A business can keep trading through a slow computer or a temperamental printer. It is much harder to keep operating when staff cannot access email, customer files are encrypted, internet services fail, or the only person who knows the passwords is away. This business technology risks checklist is designed to help small and medium-sized businesses identify the gaps that can turn an ordinary IT issue into costly downtime.
The aim is not to make every business look like a large enterprise. It is to make sensible decisions based on what would genuinely affect your customers, staff, cash flow and reputation. A dental practice, construction company and accounting firm will have different priorities, but each needs to know what could stop work and how it would recover.
Start with the business impact, not the technology
Before reviewing systems, identify the work that cannot stop for long. For some businesses, it is taking bookings and processing payments. For others, it is accessing job management software, patient records, plans, email or phones.
Ask a straightforward question: if this system was unavailable at 10 am on a busy Tuesday, what would happen over the next four hours, the next day and the next week? This gives you a practical way to prioritise risk. A system that is inconvenient can be dealt with differently from one that prevents your team from serving clients or invoicing.
Write down the key systems, who owns them and whether they are cloud-based, on-site or managed by a third party. Include the less obvious services, such as internet, Wi-Fi, phone systems, domain names, website hosting and payment terminals. These are often overlooked until something fails.
Business technology risks checklist
Use the following checks as a working conversation with your manager, internal IT contact or IT provider. You do not need every answer immediately. Unknowns are useful because they show where attention is needed.
1. Accounts, passwords and access
Most security incidents do not start with a Hollywood-style hack. They begin with a compromised password, a convincing email, or an old account that was never removed.
Check whether multi-factor authentication is enabled for Microsoft 365 email, cloud storage, accounting platforms, remote access and other systems holding business data. A password alone is no longer enough protection for these services.
Also review who has access. Staff should have the access required for their role, rather than broad administrator rights by default. When someone leaves, their account, mailbox access, software logins and shared passwords should be removed or transferred promptly. This is particularly relevant where office managers, external bookkeepers or contractors have access to sensitive information.
Avoid shared logins where possible. They make it difficult to see who did what, and create problems when a staff member moves on.
2. Email fraud and cyber security
Email remains a common route for invoice fraud, malicious attachments and account compromise. Technical protection matters, but so do clear processes for staff.
Confirm that email filtering is in place and that suspicious emails can be reported easily. More importantly, establish a verification process for changed bank details, unexpected payment requests and urgent instructions from directors. A phone call to a known number is often enough to stop a costly mistake.
Staff awareness training should be practical and regular, not a once-a-year box-ticking exercise. Your team should know how to pause, check the sender carefully and ask for help without embarrassment. New starters need the same guidance, especially if they handle payments, payroll or customer data.
3. Device health and software updates
Laptops, desktops, mobiles and servers need consistent maintenance. Delayed updates can leave known security weaknesses open for far longer than necessary, while ageing equipment is more likely to fail at an inconvenient time.
Check that operating systems, web browsers, Microsoft 365 applications and security software update automatically or are actively managed. Confirm that every work device has appropriate endpoint protection and that lost laptops can be locked or wiped where necessary.
It is also worth reviewing the age and condition of critical equipment. A five-year-old laptop may still be suitable for general administration, while an old server holding your main line-of-business application could be an unacceptable point of failure. The right replacement cycle depends on the role of the equipment, its performance and available support.
4. Backups that can actually be restored
A backup is only useful if it restores the data you need within a timeframe the business can tolerate. Many businesses assume files in Microsoft 365, a cloud application or a server are automatically protected in every scenario. That assumption needs checking.
Your backup review should answer four questions:
- What data and systems are backed up?
- How often are backups taken?
- Where is the backup stored, and is it protected from ransomware?
- When was a restore last tested successfully?
Include shared files, accounting data, practice or job management systems, email where required, and configuration details for critical systems. If a server failed or files were encrypted, you should know who would restore them, what would be restored first and how long the process would take.
A backup that has never been tested is a plan, not proof.
5. Internet, phones and connectivity
For many Central Coast, Newcastle and Hunter businesses, a connection outage can immediately affect EFTPOS, cloud applications, calls and staff working across sites. Internet risk is not only about speed. It is about reliability, fault ownership and a workable fallback.
Check whether your connection has enough capacity for normal use and peak periods, including video calls, cloud backups and guest Wi-Fi. Separate guest access from your business network so visitors cannot accidentally access devices or files.
Consider what happens if the main connection fails. A 4G or 5G backup may be enough for a small office to continue essential work, although it may not support every activity at full speed. Phone systems should also be reviewed. If calls normally ring through an internet-based service, can they be diverted to mobiles during an outage?
6. Your suppliers and cloud services
Technology risk is often shared with suppliers. Your business may rely on a software vendor, website provider, telecommunications company, payment provider or outsourced payroll platform. If their service is unavailable, your staff may have limited options.
Keep a current register of important suppliers, support contacts, renewal dates and account owners. Make sure business accounts are registered to a company-controlled email address, not a former employee's personal address. Domain names, Microsoft 365 tenancy ownership, mobile accounts and cloud subscriptions are especially important to get right.
Review the terms around data access and export. If you changed systems or a supplier ceased trading, could you retrieve the records you need in a usable format? It depends on the platform, but the question is worth asking before there is pressure to act.
7. Disaster recovery and continuity
Disaster recovery is not limited to floods, fire or major cyber incidents. It can mean a failed server, damaged office, extended power interruption or a key application outage.
Document a short, practical response plan. It should identify who makes decisions, how staff communicate, where they can work, which systems are restored first and how customers will be updated. Keep key contact details available outside the systems that may be unavailable.
Test the plan in a realistic way. For example, ask whether your team could work from another location tomorrow if the office had no power, or whether you could invoice customers if the primary file server was unavailable. A short exercise often exposes dependencies that a written plan misses.
Turn the checklist into an action plan
A checklist is most useful when it leads to decisions. After your review, group issues into three categories: urgent risks that could cause serious disruption, improvements that should be scheduled within the next few months, and longer-term upgrades that can be budgeted for.
Do not try to fix everything at once. Enabling multi-factor authentication, removing unused accounts, testing a backup and documenting emergency contacts can make a meaningful difference quickly. Larger work, such as replacing a server or improving connectivity, may need planning around budget, contracts and operational disruption.
Assign each action to a named person and set a due date. If you work with an IT provider, ask for the actions in plain English, including the risk being addressed, expected cost and likely impact on staff. At Simple IT, this is the kind of conversation we have with local businesses regularly: practical priorities first, then a plan that is manageable.
Technology risk management is not about expecting the worst every day. It is about making sure a common problem does not become a business-stopping event. Review this checklist at least annually, and again when you move offices, add a new system, change providers or grow your team. A little clarity before an incident gives you far more choices when it matters.
