Three quiet risks most small businesses never check, and a 15-minute way to find them.
Picture a 20-person accounting office on a Monday morning in March. Tax season. Everyone is at their desk, the coffee is fresh, and nobody has thought about IT in months.
That’s not negligence. It’s usually a good sign. IT that fades into the background tends to mean it’s working.
But here’s what a proper IT risk assessment for small business actually reveals: “it works today” and “we’re ready for a bad day” are two different things — and the gap between them stays invisible until the day you need it.
Now change the picture. The file server won’t open. Or someone clicks a convincing email and a mailbox starts sending things it shouldn’t. The owner’s first question isn’t technical. It’s: “Do we have a backup?”
The answer is almost always yes. The question that matters is the next one: “Have we ever actually restored from it?”
That question points at three risks that sit quietly inside most small businesses. Each one takes about five minutes to check.
1. A backup you’ve never restored is a hope, not a plan
Backups fail in boring ways. A folder was never included. The storage filled up months ago. Retention is so short that yesterday’s mistake is already gone. Or the backup sits on the same network as the thing that just failed.
None of this shows up until you try to recover.
The five-minute check: pick one file and ask whoever looks after your IT to restore it to a different location. Time it. Then ask the bigger question: if the whole server were gone, how long would it take to get people working again? Write that number down. That’s your real recovery time, and it’s often longer than anyone assumed.
2. “We turned on MFA” and “everyone has MFA” aren’t the same sentence
Multi-factor authentication is one of the most effective protections a small business can have. But it’s often switched on for most people and missed for a few: the owner’s account, the shared mailbox, the old admin login, the contractor who still has access.
Those few accounts are exactly where someone looking for a way in will try first.
The five-minute check: in your Microsoft 365 admin center, look at the MFA registration report and list every account without it. Start with administrators and anyone who can reach financial or client information. Fix those first.
Microsoft’s own MFA documentation walks through setup for Microsoft 365.
3. Updates get released. Are they getting installed?
Software vendors publish fixes for known problems all the time. The risk isn’t the problem itself. It’s the time between the fix being available and it actually being installed on your machines.
That gap widens quietly. The laptop that’s rarely on the office network. The desktop in the back room nobody touches. The computer still running a version of Windows that no longer gets updates.
The five-minute check: pick five devices and look at when each one was last updated. Look for anything running an operating system the vendor has stopped supporting. Just knowing which machines are behind is progress.
Try this IT risk assessment in 15 minutes
Open a blank page and write three lines:
- Backups: when did we last test a restore?
- MFA: which accounts don’t have it?
- Updates: which devices are behind?
Mark each one green (we know, and it’s managed), yellow (something’s in place but needs a look), or red (we don’t have a reliable answer).
Don’t aim for a perfect result. Aim to find the unknowns. A yellow or red isn’t a failure. It’s simply the next thing to fix.
What good looks like
For a small business, it’s not complicated:
- Restores are tested on a schedule, not just backups taken
- MFA is on everywhere it can be, starting with admins
- Someone is accountable for updates, and you can see whether they’re happening
- The basics are written down, so the answer doesn’t live in one person’s head
You don’t need an enterprise IT department to get there. You need to know where you stand.
Where to start
A quick IT risk assessment for small business isn’t about achieving perfection. It’s about finding the unknowns. A yellow or red isn’t a failure. It’s simply the next thing to fix.
Take our free 3-minute IT assessment → https://a2securecloud.ca/assessment
For a broader security checklist, see Get Cyber Safe from the Canadian Centre for Cyber Security.