Small business technology risk comes down to four questions: who can get into your systems, what happens when a system goes down, what your suppliers can lose on your behalf, and who is watching the devices your team carries. You can assess all four in an afternoon without any technical expertise, and most of the fixes are configuration changes rather than purchases.
The reason to do this now rather than later is that the cost of a technology failure in a small business is rarely the technology. It is the week of lost trading, the payroll you cannot run, and the customer data conversation you have to have afterwards.
Why Small Business Technology Risk Gets Ignored
Three reasons, all of them understandable.
It is invisible until it is not. Nothing on your profit and loss statement shows the cost of a backup you have never tested, so the problem never competes for attention with problems that do appear.
It feels like someone else's job. In a 5 to 50 person business there is usually no one whose job it is, which means the default owner is you, which means it does not happen.
And the advice available is written for larger organisations. Frameworks designed for enterprises assume staff and budget you do not have, so the honest response is to ignore them. That is reasonable, but the underlying risks still apply at your size.
Assess it the way you would assess any other operational exposure: list what could stop the business, check whether a control exists, and test whether the control works.
Section 1: Access Control
Access is where most small business incidents begin, and it is the cheapest area to fix.
Work through these:
- Two-factor authentication is on for email, banking, your payment processor, your accounting system and your domain registrar. Those five first, before anything else.
- No shared logins for anything that handles money or customer data. Shared accounts remove accountability and survive departures.
- A written list of every person with administrator access to any system, reviewed quarterly.
- Former employees and former contractors are off every system. Check the specific ones people forget: shared drives, the social accounts, the phone system, the password manager, the project tool.
- Passwords live in a password manager, not a spreadsheet, a notes app or somebody's memory.
- Your domain registrar and DNS records are in an account the business owns, not a former web developer's personal account.
That last one is a genuinely common and genuinely expensive problem. If you cannot log in to the account that controls your domain, you do not control your website or your email.
Section 2: Backup and Recovery
The distinction that matters here is between having backups and having tested restores. They are not the same thing and only one of them protects you.
| Question | Weak answer | Acceptable answer |
|---|---|---|
| What is backed up? | "The server, I think" | A written list of systems and data, with owners |
| How often? | "It runs automatically" | A stated frequency per system, verified in the console |
| Where does it go? | One location | Two, with one off-site or on a separate account |
| When was a restore last tested? | Never | A dated test within the last quarter |
| Who restores it? | "Our IT guy" | A named person, plus a documented second |
| How long would recovery take? | Unknown | An estimate you have actually measured |
Pick one important file this week, restore it from backup to a different location, and open it. That single exercise finds broken backups faster than any audit, and it gives you a real recovery time rather than an assumed one.
Cloud systems are not automatically exempt. Most business software vendors protect themselves against their own infrastructure failure, not against you or a staff member deleting something. Check whether your core systems can be exported, and schedule an export.
Section 3: Vendor and Supplier Risk
Your technology risk includes every supplier holding your data or running a process you depend on. In a small business that list is usually longer than expected.
Build the list first. Go through twelve months of card and bank statements and write down every software subscription and technology supplier. Owners routinely find tools they are paying for and nobody uses, which pays for the exercise on its own.
Then, for each supplier that holds customer data or runs something you cannot trade without, record four things: what data they hold, what happens to your business if they are unavailable for three days, whether you could export your data today, and who at your business owns the relationship.
Ask new suppliers for their security and data-handling documentation before signing. You are not auditing them. You are checking whether they can answer, which is informative in itself.
For edge security — WAF and DDoS protection on anything customer-facing — confirm what you have rather than assuming your host includes it. Many small business sites run with nothing in front of them.
Section 4: Devices, Networks and People
The last section covers the parts of the risk that walk out of the building every evening.
Devices. Every laptop and phone with business data on it needs disk encryption on, automatic updates on, a screen lock, and the ability to be wiped remotely. Write down who has what. Personal devices used for work count, and need a stated rule.
Network. Separate guest wifi from the network your business systems sit on. Change default passwords on the router and anything else with an admin page. Know what is connected.
People. The most common successful attack on a small business is still a convincing email asking for a payment or a password change. Two controls handle most of it: a rule that bank detail changes are verified by phone to a previously known number, and a standing agreement that nobody is ever in trouble for pausing a payment to check.
Run a ten-minute version of that conversation with your team. It is not training, it is permission — permission to be suspicious of a message that appears to come from you.
Turning the Checklist Into a Plan
You will find a dozen gaps. Sort them by a simple test: could this stop the business trading, or expose customer data? Those go first, regardless of effort. Everything else goes into a dated list.
A reasonable first 30 days:
- Two-factor on the five critical accounts.
- Full access review and removal of former staff and contractors.
- One tested restore, with the recovery time written down.
- The supplier list, built from statements.
- The payment verification rule, agreed in writing with whoever handles money.
Then re-run the full checklist quarterly and keep the previous version. The comparison tells you whether your controls are improving or just being described differently.
Where to Start
Technology risk in a small business is mostly unglamorous maintenance, and it is almost entirely within your control without hiring anyone. The first pass is the hard one; after that it is a quarterly hour.
If you would rather work through a prepared assessment than build your own, the Small Business Tech Risk Checklist page covers these four areas in a fixed scoring format you can hand to whoever manages your systems.