Running IT in a small business guides
Starters, leavers, policies, budgets and planning. 50 plain-English guides for small and medium businesses.
- The IT checklist for a new starter's first dayA new starter should walk in to a working laptop, a Microsoft 365 or Google account with multi-factor sign-in ready to finish, access to the right shared folders and nothing more, and ten minutes with someone who explains the basic security rules. Most of that can be done the week before they start, which is the whole trick.
- The IT checklist for when a staff member leavesOn a leaver's last day you should block their sign-in, reset their password, remove their phone from multi-factor authentication, collect their devices and decide what happens to their mailbox and files. Then work through every other system they used, because the main email account is rarely the only door left open.
- Shared logins: why small businesses should stop using themA shared login means you can't tell who did what, you can't turn on multi-factor sign-in properly, and you have to change the password every time someone leaves. Replacing shared accounts with individual ones plus shared mailboxes, shared folders and a password manager fixes all three without making work slower.
- How to write an IT acceptable use policy staff will actually readAn acceptable use policy sets out how staff may use the business's computers, phones, email, internet and data. Keep it to two or three pages in plain language, cover the handful of rules that genuinely matter to your business, have each person sign it, and review it once a year.
- The IT policies a ten-person business actually needsA small business needs about five short IT documents: an acceptable use policy, an access and password rule, a backup and recovery plan, an incident response plan, and a device policy covering laptops and phones. A privacy statement for customer data rounds it out. Each can be one or two pages, and together they cover most of what insurers and customers ask about.
- Documenting your IT: what to write down and where to keep itGood IT documentation is a short, current record of what systems you have, who supplies them, who can administer them, how the network is put together and when things renew. Keep it in one secure place two named people can reach, and update it every time something changes, not once a year.
- Passwords and admin access when the owner is awayNo business should depend on one person to reach its email admin, bank, domain or accounting system. Give a second trusted person their own admin access, keep a sealed emergency account for the worst case, and make sure multi-factor codes don't all go to one phone. Then test it before the owner's next holiday, not during it.
- Who in your business should own IT?Someone inside the business should be accountable for IT, even if a provider does the technical work. Usually that is the owner, general manager or office manager: a person with authority to make decisions and spend money, who meets your IT provider regularly and knows what the business needs. They don't need to be technical.
- How to train staff on a new system without losing a weekTrain staff in short, role-specific sessions just before they need the new system, using your own data and real tasks. Pick one or two champions who learn it first, give everyone a one-page cheat sheet, and plan for questions in the first fortnight. One long demonstration a month before go-live is the approach that fails most often.
- How to get staff to actually use Teams and SharePointStaff adopt Teams and SharePoint when the setup is simple, the files they need are already there, the old places are closed off, and managers use the new tools themselves. Plan a small number of clearly named teams, migrate files properly, set a few ground rules, and switch off the old shared drive once everything has moved.
- How to manage contractors' access to your systemsGive contractors their own named accounts or guest access, limited to what the job needs, with multi-factor sign-in and an end date set from the start. Keep a register of every outside party with access, review it each quarter, and remove access the day the work ends rather than when someone remembers.
- BYOD: setting rules for personal phones and laptops at workBring your own device works when you separate business data from personal data, require basic security on any device that holds work information, and agree in writing what the business can and can't do to an employee's own phone or laptop. Phones usually suit BYOD well; personal laptops are harder and often better replaced with a company device.
- IT rules for staff who work from homeStaff working from home should use a business device or approved access, connect through home Wi-Fi with a strong password, keep work files in the business's cloud rather than on a home computer, handle printed and spoken customer information carefully, and know how to get help. Write these down in a page and agree them before hybrid work becomes the norm.
- Handling IT for seasonal and temporary staffPrepare a simple, repeatable kit for short-term staff: a role template for accounts, a pool of ready devices, access limited to what the job needs and an end date set when the account is created. That way a temp is productive on day one and their access ends on their last day without anyone having to remember.
- Keeping software licences in orderKeep one register of every software subscription and licence, showing what it costs, how many seats you pay for, who uses them, who the admin is and when it renews. Check it against actual users every quarter, and route all new software purchases through one person. Most businesses find unused seats the first time they look.
- What to do when a key staff member leaves with the passwordsStart by securing what you still control, then work through each system's official recovery process to regain ownership, prioritising email, the domain name and anything that handles money. Most providers can restore access to the legitimate business owner with proof of identity and ownership. Once you're back in, change every credential the person knew and fix the setup that let it happen.
- How to prepare for an IT audit or cyber insurer reviewMost IT reviews for small businesses ask about the same handful of controls: multi-factor sign-in, backups and restore tests, updates, endpoint protection, admin access, staff training and an incident plan. Gather evidence for each, fix anything quick, and answer every question honestly, because an inaccurate answer can cause far more trouble at claim time than an honest gap.
