The three gaps we find in every small business IT setup

Every small business we onboard has the same three gaps, and none of them are exotic. They are the ordinary ones: nobody owns the backup, nobody has looked at who still has admin rights, and nobody can name the person who gets called at 6pm when the file server stops answering.

That last one matters more than the tooling. An MSP contract is really an agreement about who holds the pager, and it should be written down before anything technical gets discussed.

Start with the restore, not the backup

A backup you have never restored is a hypothesis. We test restores quarterly and write the result down, because the number that matters is not whether the job ran; it is how long the business is down while the data comes back.

• Name the recovery point objective in hours, then check the schedule actually meets it.
• Restore one real file and one whole system. The second one is where surprises live.
• Keep one copy somewhere an attacker with domain admin cannot reach.

Nobody is judged on the backup that ran. Everybody is judged on the Tuesday it had to come back.

Then cut the admin rights

Standing local admin on every laptop is the single most common finding in the assessments we run, and the cheapest to fix. Remove it, hand out elevation on request, and the ransomware blast radius shrinks the same afternoon.

The review itself takes an hour. Export the members of every privileged group, sit down with the owner, and ask a single question against each name: does this person still need this today? Most lists shrink by half. The ones that survive get documented, so next quarter the review takes fifteen minutes instead of an hour.

Finally, name the owner

Write down who gets the call, what number reaches them, and what they are authorised to do at 6pm without waiting for a sign-off. A one-line escalation path prevents the worst outcome of any incident, which is not the fault itself but the forty minutes lost deciding whose problem it is.

None of this requires a bigger budget. It requires somebody to own it, review it on a schedule, and put their name at the top of the report. That is the whole job, and it is the part most IT setups quietly skip.