Notes from the service desk.
What we learn running IT and compliance for small teams, written for owners and operators, not engineers.
The three gaps we find in every small business IT setup
Nobody owns the backup, nobody reviews admin rights, and nobody knows who gets called at 6pm. Fixing those three costs almost nothing.
What a SOC 2 Type I actually requires from a 12-person company
A plain reading of the controls, what evidence auditors accept, and the parts you can genuinely defer to Type II.
Phishing simulations are useless without the follow-up conversation
Click rates make a nice chart. What changes behaviour is what happens in the ten minutes after someone clicks.
Reading this because something at work is not quite right? The assessment is free, takes 30 minutes, and you keep the findings sheet.
Get your free assessment →How to audit your software licences in an afternoon
Most teams pay for seats nobody uses and tools that overlap. Here is the spreadsheet we start from.
Your recovery time objective is a business decision, not an IT one
Before anyone picks a backup product, somebody has to say out loud how many hours of downtime the business can absorb.
When a small business should hire internal IT instead of an MSP
There is a real crossover point. We would rather tell you where it is than sell past it.