Most IT disasters we get called to were preventable, and the prevention was boring. This checklist covers the things that actually cause the emergencies. Work through it once a quarter.
Backups
- Do you have one? Being on Microsoft 365 or Google Workspace is not a backup. Those protect against their own hardware failing, not against someone deleting a folder or ransomware encrypting it.
- Have you tested restoring from it? An untested backup is a hope, not a plan. Restore one file. It takes five minutes.
- Is a copy somewhere else? If your backup drive sits next to the computer it backs up, a fire or a theft takes both.
Accounts and access
- Is multi-factor authentication on for email? This single control stops the overwhelming majority of account takeovers. Turn it on for every account, starting with whoever handles invoices.
- Does anyone still have access who has left? Former staff, former contractors, the bookkeeper you stopped using. Check your user list.
- Are passwords reused across accounts? One breach elsewhere becomes a breach of yours. A password manager solves this properly.
- Does everyone use their own login? Shared logins mean you cannot tell who did what, and you cannot remove one person’s access.
- Can someone spoof your domain? Without SPF, DKIM and DMARC records, anyone can send email that appears to come from your business. Clients get invoices that are not yours.
- Do staff know what a payment-redirection scam looks like? The most expensive attack on Australian small business is not technical. It is an email asking to change bank details.
Devices
- Are updates installed? Not “will be later”. Check.
- Is every device encrypted? A stolen laptop is an inconvenience if encrypted and a data breach if not.
- Is there working anti-malware on everything? Including the machine in the back office nobody uses much.
The business side
- Do you know what you are paying for? Most businesses we review are paying for at least one subscription nobody uses.
- Do you own your domain? Not your former web developer. Check the registrant details.
- Could you keep working if the internet dropped for a day? Knowing the answer is most of the value.
Anything you could not answer confidently is worth looking at. If you would like someone to work through it with you, our free consultation covers exactly this — and you keep the findings whether or not you engage us.