Why a short checklist helps
Most small businesses do not have an IT department. Technology is looked after by whoever is most comfortable with it, often alongside a full-time job doing something else. That works until a laptop is lost, an employee leaves with access to everything, or a file disappears and nobody knows whether a copy exists.
Small business IT does not need to be complicated. It mostly comes down to knowing what you have, controlling who can reach it, keeping copies, keeping things updated, and knowing who to call. The sections below cover each of those in turn, and the other guides in this section go deeper on the larger topics.
1. Know what devices you have
Start with a simple list. A spreadsheet is enough. For each device, record:
- What it is (laptop, phone, tablet, printer, router, server)
- Who uses it
- When it was bought, and roughly when you expect to replace it
- Whether it is owned by the business or by the employee
Include the less obvious equipment, such as the office router, network storage and printers. These are often forgotten until they fail or become a security weak spot.
Basic settings are worth checking on every device: a screen lock with a PIN or password, disk encryption where the device supports it, and automatic updates turned on. Rules for personal phones and laptops used for work are a separate topic, and worth settling in writing before the first employee asks.
2. Keep a clear list of accounts
Every business accumulates accounts: email, accounting, payroll, website hosting, domain registration, social media, supplier portals. Write down what exists, who administers each one and who else has access.
A few habits make this far easier to manage:
- Use individual logins for each person rather than one shared password.
- Make sure at least two trusted people can reach the critical accounts, such as the domain and the main email administrator account. If the one person who holds everything is unavailable, you do not want to be locked out.
- Store passwords in a password manager rather than in a notebook or a shared document.
- Turn on two-factor authentication for email, banking, accounting and anything that holds customer data.
Email deserves special attention. Most other accounts can be reset through it, so whoever controls the email account can often take over the rest.
3. Back up what you cannot afford to lose
Decide which data matters: customer records, financial files, contracts, photos, the website. Then make sure it exists in more than one place. A good backup strategy keeps several copies, on different kinds of storage, with at least one away from your main site.
The key habit is testing. A backup you have never tried to restore is a hope rather than a plan. Pick a date each quarter to restore a few files and confirm they open.
4. Keep software updated
Updates fix security problems that criminals actively look for. Turn on automatic software updates for operating systems, browsers and business applications where you can. For equipment that cannot update itself, such as an older router, set a reminder to check for new firmware. Retire anything that no longer receives updates from its maker.
5. Put basic protection in place
No single product protects a business. Layers work better:
- A firewall (usually built into the router and the operating system) controls what traffic gets in.
- Antivirus or endpoint protection helps catch malicious files on each device.
- A careful team recognizes phishing emails and odd payment requests before they cause damage.
The last point matters more than many owners expect. Many incidents start with a person being tricked rather than with a technical flaw, which is why short, regular security awareness training is usually a better use of time than a long annual session. A written password policy, even half a page long, also gives everyone the same expectations.
6. Decide where your systems live
Some businesses run a server in a back room. Others rent capacity from a provider and use cloud computing for email, files and accounting. Neither is automatically better. Hosting options depend on your budget, your staff’s skills and how much downtime you can tolerate, so it is worth choosing deliberately rather than by default.
7. Plan for things going wrong
Two short documents are worth having, even if they are one page each:
- A basic incident response plan: who to tell, who decides, and what to do first when you suspect a problem such as a compromised account or a lost laptop.
- A disaster recovery outline: which systems matter most and how long the business could manage without each.
You do not need to predict every scenario. The point is that people know what to do at 4:45 on a Friday afternoon without making it up as they go.
8. Handle people joining and leaving
New staff need accounts, devices and a clear explanation of the rules. Departing staff need all of that reversed promptly. Staff offboarding is one of the most commonly missed parts of small business IT, and it is easy to fix with a short checklist.
9. Know who to call for help
Decide in advance where technical help comes from. Options include a capable colleague with set hours, a local IT contractor, a managed service provider, or the support lines of the services you use. Write down contact details, account numbers and what each person or company is responsible for.
If you rely on one person, make sure their knowledge is written down. Passwords, network settings and renewal dates should not live only in one head.
A reasonable order of work
If everything feels urgent, a sensible sequence is:
- Secure email and other key accounts, with two-factor authentication.
- Set up and test backups.
- Turn on automatic updates.
- Build the device and account lists.
- Write the short plans and the offboarding checklist.
Doing these well will not make a business immune to problems, but it usually makes problems smaller, quicker to spot and easier to recover from.