Computer consultant in Newcastle, NSW: someone to call when it stops.

Email and file storage, the laptops and phones people work on, passwords, security, and a backup, meaning a saved copy you can go back to. Most of that takes one proper setup, and then somebody keeping an eye on it.

Part of it is a project with an end, which is the setting up. The rest is somebody answering when something stops working, which never ends. The monthly fee is for the second one.

What it covers

• Email on your own business name.

  Rather than a free address. Arriving reliably, and not landing in other people's spam folders on the way.

• Files kept in one place.

  Somewhere everybody can reach from any device, with old versions recoverable when somebody saves over one.

• The devices people work on.

  Laptops and phones, set up the same way as each other, and wiped remotely if one goes missing on a train.

• Passwords and who has access.

  One safe place for logins, and a way to remove somebody on the day they leave rather than a month later.

• A backup you can actually go back to.

  Taken automatically, kept somewhere separate, and tested at least once so somebody knows it works.

Anything past that is a business deciding it wants software built around how it works. That is a different job, and it is worth naming as one rather than folding it in.

Almost every small business already depends on email, a phone and a folder of files. The question is whether anybody is responsible for it when it stops.

The costs are rarely dramatic. They are a morning lost to an email problem, a quote that never arrived, an invoice paid into the wrong account after somebody read a convincing fake.

None of that requires anything sophisticated to go wrong. Almost all of it comes back to a reused password or a backup nobody ever checked.

Why owners bring somebody in

• Email is a business asset.

  Where it is a free address, the business does not control it, and moving it later grows harder every year that passes.

• The risk is entirely ordinary.

  Almost nothing that goes wrong is clever. It is a reused password, a missing backup, or an update nobody applied.

• Somebody has to be responsible.

  Not for everything in the business. For the things above, on a number that somebody actually picks up.

Somebody to call, the updates and backups genuinely happening, and a short note of what changed. A fee that buys only the right to call is insurance rather than support.

In a month where nothing breaks, the fee is still buying something. This is the quiet work behind that month, and it is most of what the arrangement is for.

What a quiet month looks like

• Updates go on as they come out.

  Operating systems, browsers and anything with a login. It is the quiet half of the job, and it is where most of the risk sits.

• The backup runs, and somebody proves it works.

  Running is not the same as working, so a real restore happens rather than an assumption that one would.

• Somebody checks who still has access.

  Anybody who has left comes off the list. Anybody new starts the same way as everybody else.

• A short written note lands in your inbox.

  What changed, what is coming next, and anything the business actually needs to decide.

The Australian Cyber Security Centre publishes a plain small business guide, and its advice is genuinely the short version of this chapter.

Two step login everywhere, passwords in one manager, updates applied, and a backup kept somewhere separate. Those four cover most of what actually happens to small businesses.

Security advice aimed at small business is usually written for companies with a security team. A short list does most of the work here.

The four that do the work

• Two step login, starting with email.

  A code as well as a password. On email first, then banking, then everything else, so a stolen password stops being enough.

• One password manager for everything.

  One safe place, one strong password to open it, and no more reusing the same password across ten different sites.

• Updates left switched on.

  Most trouble that reaches a small business came through a hole an update had already closed months earlier.

• A backup kept somewhere separate.

  Separate is the word that matters. A copy on the same computer is not a backup if that computer is the thing you lose.

Where a business holds customer information, it also has obligations when that information leaks. The Office of the Australian Information Commissioner sets out when a breach has to be reported, and it is worth ten minutes before it is needed.

First a written list of everything the business uses. Then email moves onto its own name, files move into one place, and passwords move into a manager. Backups go on and one restore proves itself, and the arrangement goes in writing.

Most of it takes about a fortnight, and the moves happen outside working hours wherever they can.

1. Everything the business uses goes on a list

Every account it depends on, who has it, and who is paying for it. This is where the forgotten subscriptions turn up, usually more than one.

2. Email moves onto the business's own name

Not a free address. The business's own name, in an account it owns, so that it survives a staff change. It is the job owners put off longest.

3. Files move into one place

One shared location everybody uses, reachable from a phone, with old versions recoverable. Files on somebody's desktop are a single point of failure.

4. Passwords move into a manager

One safe place, shared with the people who need it, and two step login switched on for anything that matters.

5. Backups go on, and one restore proves itself

Automatic, kept somewhere separate, and proved once. A backup nobody has ever restored from has never been proved to work.

6. The arrangement goes in writing

Who to call, and how fast they answer. The middle of a problem is the wrong time to discover the arrangement was informal.

The audit takes a few days. Email and files move over a weekend so nobody loses a working day, and the rest settles over the following weeks. After that it is maintenance.

The order it happens in

• The list comes first.

  What the business uses, who owns it and who pays for it. Most owners have never had that list, and there is usually a saving on it.

• Then email and files move across.

  Devices come into line while that happens. A short interruption, and then it is on the business's own name.

• Then the routine starts running.

  Passwords, backups, updates and access reviews. Nothing dramatic ever happens, which is the intended result.

The moves happen outside working hours wherever possible. Anything that has to happen during the day goes in the diary with the business rather than sprung on it.

Ask who owns the accounts, what happens in a quiet month, how fast they answer, and whether you walk away with everything if you leave. The answers separate support from a subscription.

These are worth asking of any provider, including this one, so the answers given here are underneath each question.

• Who owns the accounts?

  You do, in the business name, with the recovery details under your own control. This is the one to get in writing first.

• What happens in a month where nothing breaks?

  Updates, backups checked, access reviewed, and a note of it all. Where the answer is nothing, the fee is buying availability and nothing else.

• How fast do you answer, and when?

  Hours and a response time, in writing. Ask what happens late on a Friday, because that is when it costs the most.

• Will you hand everything over if I leave?

  Every login, documented, and without a fee for it. That answer is much easier to get before you start than after.

Plenty of Newcastle businesses handle the day to day themselves and only want somebody for the setup. That is reasonable, and anybody who will not quote it that way is worth passing on.