- The IT tasks to do every month, quarter and yearMost IT problems in small businesses come from things that quietly drift: backups that stopped, updates that failed, accounts nobody removed, renewals nobody noticed. A short calendar of monthly, quarterly and yearly checks catches them before they cause trouble, and takes a few hours a month in total.
- How to report an IT problem so it gets fixed fasterTell support who is affected, what you were trying to do, what happened instead, any exact error message, when it started and how urgent it is for the business. A screenshot and the name of the computer or device save most of the back-and-forth. A clear request can be the difference between a ten-minute fix and a two-day exchange of emails.
- How to reduce everyday IT interruptions in your officeMost IT interruptions in small offices come from a short list of repeat problems: old computers, inconsistent setups, password lockouts, unreliable Wi-Fi, temperamental printers and updates arriving at the wrong time. Standardise devices, schedule updates outside work hours, add self-service password reset and fix the repeat offenders properly, and the daily disruptions drop noticeably.
- IT for business owners who are not technicalA non-technical owner doesn't need to understand how IT works, only to know what it should achieve and how to check it's happening. Focus on five things: who has access, whether data is backed up and recoverable, whether systems are kept secure and updated, what it all costs, and who to call when it goes wrong. Ask about each regularly and insist on plain answers.
- Succession and IT: what to sort out when selling a businessBefore you sell, make sure the business, not you personally, owns its domain names, Microsoft 365 or Google account, software subscriptions and devices, and that everything is documented. Agree in the sale terms how and when IT control passes to the buyer, separate your personal data from the business's, and plan a handover that keeps the business running through settlement.
- Family businesses and IT accessFamily businesses need the same IT basics as any other firm: individual accounts, clear admin rights, business data kept apart from household data and a plan for who takes over if someone steps back. The difference is that informal trust makes it easy to skip these steps, and family changes such as separations, retirements or disagreements can turn shared access into a real problem.
- Managing multiple software and IT vendorsKeep a single list of every vendor with contacts, contract terms and what each is responsible for, name one internal person to coordinate them, and make sure someone is responsible for problems that fall between vendors. Many small businesses ask their IT provider to act as the vendor coordinator, so staff have one place to report a problem and someone else chases the right supplier.
- Keeping customer data tidy and lawfulKnow where your customer information lives, keep only what you need for as long as you need it, limit who can see it, protect it properly and delete it when its purpose has passed. That approach keeps you aligned with the Privacy Act 2020 and also makes a breach far less damaging if one ever happens.
- How to build a three-year IT plan for a small businessA three-year IT plan is a short document that lists what you have, what the business is trying to do, what must be replaced or changed in each of the next three years, and roughly what that will cost. It turns IT from a run of surprise bills into a schedule you can see coming and argue about in advance.
- How much should a small business spend on IT?There is no single right figure, but small and medium businesses commonly spend somewhere in the low single digits as a percentage of revenue on IT, and it is often more useful to look at the cost per staff member per year. Treat any benchmark as a sense check that prompts questions, never as a target to hit.
- Capex vs opex for IT: should you buy, lease or subscribe?Capex means buying IT outright as an asset, while opex means paying for it as an ongoing running cost through leases, rentals or subscriptions. Neither is better in general; the right mix depends on your cash flow, how predictable you want costs to be, and how much control you need over the equipment.
- Claiming IT costs and depreciation in New Zealand: the basicsIn general terms, NZ businesses deduct day-to-day IT running costs as expenses in the year they are incurred, and spread the cost of longer-lived equipment over several years through depreciation, with lower-value items often deductible straight away. The exact treatment depends on the item and your circumstances, so use this as background and confirm every decision with your accountant.
- IT for a brand-new business: getting the first ten staff rightA new business needs a domain name it controls, business email and file storage on one platform, secured company devices, multi-factor sign-in, a password manager and a backup, all set up so the business rather than any individual owns them. Doing this properly while you are small takes days; fixing it at thirty staff takes months.
- Setting up a new office's IT from scratch, in the right orderWhen you are fitting out an office with no existing IT, work in this order: decide the platforms and security rules, order internet and cabling early, choose and configure devices centrally, then add printing, phones and meeting rooms, and test everything before the first person sits down. Getting the order right avoids most of the delays that make opening week painful.
- Office move IT checklist: a timeline that works backwards from moving dayPlan the IT side of an office move about three months out, starting with internet and cabling, then confirm phones, equipment and the cut-over plan in the final month, and move and test over a weekend so the office works on the first morning. Most move-day IT disasters come from things ordered too late, not from the move itself.
- Opening a second site or branch: the IT checklistOpening a second site means deciding how it connects to the first, giving staff there the same systems and security, sorting phones and local equipment, and agreeing who provides hands-on help. Start from the assumption that the new site should look and work exactly like the first, and only make exceptions when there is a clear reason.
