Common IT Mistakes Small Businesses Make (And How to Avoid Them)

Small businesses rarely lose data to a movie-plot attack. More often it's a backup that was never tested, a password three people knew, or a laptop running software nobody has touched since it was installed. None of that is dramatic, and all of it is fixable, usually in an afternoon. Here are the mistakes we see most often, and what to do about each one.

Treating backups as a chore that never gets checked

The usual version of this: an external drive sits plugged into the office PC, and a scheduling tool copies a folder to it every night. That protects you against a deleted file. It does not protect you against ransomware, theft, fire, or a power surge through the same desk. If the bad thing reaches your computer, it reaches the drive plugged into it.

Use the 3-2-1 approach instead:

• Three copies of important data — the working copy plus two backups.
• Two different types of storage — for example, a local drive and a cloud service.
• One copy kept off-site or offline, not permanently connected to your network.

Then prove it works. Once a quarter, restore a small set of files somewhere harmless and time how long it takes. If the answer is "we don't know how", that is the real finding. Also decide what "everything" means: documents, email, your accounting file, the customer database, plus the settings that make your line-of-business software run. Restoring files without the configuration around them leaves you half-fixed.

Shared and reused passwords

There is usually one login that half the office knows — often the shared mailbox, the accounts system, or the Wi-Fi. It gets written on a sticky note, passed on when someone leaves, and never changed. The risk isn't only that one account can be misused. That same password tends to get reused on supplier portals, so a breach at any one of those sites puts the rest in reach.

Fix it in this order:

1. Turn on multi-factor authentication for email first. Your email can reset almost every other password you own, so it deserves the strongest protection.
2. Give every person their own account. Shared logins make it impossible to know who did what, and messy to shut off cleanly.
3. Use a business password manager, and keep the recovery details somewhere offline that at least two people can reach.
4. Add MFA to banking, payroll and anything holding customer data.

Long passphrases of four or five random words beat short, clever substitutions. Summer2024! is not a strong password; it is a common one.

Software and devices you stopped updating

Unpatched software is one of the most reliable ways into a small network, and the entry point is often something you forgot you were running: a router still on factory firmware, a website plugin installed years ago, a storage device nobody logs into. Set operating systems and browsers to update automatically, and restart when asked rather than postponing for a month.

For everything else, keep a simple list of what you run and who is responsible for patching it. Anything past its end-of-support date needs replacing or isolating. Running it "for now" is how a temporary compromise quietly becomes permanent.

No process for people joining or leaving

When someone resigns, the handover focuses on the work and forgets the access. Months later their account is still active, their mailbox still forwarding, and their old laptop still holds a saved session to your accounts system.

Write a one-page leaver checklist: disable the account the same day, forward email to their manager for a set period, collect the laptop and phone, change any shared passwords they knew, and remove them from payment and approval systems. Do the same in reverse for new starters, and record who approved each account.

Knowledge locked in one person's head

This one surfaces at the worst possible time. The person who set up the network, domain, phone system and accounting software moves on, and nobody else has the logins or knows how the pieces fit together.

Keep a documented list of systems, logins and suppliers — domain registrar, hosting, internet provider, software vendors — stored securely, with at least two people able to open it. Note contract renewal dates too. Then check that each account is registered to the business rather than someone's personal email address. That single detail causes more headaches than most owners expect.

Only fixing things once they break

A failing drive, a full mailbox, a backup that silently stopped running in March — most of these give warning signs first. Nobody notices because nobody is watching. Break-fix IT feels cheaper until the Monday morning the server doesn't start at 8:40.

Basic monitoring changes that. Alerts for backup failures, low disk space, drive health, antivirus status and unexpected logins catch most problems while they are still small. Pair it with a short maintenance routine — patch, verify backups, review accounts, check storage — and you spend far less time firefighting.

Where to start this week

If the list feels heavy, pick the three that hurt most if they fail: backups, email security, and knowing who has access to what. Sort those out first, write down what you did, and put a recurring reminder in the calendar to check again.

You don't need an enterprise toolset to run a small business well. You need a few habits that happen on schedule, and someone who notices when they stop happening. A short review of your backups, accounts and updates usually turns up two or three quick wins and a clear list of what to tackle next.

Photo: kirill_makes_pics / Pixabay