Ten questions.
A clearer starting point.
You do not need every technical answer today. Start by knowing which questions to ask, who should answer them and what evidence would help.
Minnesota based · Preparing for launch · Scope agreed before work begins
Bring these questions to your IT provider.
This is an owner discussion guide, not a technical scan or risk score. No answers are collected by this website. Use it to find the people and evidence needed for the next conversation.
- Who owns your critical accounts?List your business email, domain registrar, cloud storage and finance systems. Identify the business owner and administrator for each.
- Where is multi-factor authentication enabled?Ask the administrator to explain coverage and exceptions, especially for email and privileged access. Do not change settings without a test and recovery plan.
- How do people join and leave?Ask who approves new access, removes departing staff and checks contractor accounts.
- Which devices support important work?Identify the agreed business device inventory and who owns update and security responsibilities.
- Who can share files outside the business?Discuss external collaboration, approval and how access is reviewed when a project ends.
- What is actually backed up?Ask for the coverage and retention information for your agreed critical systems and data.
- What was last restored successfully?Ask for documented restore-test evidence and the system or data it covered. Avoid assuming a job-success message proves end-to-end recovery.
- Who verifies payment-detail changes?Decide how a trusted contact is reached through an independently known channel before payment instructions are changed.
- Who gets called when something looks wrong?Keep your IT provider, insurer reporting route and incident-response contacts available. Confirm who has authority to make decisions.
- Who owns the next three improvements?Choose priorities with the appropriate technical owner. Record the owner, next action and target discussion date; validate scope before changes.
Further reading: NIST Small Business Cybersecurity Corner. This original CX discussion guide is informed by common small business security topics. It is not a NIST assessment, certification or endorsement.
Plan your next step
Start with the business.
Get clear on the risk.
Tell us what your company does, the size of your team and what prompted your enquiry. We’ll discuss fit and the scope needed before proposing work.
Preparing for launch. Enquiries are welcome; delivery dates and engagements require finalized onboarding and a written agreement. Please do not email passwords or sensitive security evidence.