.
Alongside that, deal with passwords. If the same password runs your email, your banking, and your apps, a single leak hands over the lot. A password manager fixes this without you having to remember anything, and it pairs with MFA to take the easiest path off the table for an attacker.
Then put one habit in place that no software can replace: if a supplier or customer asks to change bank details, you confirm it by phone to a number you already hold, never by replying to the email. That single rule blocks most invoice fraud, which is the most expensive thing that happens to trade businesses online.
Days 30 to 60: Protect the Devices
With the accounts secured, the second month is about the device the business actually runs on. The honest question is simple: if your phone was lost or stolen on site tomorrow, could someone open it and reach your job app, your contacts, your quotes, and your banking?
Closing this gap is quick. A proper screen lock and device encryption mean a lost phone is not an open door. The ability to remotely wipe a missing device means a theft is an inconvenience, not a breach. If staff use their own phones for work, the same baseline needs to travel with those devices too, because a personal phone with the job app on it is now part of your business.
This is also the month to tidy up who can reach what. Trade businesses turn over subbies and casual staff constantly, and the access that never gets removed is the gap that bites later. A login a former worker still has is a quiet way in months after they left. Grant access by role, keep a simple list of who has what, and switch it off promptly when someone moves on.
Days 60 to 90: Make Recovery a Certainty
The final month is about the day something goes wrong anyway, because no set of controls is perfect and the goal is to significantly reduce risk, not to pretend it disappears. Two controls decide whether a bad day is a few hours or a few weeks.
The first is patching. Most break-ins use a known flaw that already had a fix available, so keeping your systems and apps updated closes those doors before anyone walks through. “Auto-update is on” is not the same as managed, so the aim is knowing it is actually happening, not assuming.
The second is backups. Most trade businesses have never thought about it because the data lives in apps and on the phone and it all just works, until a phone dies or an app account gets locked. You need to know where your important data lives, that a second copy exists somewhere safe, and that at least one copy is protected so an attacker cannot delete or encrypt it. A backup nobody has restored from is a guess, so a test restore is the part that proves it.
Where This Plan Comes From
This 90-day baseline is not something we invented. It lines up with Essential Eight, the standard set of controls published by the Australian Cyber Security Centre. MFA, passwords, device protection, access control, patching, backups. You do not need to learn the framework. You need the handful of controls behind it switched on and kept on.
For a trade business, this is rarely a big or expensive project. It is a sequence of settings and habits that take the target off your back. The hard part is knowing exactly where you stand today, which is what an audit gives you before you spend a dollar fixing the wrong thing.
Take the free IT Maturity Assessment to see where your business sits, then close the gaps in order.
