Computer consultant in Newcastle, NSW: someone to call when the computers stop.

Email and file storage, the laptops and phones people work on, passwords, security, and a backup, which is a saved copy you can go back to. Most of it is set up once and then watched.

Part of it is a project with an end, the setting up. The rest is somebody answering when something stops working, which never ends. What you pay each month is for the second one.

What it covers

• Email. On your own business name rather than a free address, arriving reliably, and not landing in other people's spam folders.
• Files. In one place everybody can reach, on any device, with old versions recoverable.
• Devices. The laptops and phones people work on, set up the same way, and wiped remotely if one goes missing.
• Passwords and access. One safe place for logins, and a way to remove somebody the day they leave.
• Backup, which is a saved copy you can go back to. Taken automatically, kept somewhere separate, and tested at least once so you know it works.

Anything past that is a business deciding it wants software built for how it works. That is a different job and it is worth naming as one.

Almost every small business already depends on email, a phone and a folder of files. The question is not whether you have technology, it is whether anybody is responsible for it when it stops.

In most small Newcastle businesses the most confident person on staff is quietly the IT department. It works until they are on holiday, or until the thing that breaks is the thing they set up.

The costs are rarely dramatic. They are a morning lost to an email problem, a quote that never arrived, an invoice paid to the wrong account after somebody read a convincing fake.

Why owners bring somebody in

• Email is a business asset. If your email is a free address, you do not control it, and moving it later is harder every year you wait.
• The risk is ordinary. Almost nothing that goes wrong is sophisticated. It is a reused password or a missing backup.
• Somebody has to be responsible. Not for everything. For the things above, with a number to call.

Someone to call, the updates and backups actually happening, and a short note of what was done. A fee that buys only the right to call is insurance. Ours buys the work as well as the number.

In a month where nothing breaks, the fee is still buying something. This is the work that happens quietly, and it is what we do for Newcastle businesses on a monthly arrangement.

What a quiet month looks like

• Updates applied. Operating systems, browsers and anything with a login. It is the quiet half of the job and it is where most of the risk goes.
• Backups running and checked. Running is not the same as working, so a restore gets tested rather than assumed.
• Access reviewed. Anybody who has left, removed. Anybody new, set up the same way as everyone else.
• A short written note. What was done, what is coming, and anything you need to decide.

The Australian Cyber Security Centre publishes a plain small business guide, and its advice is genuinely the short version of this chapter.

Turn on two step login everywhere, put passwords in one manager, apply updates, and keep a backup somewhere separate. Those four cover most of what actually happens to small businesses.

Security advice aimed at small business is usually written for companies with a security team. A short list does most of the work.

The ones that do the work

• Two step login. A code as well as a password, on email first, then banking, then everything else. A stolen password stops being enough.
• A password manager. One safe place, one strong password to open it, and no more reusing the same one across ten sites.
• Updates. Turn them on and let them run. What gets in usually came through a hole an update had already closed.
• A backup kept separate. Separate matters. A copy on the same computer is not a backup if the computer is what you lose.

If you hold customer information, you also have obligations when it leaks. The Office of the Australian Information Commissioner sets out when a breach has to be reported. Worth ten minutes of reading before you need it.

Write down what you use, move email onto your own name, put files in one place, get passwords into a manager, switch on backups, then agree who to call. Most of it is a fortnight of work.

1. Write down what you actually use

Every account the business depends on, who has it, and who pays for it. This is where the forgotten subscriptions turn up.

2. Move email onto your own business name

Not a free address. Your own name, in an account the business owns, so it survives a staff change. It is the job owners put off longest.

3. Put files in one place

One shared location everybody uses, reachable from a phone, with old versions recoverable. Files on somebody's desktop are a single point of failure.

4. Get passwords into a manager

One safe place, shared with the people who need it, and two step login switched on for anything important.

5. Switch on backups and test one restore

Automatic, kept somewhere separate, and proved once. A backup nobody has ever restored from is a theory.

6. Agree who to call and how fast they answer

In writing, with hours. The middle of a problem is the wrong time to find out the arrangement was informal.

The audit takes a few days. Email and files move over a weekend so nobody loses a working day, and the rest settles in over the following weeks. After that it is maintenance.

The order it happens in

• Everything gets written down. What you use, who owns it and who pays for it. A list most owners have never had, and usually a saving sitting on it.
• Email and files move. Devices are set up the same way while that happens. A short interruption, then it is on your own business name.
• The routine starts. Passwords, backups, updates and access reviews. Nothing dramatic, which is the intended result.

The moves are done outside working hours where possible. Anything that has to happen in the day gets scheduled with you rather than sprung on you.

Ask who owns the accounts, what happens in a quiet month, how fast they answer, and whether they will hand everything over if you leave. The answers separate support from a subscription.

We do this work in Newcastle, so we are not neutral. These are the questions we would want asked of us.

• Who owns the accounts? You do, in the business name, with the recovery details in your control. This is the one to get in writing.
• What happens in a month where nothing breaks? Updates, backups checked, access reviewed, and a note of it. If the answer is nothing, the fee is standby pay.
• How fast do you answer, and when? Hours and a response time, written down. Four on a Friday is the honest test of it.
• Will you hand everything over if I leave? Every login, documented, without a fee. That answer is easier to get before you start than after.
• Am I locked in? Ours runs month to month and always has. Any arrangement you cannot leave at the end of a month is worth a second look.

A lot of Newcastle businesses handle the day to day themselves and only want somebody for the setup. That is a reasonable thing to ask for, and anybody who refuses to do it that way is telling you something.