- IT when you buy or merge with another businessWhen you buy or merge with another business, find out exactly what IT it has and what risks come with it before settlement, secure the accounts and data on day one, and then bring systems together in planned stages rather than all at once. The aim is to protect both businesses while giving staff a clear path to one way of working.
- How to choose and manage software vendorsChoose business software by writing down what you need it to do, trialling a short list with real data and real staff, and checking the contract for data ownership, exit terms, security and support before signing. After that, manage the vendor actively: track renewals and licence counts, hold them to their support terms and review the fit every year.
- How to negotiate with telcos and IT suppliersYou get better deals from telcos and IT suppliers by knowing exactly what you use, starting the conversation well before contracts renew, getting comparable quotes and negotiating on terms as well as price. Small businesses rarely have huge buying power, but they often leave money and flexibility on the table simply by letting contracts roll over unexamined.
- How to build an IT risk register for a small businessAn IT risk register is a short list of the things that could go wrong with your technology, how likely and how damaging each one is, what you are doing about it and who is responsible. For a small business it can be a single spreadsheet of fifteen to thirty lines, reviewed every quarter, and it is one of the most useful documents an owner can hold.
- The questions owners and boards should ask about ITOwners and directors do not need to understand the technology, but they should regularly ask a short set of questions about recovery, access, security, spending and dependence on key people, and expect plain answers backed by evidence. The quality of the answers tells you as much as the answers themselves.
- How to calculate what IT downtime really costs your businessEstimate the cost of downtime by adding the wages of the staff who cannot work, the revenue you lose or delay, the cost of fixing the problem and catching up, and any penalties or reputational damage. Even a rough figure per hour turns a vague worry into a number you can weigh against the cost of prevention.
- IT for a business growing from ten to fifty staffBetween ten and fifty staff, IT has to shift from informal habits and one helpful person to repeatable processes: standard devices managed centrally, documented starter and leaver steps, role-based access, stronger security and proper support. Businesses that make that shift early grow smoothly; those that do not usually hit a painful wall around twenty to thirty people.
- Standardising devices and software: why it saves money and how to do itStandardising means choosing a small number of approved laptop, desktop and phone models and a standard list of software, then setting every device up the same way. It makes support faster, security more consistent and purchasing simpler, and for most small businesses it is one of the cheapest ways to make IT run better.
- IT and sustainability: energy, e-waste and practical stepsThe biggest sustainability gains in small-business IT come from keeping devices in use longer, buying fewer and better, switching off and right-sizing equipment, and disposing of old gear through proper e-waste recycling with secure data destruction. These steps usually save money as well, which makes them easier to justify.
- The IT questions government and council tenders ask, and how to prepareGovernment agencies, councils and other public buyers commonly ask suppliers about information security, privacy, data location, business continuity, insurance and how subcontractors handle data. The businesses that answer well usually prepared written policies and evidence before the tender arrived, rather than trying to create them against a deadline.
- Preparing your IT for due diligence when selling or raising investmentBefore selling your business or seeking investment, make sure the business clearly owns its domains, accounts and data, that contracts and licences are documented and transferable, that security basics are in place with evidence, and that systems are documented well enough for a new owner to take over. Doing this months ahead avoids price reductions, delays and awkward surprises.
- Writing the IT section of your business continuity planThe IT section of a continuity plan lists the systems the business needs to keep trading, how quickly each must be restored, how staff will work if the office, internet or a key system is unavailable, who does what, and how the plan is tested. It should cover everyday disruptions like power and internet outages as well as rare disasters.
- Business insurance and IT: what owners should checkIT touches several kinds of business insurance, not just cyber cover: material damage for equipment, business interruption for lost income, professional and public liability, and the conditions inside each policy that may assume you have certain IT controls. Talk to your broker about how each policy treats technology-related losses, because gaps often only appear when you claim.
- Digital skills grants and support for NZ small businessesNew Zealand has government, regional and industry programmes that help small businesses build digital skills or get advice on technology, but they change often and eligibility varies. Check current details with official sources and your regional business support organisation before planning around any funding.
- When is it time to replace a key business system?It is time to replace a key business system when it no longer supports how the business works, staff rely on workarounds to compensate, it is reaching the end of vendor support, or its costs and risks have overtaken the cost and disruption of changing. Plan the decision well ahead, because a forced replacement under pressure is the most expensive way to change.
- How to project-manage an IT change in a small businessTo run an IT change well, define what success looks like, name one person in the business who owns it, agree a realistic plan with the people doing the work, test before go-live, keep staff informed, and finish with a handover and review. Most failed IT projects stumble on unclear goals and poor communication rather than on the technology itself.
- IT reporting a non-technical owner can actually readA good IT report for a non-technical owner fits on one or two pages and answers a few plain questions: are we secure, are backups working, what broke and was it fixed, what is ageing or at risk, what are we spending, and what decisions do you need to make. Anything that does not help answer those belongs in an appendix or nowhere.