Most small offices in Sackville, Bedford, Halifax and Dartmouth don't have an IT department. They have someone who's "good with computers," a router the internet provider installed years ago, and a Microsoft 365 or Google account that has grown on its own. Most days that works fine, right up until the day it doesn't.
You don't need an enterprise budget for any of the five risks below. Most of the fixes are habits and settings, not new equipment. These are the gaps we run into most often, and what to do about each one.
1. Backups nobody has tested
Most businesses have some kind of backup: an external drive, OneDrive or Google Drive syncing, or a general sense that "the cloud has it." The trouble is that syncing isn't the same as backing up. If a file gets deleted, overwritten or encrypted by ransomware, sync copies that change everywhere. A drive that stays plugged in all the time can get encrypted right along with the computer it's attached to.
A backup you've never restored is a guess.
What to do:
- This week, restore one important folder and one mailbox to a test location. Time how long it takes.
- Keep at least one copy off-site and not permanently connected to your network.
- Write down who restores what, and where those instructions live, so it isn't all in one person's head.
2. No multi-factor authentication on email
Your email account is the master key to the business. Password resets, invoices, client conversations and banking alerts all go through it. If someone gets the password, whether from a convincing fake login page or a password reused on a site that was breached, they can quietly read and send mail as you.
Multi-factor authentication (MFA) means a password on its own isn't enough to get in.
What to do:
- Turn on MFA for every email account. Start with the owner and anyone who handles money.
- Use an authenticator app or a security key instead of text messages wherever you can.
- Don't stop at email. Cover your accounting software, online banking, admin accounts and your domain registrar too.
- Set aside 15 minutes to walk staff through it. Most of the complaints go away after the first week.
3. Shared passwords on sticky notes and spreadsheets
The "front desk" login. One password for the Wi-Fi, the accounting software and the supplier portal. A file called passwords.xlsx on the shared drive. It's convenient, but you can't tell who has access to what, and changing one password means tracking down everyone who uses it.
What to do:
- Use a business password manager. Everyone gets their own vault, and shared logins go into shared folders that you control.
- Give people their own accounts wherever the software allows it. With a shared login, there's no way to tell who did what.
- Change any password that has been written down, emailed around, or reused across several systems.
4. Unpatched computers and an old router
"Remind me tomorrow" turns into months of skipped updates. Windows 10 stopped getting regular free security updates in October 2025, so an office PC still running it without extended updates is falling further behind every month.
Then there's the router. Often it's the one the internet provider supplied, still using the default admin password, with firmware nobody has touched since it was installed. Guests, staff laptops, the smart TV and sometimes the payment terminal all share the same network.
What to do:
- Confirm every computer is actually getting updates, and schedule restarts for after hours so people stop putting them off.
- List any computers that can't run a supported operating system and plan to replace them.
- Log in to the router: change the default admin password, update the firmware, and confirm it uses WPA2 or WPA3 encryption.
- Put guests and gadgets on a separate network from the computers that handle client data.
5. No plan for when someone leaves
Departures are busy. The laptop comes back, but the person's email still works on their phone, they still know the shared passwords, and they might still be an admin on your Facebook page or website. Usually nobody means any harm. It's still a risk, and sometimes the business loses access to something that was set up under that person's personal account.
What to do:
- Keep a one-page offboarding checklist: email, Microsoft 365 or Google, the password manager, accounting, banking, social media, website and domain, alarm codes and keys.
- Disable accounts the same day instead of deleting them, and keep or forward the mailbox so client emails don't go missing.
- Change any shared passwords the person knew.
- Make sure business accounts are registered to a business email address, not someone's personal Gmail.
Where to start
You don't have to fix all five this week. If you only do one thing, turn on MFA for email. Next, test a restore. After that, take one item a month.
If you'd like a second set of eyes, that's what our 30-minute Free IT and Security Checkup is for. We'll look at your backups, security, passwords and devices with you, and you'll get a short written list of your biggest risks, whether or not you hire us. No sales pitch, no obligation. On-site anywhere in HRM, or remote.
Book your Free IT and Security Checkup at openstackforge.ca, call 902-706-8753, or email info@openstackforge.ca.
Calvin Gould, Open Stack Forge, Lower Sackville