Good IT advice

Eight things matter. The rest can wait.

Most small business IT advice is noise. These eight basics stop the attacks we actually see and keep the business running when something goes wrong. Check yours below.

Facts from Microsoft, the ACCC and ASD, checked 31 October 2026.

Book a 30-minute chat Check the basics 07 3114 2808

Eight basics
What to stop doing
Eight-point check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A cafe owner approves a sign-in prompt on her phone at the counter after closing, a laptop beside the till. — **A$166.8 million**Lost to payment redirection scams in 2025 (ACCC). A phone call stops most of it.

Start here

Four things to do this week.

Each takes hours, not months.

Turn on MFA

Email, banking, accounting and every admin account.

Authenticator app
Passkeys
No SMS

Small business IT basics check

How many of the eight do you have?

Tick what is true today. The gaps come back in the order we would close them.

Tick what is true for your business today.

MFA on email, banking, accounting and every admin accountAuthenticator app or passkey, not SMS.
Bank detail changes checked by phoneOn a number you already had, every time.
Backups you control, with a restore testedIncluding Microsoft 365, kept where ransomware can't reach.
One login per personNo shared accounts; leavers switched off on the day.
Proper endpoint protection on every deviceDetection and response, with someone watching the alerts.
Updates applied quicklyInternet-facing devices first: ASD expects 48 hours where an exploit exists.
A password manager for everyoneNo passwords in email, Teams or spreadsheets.
Someone accountable for ITA person or provider who owns it, not a helpful relative.

Where you stand

0of 8 basics in place

8 gaps to close.

MFA on email, banking, accounting and every admin accountMicrosoft says MFA can block more than 99.2% of account compromise attacks.
Bank detail changes checked by phonePayment redirection scams cost Australians A$166.8 million in 2025 (ACCC).
Backups you control, with a restore testedIt's how you recover without paying.
One login per personYou can't remove access you can't trace.
Proper endpoint protection on every deviceFree antivirus misses behaviour-based attacks.
Updates applied quicklyMost attacks use flaws that already have a fix.
A password manager for everyoneShared and reused passwords spread a single breach.
Someone accountable for ITWithout an owner, the basics slip quietly.

Close the gaps

Proper endpoint protectionDetection and response on every device, with alerts acted on.
Fast updatesAutomatic for laptops; days, not months, for firewalls and VPNs.
A password managerFor everyone, including shared business accounts.
An owner for ITSomeone accountable, inside or outside the business.

Habits to drop

Stop doing these.

Sharing passwords in email or chatUse a password manager instead.
Personal email for workEveryone gets a business account with their own name.
Running unsupported systemsWindows 10 support ended October 2025; Server 2016 ends January 2027.
Hoping the helpful relative has it coveredSecurity needs someone accountable.
Waiting for an incidentInsurers and customers ask now.

Perspective

What not doing it costs.

Measure	Figure	Source
Average cost per cybercrime report, small business	A$56,600	ASD Annual Cyber Threat Report 2024-25
Payment redirection scam losses, 2025	A$166.8 million	ACCC
Account compromise attacks MFA can block	More than 99.2%	Microsoft

For what managed IT costs, see our published plans on the pricing page.

Our view

Boring, done properly, beats clever.

The incidents we clean up rarely involve anything clever. They involve a mailbox without MFA, a bank change nobody phoned about, or a backup nobody had tested. These eight basics close those doors.

That's most of what a good managed service does: the routine work, done every time, with someone accountable for it.

The order

Getting the basics in place in five steps.

Step 1Check
Run the eight-point check.
Step 2This week
MFA, phone checks, restore test, logins.
Step 3This month
Endpoint protection, updates, password manager.
Step 4Name an owner
Inside or outside the business.
Step 5Review quarterly
Keep the basics from slipping.

Related guides

Keep it simple. Then go deeper.

Where to go next.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What small businesses ask about IT basics.

What is the single most important thing to do?

Turn on MFA for email and every admin account, using an authenticator app or passkey. Microsoft says MFA can block more than 99.2% of account compromise attacks.

Does Microsoft 365 back up our email?

Microsoft keeps the service running and holds deleted items for limited periods. That isn't an independent backup you control. Back up mail and files separately and test a restore.

Is the antivirus that came with our laptops enough?

Usually not on its own. Endpoint detection and response watches for attacker behaviour, not just known files. Defender for Business, included in Microsoft 365 Business Premium, is a common choice.

How fast should we install updates?

As fast as you reasonably can, starting with anything on the internet such as firewalls and VPNs. ASD's Essential Eight expects internet-facing services to be patched within 48 hours where an exploit exists.

What does a cyber incident cost a small business?

ASD's Annual Cyber Threat Report 2024-25 put the average self-reported cost per cybercrime report at A$56,600 for small businesses. Some cost far more.

When should we get outside help?

When nobody in the business clearly owns IT, when you're growing past a handful of staff, or when insurers and customers start asking questions you can't answer with evidence.

Next step