A company without its own IT administrator: what it needs to have covered

Who does your IT today?

In smaller companies, usually “whoever knows their way around it”. The accountant who can sort out the printer, the operations manager who once worked on a helpdesk, or the owner's son. It works until something happens that nobody deals with every day: a burnt-out server, encrypted data, an employee leaving whose access nobody revoked.

The problem is not these people's skill. It is that responsibility is not written down anywhere, so in a crisis someone has to go looking for it, and that decisions about IT are made ad hoc, once something has already stopped working.

Which areas does someone have to own?

Four, and the mistake is usually that only one of them is dealt with. Infrastructure, meaning servers, networks and their monitoring. End devices and the software on them. Cyber security, meaning protection and a procedure for when something happens. And hardware purchasing, so that equipment is not bought somewhere different and in a different way every time.

When several suppliers are in charge of them, the main cost is not their invoices but the time spent finding out whose job something is. During an outage this shows in full: everyone confirms that their part is working.

What does an IT audit reveal?

Where the company really stands, which usually differs from what management imagines. The audit covers more than fifty technology areas, and its purpose is not a list of findings but an answer to the question of whether the company is prepared to face an attack and what to do first.

The output is therefore a remediation plan ordered by priority, and recommendations on where to direct IT investment. For owners the latter tends to be more valuable than the former: IT budgets are commonly spent on what is visible, while what is missing are backups that, unbeknown to anyone, have not been verified for years.

What should you keep in-house, even when you hand over IT?

The access through which you own your company. The administrator account for the domain and DNS, the account with the registrar, the billing and administrator accounts for cloud services, licences and their contracts. The supplier should operate these things, not own them.

It is not distrust, it is operational prudence: when you change supplier or when the current one does not respond, this is exactly what determines how quickly you can act. Companies that underestimated this usually discover the problem not when signing the contract but when parting ways, when it turns out that the domain is registered to someone else's email address.

Likewise, decisions about backups stay with you: what is backed up, how long it is kept and when a restore was last tested. Anyone can set up a backup job; what has value is proof that something has actually been restored from it at some point.

Why does a flat fee change the budget?

Because it reverses the logic of paying. When you pay per call-out, you pay when something has broken, so monitoring and prevention are the least profitable things for the supplier. With a regular monthly fee for an agreed scope, you pay for things running, and the budget no longer depends on what happens to break and when.

The second difference is cover for absence. An external team covers infrastructure, virtual environments, networks, office software and security all at once. A smaller company cannot build this scope with its own staff, because it would have to employ a specialist for each of those areas.

What happens when the person who knew their way around leaves?

Usually only then does it become clear how much was only in their head. Where the server with the accounting system is running, why that one printer keeps restarting, who has the key to the server cabinet and which email address the domain reminders go to. The handover takes longer than the notice period, and some of the information is never handed over at all, because nobody knew they should ask.

Only one thing helps against this, and it is not a tool: a written inventory of what the company runs, who manages it and how it is accessed. Incidentally, a company needs the same inventory for risk management too, so the work is not done twice.

When can a company manage on its own?

More often than advertisements admit. A company with a few laptops, no server of its own, email and documents in the cloud and nothing that has to run around the clock usually gets by with one person on the phone. External monitoring starts to make more sense where an outage would bring operations to a halt: in a warehouse, in production, in a shop or in a medical practice.

The second trigger is regulation. As soon as a company provides a regulated service under the Cyber Security Act, security is no longer a matter of judgement and becomes a matter of proof.

Whether the act applies to you, and under which regime, is covered in a separate article. Management of infrastructure, networks and end devices, as well as the IT audit, is provided by our ICT services, while security roles, documentation and testing come from Securent; you will find both in the Cyber security category.