Author: Kieran Sapak

A convincing-looking invoice arrives just before lunch. Someone changes the bank details, payment is made, and the problem is not spotted until the real supplier chases for their money. Situations like this are why five security checks, carried out regularly, are far more useful than a long policy nobody has time to read.

For a small business or charity, security is not about becoming a technology expert. It is about making a few sensible checks part of the working routine, so one lost laptop, rushed click or former employee does not turn into days of disruption. The aim is to protect the things your organisation relies on: access to email, customer information, files, money and the ability to keep working.

The five security checks worth putting in the diary

A monthly check is a sensible starting point for most organisations. A slightly longer review every three to six months works well for items such as user access and recovery plans. The right frequency depends on how many people you employ, the information you hold and how often your systems change.

1. Check who can get into your accounts

Your email account is often the master key to the business. It may reset passwords for other services, hold sensitive conversations and contain invoices, contracts and customer details. Start there, then look at finance software, cloud storage, payroll, customer records and any other system used to run the organisation.

Make sure every person has their own login. Shared accounts make it difficult to know who changed something and make access hard to remove when somebody leaves. If a shared mailbox is genuinely needed, give people access through their own accounts rather than passing around one password.

Turn on multi-factor authentication wherever it is available. This is the extra confirmation step, often through an authenticator app or a prompt on a phone, that makes a stolen password much less useful to a criminal. Text messages are better than no second check, but an app-based method is usually preferable where possible.

Then look for accounts that no longer need access. A former staff member, volunteer, contractor or supplier should not still be able to sign in months later. Pay particular attention to accounts with permission to view payroll, change bank details or manage other users.

There is a practical balance here. Too many restrictions can stop people doing their jobs, especially in a small team where roles overlap. But giving everyone full access “just in case” creates a much bigger risk. Give people the access they need today, not every permission they might possibly need one day.

2. Check that devices and software are being updated

Updates can feel like an interruption, particularly when a laptop wants to restart in the middle of a busy day. Yet many updates fix known weaknesses that criminals already know how to exploit. Delaying them indefinitely is like leaving a broken lock because replacing it is inconvenient.

Check that work laptops, desktop PCs, tablets and phones are still receiving operating system updates. Also check key applications, such as internet browsers, office software, accounting tools and security software. Devices that are too old to receive updates deserve special attention. They may still switch on and appear perfectly usable, but they can become a growing security and reliability problem.

Keep an eye on the basics as well. Each device should have a screen lock, a strong sign-in method and security software appropriate to the device. Laptops that leave the office should be encrypted, meaning the information on the drive is protected if the device is lost or stolen.

Automatic updates reduce the burden, but do not assume they have worked without checking. A device that has been switched off for weeks, has little free storage or has an error message can quietly fall behind. A short monthly review helps catch these before they become an emergency.

3. Check that your backups can actually be restored

A backup is only useful if you can get your information back when you need it. Files can be lost through accidental deletion, equipment failure, ransomware or an incorrect change that is not noticed for days. Keeping everything in one place, even if that place is cloud-based, is not the same as having a recovery plan.

First, confirm what is backed up. Include the files that matter most, but also consider financial records, shared folders, contact lists and any specialist data your organisation needs to operate. Be clear about where the backup is stored and who can access it. If only one person knows the password or process, that is a weakness in its own right.

The crucial check is a test restore. Pick a non-sensitive file or folder and recover it to a safe location. Can you find the right version? How long did it take? Could someone else follow the instructions if the usual person was away? A backup system can report that it has run successfully while still missing an important folder or keeping versions for too short a period.

Keep at least one backup separate from the main systems, so an attacker cannot simply delete both the live files and the copies. The exact setup depends on the tools you use, but the principle is simple: do not put every copy of important information behind the same login or in the same basket.

4. Check your defences against email fraud

Most small-business cyber incidents begin with a message that asks someone to act quickly. It might pretend to be a supplier with new bank details, a director requesting gift cards, a delivery company asking for a payment or a familiar contact sharing a file.

Technology can filter a lot of unwanted email, but it cannot make judgement calls for your staff. Agree a straightforward payment verification process. If bank details change, confirm them using a known telephone number or an established contact method, not the number or link in the unexpected email. The same applies to urgent requests that seem to come from a manager.

During this check, ask whether everyone knows what to do with a suspicious message. They should not feel embarrassed about asking. A quick “does this look right to you?” is much cheaper than trying to recover a payment sent to a fraudster.

It also helps to make reporting easy. Decide who staff should tell, what information they should keep, and who can contact the bank if a payment is involved. Speed matters after a mistake, so a clear response is more valuable than blaming the person who clicked.

5. Check your permissions and your plan for a bad day

The final of the five security checks looks at two things that are easy to overlook when work is going smoothly: who can see your data, and what happens when something goes wrong.

Review shared folders, customer databases and finance systems for overly broad permissions. Sensitive material should not be available to every member of staff simply because it is easier to set up that way. Check also for personal email addresses, old external collaborators and links that allow anyone with the link to view or edit a document.

