The short answer

A small business needs five things done well: business email on its own domain, one account per person with multi-factor sign-in, backups that are tested, security updates that install themselves, and a written list of what you have. Get those right and most of the IT problems small firms face either never happen or are quick to fix.

The essentials every small business should have

  • Business email on your own domain. name@yourcompany.co.uk builds trust, and it keeps your email in your business’s name rather than an individual’s personal account.
  • One account per person, with multi-factor sign-in. Shared logins make it impossible to see who did what or to remove someone cleanly when they leave. Multi-factor sign-in stops most attacks that rely on a stolen password.
  • Backups you have actually tested. A common rule of thumb is 3-2-1: three copies of important data, on two different types of storage, with one kept off site or in a separate cloud account. A backup you have never restored from is a hope, not a backup.
  • Automatic security updates. Windows, macOS, phones, browsers and your router all need updates. Most can install themselves if they are set to.
  • Basic device security. Encrypted laptops, a screen lock, and antivirus or the built-in protection switched on.
  • A simple record of what you have. Which accounts and licences you pay for, who has admin access, and when your domain name renews. This is the list people wish they had when someone leaves.

Cyber Essentials: a useful checklist even if you never certify

Cyber Essentials is a UK government-backed scheme, run with the National Cyber Security Centre, that sets out five basic controls: firewalls, secure configuration, user access control, malware protection and security update management. Some public sector and larger private contracts ask for it.

Even if you never apply for the certificate, those five headings make a good checklist for a small business. The NCSC also publishes a free Small Business Guide that is worth reading.

Remote or on-site? Monthly or one-off?

Remote support suits most problems: email that won’t send, a slow laptop, a locked account. A technician connects with your permission and fixes it while you watch, with no travel time. On-site visits are for jobs that need hands on, such as cabling, a router swap or setting up a new office.

One-off support works if your setup is simple and problems are rare. Monthly support makes sense once you have several people, regular new starters, or data you can’t afford to lose, because someone is looking after updates, backups and security before anything breaks.

Questions to ask any IT support provider

  • What response time will you commit to, and is it in writing?
  • Who owns the admin accounts? (The answer should be: your business.)
  • How do you connect remotely, and do I approve each session?
  • Will you document what you set up, so another provider could take over?
  • What happens to my accounts and data if we stop working together?

Signs you’ve outgrown “whoever is good with computers”

  • Nobody is sure who has the admin password, or it lives with someone who has left.
  • New starters wait days for an email account or a working laptop.
  • Customers say your emails go to their junk folder.
  • You have never checked whether your backups can be restored.
  • The person fixing IT problems is losing hours they should spend on their real job.

If two or more of those sound familiar, it is time for proper support. See IT support for UK small businesses or remote IT support.