IT tips for SMBs
IT security for SMBs: the basics that actually reduce risk
A former employee’s account that’s still active, a lost laptop or a fake Microsoft 365 notice can be enough to ruin a day. Yet IT security for SMBs doesn’t have to start with a heavy project. The best first steps are often well known, affordable and easy to verify.
IT security for SMBs: start with access
Email is a good starting point because it often opens the door to other tools. Turn on multi-factor authentication for mailboxes, administrator accounts, remote access and financial applications. A stolen password then becomes less useful on its own. Also plan a recovery method that isn’t tied to one person’s personal phone.
Next, reduce the number of administrator accounts. The business owner doesn’t need a powerful account to read email or prepare a quote. Keep a regular account for daily work and a separate account for technical changes. This small separation limits the damage if a session is compromised.
Finally, make a simple list: who has access to what, and why? Shared accounts with no owner, old generic mailboxes and access granted “temporarily” to a vendor tend to stick around. A quarterly review of this list beats a perfect inventory that never gets updated.
Back up to restore, not to check a box
A useful backup has to survive whatever hits the original data. If the same account can delete the production folder and all its copies, the risk remains. Keep at least one copy separate, limit deletion rights and document how long data is kept. Think about files, but also about the application data employees need to bill or serve clients.
The test matters as much as the copy. Pick a supplier folder, an accounting document and a few emails, then ask for a restore to a temporary location. Note how long it takes, what’s missing and who knows how to start the procedure. This is often when you discover that a folder wasn’t included or that failure alerts were going to a mailbox nobody checks.
Repeat this test after a major change: a migration, a new server, a SharePoint reorganization or the departure of the person who managed the backups. The useful question isn’t “Do we have a backup?” but “Can we recover the right item without improvising?”
Treat updates as an operational routine
Updates become risky when they’re put off for months, then installed all at once in a rush. Keep a reasonable inventory of workstations, servers, firewalls, access points and important applications. It doesn’t need to list every cable; it should tell you which equipment is no longer supported and who is responsible for it.
Set a regular window for patches and leave room for urgent updates. Before a sensitive change, check the backup and decide how you’ll roll back. For workstations, restarting at the right time keeps employees from putting off an update for weeks because it interrupts their day.
Also watch for forgotten devices: an old laptop in a meeting room, a camera installed by a subcontractor or an access point that no longer shows up on the management dashboard. A short, up-to-date inventory helps more than an expensive tool full of outdated data.
Close access when people leave and keep vendors in check
An employee’s departure should trigger a checklist shared by operations and IT. Disable the account, sign out open sessions, collect the device, transfer the files that matter and change shared codes. Do it at an agreed time, especially for a sensitive departure. Waiting for someone to remember the account a few days later leaves a needless grey area.
Apply the same principle to vendors. Give each one named access, limited to the system required and the length of the engagement. If an outside technician needs to work on the firewall, they don’t automatically need access to the team’s files. When the engagement ends, close the access instead of just filing their name away.
A one-page procedure is enough to get started. Write down the person responsible, the systems to check and the proof expected. The goal isn’t to slow down HR: it’s to make sure a technical detail doesn’t depend on one person’s memory.
Turn the basics into monthly checks
To make progress without spreading the budget too thin, choose an internal owner and five simple indicators: MFA turned on for priority accounts, a known list of administrator accounts, error-free backups, a recent restore test and patches applied. Add departures and vendor access to the agenda when there are any. Fifteen minutes a month can be enough to stay on top of it.
Our IT expertise page outlines the areas that can be reviewed together, from networking to cloud services. The goal isn’t to buy everything at once. Start with what could interrupt operations, expose data or prevent a restore, then handle the rest in a realistic order.
This week
Turn on MFA for email and confirm the list of administrator accounts.
This month
Restore a real folder to a temporary location and note the result.
At the next departure
Use a shared checklist for accounts, devices, files and vendor access.
Choose the next action, not an endless list
If you want to confirm the priorities for your SMB IT security, Infotech Canada can review access, backups and equipment with you. A short meeting helps you choose the first checks without turning everything into a major project. You can also write to us if you’d rather summarize the situation first.