Next, write down a simple incident plan. It does not need to be a thick folder of technical language. It should say who makes decisions, how to contact your IT support, how staff should report a concern, and what to do if a device is lost, an account appears compromised or files become unavailable. Keep key contact details somewhere accessible if email is the problem.

Run through one realistic scenario with the team. For example, what would happen if the office manager’s laptop went missing on a train, or if someone received an email saying the director needed an urgent payment? The exercise often reveals small gaps, such as nobody knowing who has authority to pause payments or remove an account.

Security is not a one-off job to tick off and forget. It is a useful habit of noticing changes before they become expensive distractions. Put the next review in the diary, give one person responsibility for chasing it, and keep the process simple enough that it actually gets done.

A new Microsoft 365 subscription can look like the answer to every admin headache: professional email, shared files, Teams calls and familiar Office apps in one place. But a rushed Microsoft 365 setup for small business can create problems that only appear later – missing emails, confusing permissions, former staff retaining access, or files saved in places nobody else can find.

The good news is that it does not need to become an IT project of epic proportions. Start with the way your organisation actually works, make a few sensible choices early, and keep the setup easy for people to use every day.

Start with people, not the licence

Before buying licences or creating accounts, write down who needs access and what they need to do. Include employees, trustees, volunteers, part-time staff and anyone who regularly handles customer information. A person who only needs email and Teams may need a different plan from someone who creates spreadsheets, presentations and documents all day.

For many small businesses and charities, Microsoft 365 Business Basic, Business Standard or Business Premium are the usual starting points. Basic covers web and mobile apps, email and collaboration. Standard adds the desktop Office apps. Premium adds more advanced device management and security controls.

The right option depends on your working habits, not on which package has the longest feature list. If everyone works from their own laptops and handles sensitive information, Premium may be worth the extra cost. If your team mainly uses shared office computers and needs reliable email and documents, Standard may be plenty. Paying for features nobody will use is not good value, but under-buying can lead to awkward workarounds later.

At this stage, also decide who will be responsible for day-to-day administration. This does not mean they must fix every technical problem. It means someone needs to know where new users are added, where passwords are reset and who to contact when something is unclear. Avoid making every owner or manager a full administrator just because they might need access one day.

Set up your business email properly

Your email address is often the first part of Microsoft 365 that customers see. Using your own business domain, rather than a personal email account, looks more professional and keeps business communication separate from an individual’s account.

Moving email requires care. Messages, contacts and calendars may be spread across an old provider, Outlook files or several personal inboxes. Before changing anything, identify where the current email lives, how much needs to be moved and whether anyone has important folders stored only on their computer.

The technical change involves updating domain records so new messages are delivered to Microsoft 365. It is a normal part of the process, but timings matter. Make the switch during a quieter period where possible, and make sure every user can sign in before relying on the new service. Keep the old mailbox available until you have checked that historical emails have arrived and new messages are flowing correctly.

Use sensible, consistent email names from the beginning. Firstname.lastname@ is easy to understand, while shared addresses such as enquiries@, accounts@ or bookings@ can be assigned to the people who deal with those messages. A shared mailbox is usually a better choice than giving several people the password to one general inbox. It gives the team access while keeping individual sign-ins separate.

Build accounts that are easy to manage later

Create one account per person, even if two people share a role. Individual accounts make it much easier to see who has access, remove it when they leave and investigate an unusual sign-in. Shared passwords are tempting when things are busy, but they create a security and accountability problem very quickly.

Use clear display names, job titles and contact details. These small details make Teams meetings, address books and handovers less confusing. If someone works with a charity or client in a volunteer capacity, their access should still reflect what they need, rather than giving them the same permissions as a director by default.

Set up a simple joining and leaving process too. When someone starts, create their account, give them only the necessary access and show them where key files live. When someone leaves, block sign-in promptly, remove access from shared areas and arrange what happens to their email and files. The best time to plan this is before the first departure, not during one.

Make security part of the Microsoft 365 setup for small business

Small organisations are not too small to be targeted. Most attacks are automated and look for simple openings, such as a reused password or an account without multi-factor authentication.

Multi-factor authentication, often shortened to MFA, should be turned on for every account. It asks for a second proof of identity when somebody signs in, usually through an authenticator app or a code. It adds a small step at sign-in, but it is one of the strongest protections you can put in place.

Avoid relying on text messages if an authenticator app is practical for your team. More importantly, make sure users understand that an unexpected approval request is not something to tap through. If they did not try to sign in, they should reject it and tell the person managing IT.

Also check the recovery details for administrator accounts. Use more than one administrator, but keep the number low. If the only admin account is locked out or belongs to someone who is away, even a simple change can become frustrating. Store recovery information safely and make sure it is not tied solely to one employee’s personal phone.

Microsoft 365 includes useful security features, but it does not remove the need for good habits. Staff should know how to spot suspicious invoices, unusual password reset emails and unexpected file-sharing invitations. A short, plain-English briefing is more likely to stick than a thick policy document nobody reads.

Give files a sensible home

OneDrive and SharePoint are often misunderstood because both store files, but they are designed for different jobs. OneDrive is for an individual’s working files. SharePoint is for documents the team needs to find, use and keep after a person moves on.

