When owners ask how to get their IT in better shape, they usually want to talk about the fun stuff: AI, automation, a new app for the crew. That's fine. We like the fun stuff too.
But IT improvements have an order, and doing them out of order is how you end up with a shiny new automation running on a computer that hasn't been backed up since 2022. Here's the order we'd follow for most small businesses.
Start with a list
You can't protect what you don't know you have. Write down every computer, who uses it and how old it is. Every account and subscription the business pays for. Who has admin access to Microsoft 365 or Google Workspace. Where your important files actually live. Who owns your domain name, and which email address that account is registered under.
That last one catches people off guard. It isn't unusual to find a domain registered to a web designer who retired years ago, or to a personal Gmail account nobody can get into anymore.
Lock down email and accounts
Email is where most trouble starts, so it gets fixed first.
- Turn on multi-factor authentication for everyone, owner included.
- Give every person their own login. No shared "office@" account that six people sign into.
- Use a password manager for the business, so passwords stop living on sticky notes.
- Remove anyone who no longer works for you. Today, not when you get around to it.
Get backups right
A real backup is automatic, stored off-site and tested. If any one of those three is missing, what you have is a false sense of security.
Don't forget what's in the cloud. Your Microsoft 365 or Google Workspace data is stored by Microsoft or Google, but that isn't the same as a backup you control. If someone deletes the wrong folder, or ransomware scrambles files that sync to the cloud, you want your own copy to restore from.
Then give it the hurricane test. If your building flooded tonight, could your team be working from somewhere else by the end of the week? If the honest answer is "probably," find out for sure before August.
Patch and replace
Set updates to install automatically, and have someone confirm they did. Then look at the ages on your list. Any computer that can't run a supported version of Windows needs a replacement date. Budgeting for two laptops a year is a lot easier than buying eight at once.
Get files off the desktop
If important files live on one person's desktop or on a server in the closet, move them into shared cloud storage like SharePoint, OneDrive or Google Drive, with folders set up by who actually needs access. Your team can reach them from home or a job site, and a stolen laptop becomes an inconvenience instead of a data breach.
Split up the Wi-Fi
Guests, personal phones and the smart TV in the conference room don't belong on the same network as the computer that runs payroll. Set up a separate guest network. And yes, change the password that's been taped under the front desk keyboard since the day the office opened.
Now do the fun stuff
Once the foundation is solid, this is where it gets interesting. Automate the tasks your people hate: retyping web leads into a spreadsheet, chasing invoice approvals, sending appointment reminders by hand. Build an AI assistant that knows your procedures and price sheets. Connect the three systems that currently only talk to each other through your office manager.
All of that works better, and is a lot safer, on top of the steps above.
If you'd like help working through this list, our free assessment covers most of the first half of it. For the fun stuff, take a look at our AI for business and custom software pages.