A practical rule is simple: if a file belongs to the organisation, put it in a shared team location. This includes quotes, policies, finance folders, project documents and meeting notes. If it is a draft, personal working note or something not yet ready for others, OneDrive may be the better home.

Create a small number of clear shared areas rather than dozens of Teams channels and folder structures. Most small organisations can begin with sections such as General Administration, Finance, Projects and People. Agree who can edit sensitive folders, especially anything involving payroll, personal data or client records.

Be careful with external sharing. It can be useful when working with an accountant, supplier or partner organisation, but it should be intentional. Give access to the specific folder or file needed, review it afterwards and avoid sending documents as unprotected email attachments when a controlled shared location will do.

Set Teams up for useful conversations

Teams works best when it supports real work rather than becoming another noisy place to check. Keep your first structure modest. Create teams for genuinely distinct groups or projects, and use channels only where they help people separate conversations.

Decide where different types of communication belong. For example, quick questions may suit chat, project updates may belong in a channel, and decisions that need a clear record may need an email or meeting note. There is no perfect rule for every business, but an agreed approach prevents important details disappearing in a long stream of messages.

Check notification settings with staff, particularly people who work part-time or use personal mobiles. Teams can improve communication, but constant alerts can make it feel like work follows people everywhere. A few minutes spent adjusting notifications can make adoption far less stressful.

Test the everyday jobs before calling it finished

A setup is not complete because every account exists. Test it from the user’s point of view. Can a new member of staff sign in on their usual device? Can they send and receive email? Can the right people open shared files, join a Teams meeting and use the Office apps they need?

It is also worth testing what should not work. A volunteer should not be able to open payroll files. A former staff member should not retain access. A shared mailbox should not require the whole team to know one password. These checks reveal permission issues while they are still easy to fix.

Finally, think about backups and retention. Microsoft 365 protects its service, but that is not always the same as having an independent copy of every deleted or changed file for as long as your organisation may need it. The right approach depends on the sensitivity of your data, any legal or funder requirements, and how disruptive a loss would be.

A well-planned Microsoft 365 setup should make Monday morning easier, not give your team another system to fear. Keep the rules clear, show people the few things they need to do confidently, and get friendly support when the technical bits stop feeling simple.

A lost spreadsheet is annoying. A lost customer database, case file folder or month of accounts can stop a small business in its tracks. That is why the question, how often should business data be backed up, deserves a more useful answer than “every now and then”. The right schedule depends on how much work you could realistically afford to recreate after a problem.

For many small businesses and charities, a sensible starting point is automatic daily backups, with more frequent protection for files that change throughout the day. But frequency is only one part of the picture. A backup that has not been checked, cannot be restored, or lives in the same place as the original data may not help when you need it.

How often should business data be backed up?

Think about the answer in terms of acceptable loss. If a laptop failed at 4 pm, how far back could you go without causing serious disruption? If losing a full day’s work means staff would spend hours rebuilding records, chasing paperwork or re-entering invoices, daily-only backups may be too infrequent.

A practical rule of thumb is to back up core business data every day at a minimum. This covers documents, accounts information, customer records, project files, email where appropriate, and any specialist application data your organisation relies on. For information that changes regularly, such as bookings, sales, job notes or shared working files, backups every few hours – or continuous version history – are a better fit.

Not every file needs the same treatment. A folder of old marketing images does not carry the same urgency as payroll records or a live client case file. Setting one blanket rule for everything can either leave important work exposed or create unnecessary cost and clutter.

A simple schedule for most small organisations

For a typical office with a few to a few dozen people, this pattern is usually sensible:

• Critical live data: every hour, or continuously where the system allows it.
• Everyday documents and shared folders: daily automatic backup.
• Finance, personnel and compliance records: daily backup, with retained historical copies.
• Archive material that rarely changes: weekly or monthly backup after it has been safely stored.

This is not about making backups complicated. It is about matching the protection to the consequence of losing the information. If your team updates one shared job tracker all day, protecting it once overnight is a gamble. If you scan historic paperwork once a month, a less frequent schedule may be perfectly reasonable.

Start with the data that would hurt to lose

Businesses often assume that “our files” are all in one place. In reality, vital information may be spread across staff laptops, shared cloud storage, mobile devices, accounting software, email, USB drives and specialist systems. A backup plan only protects what it actually includes.

Start by asking a few plain questions. Where does the team create and save work? Which systems hold customer or supporter information? What would you need to recover first to keep trading? Who is responsible for checking that backups are running?

The answers can be surprisingly revealing. For example, a business may back up its office computer every night but discover that its most recent quotations sit only on a salesperson’s laptop. Or a charity may have copies of its documents but no exported copy of key records held in an online platform. Cloud services often provide useful protection, but synchronisation is not always the same as backup. If a file is deleted or damaged, that change may synchronise too.

Make a short list of your critical data and systems. You do not need a technical inventory worthy of a large corporation. A clear one-page record is enough to begin: what the data is, where it lives, how often it changes and how quickly you would need it back.

Frequency is only useful if you can restore

Backups are often treated like insurance policies: reassuring to have, easy to forget about. The awkward difference is that an insurance policy does not need testing before a flood. Your backup does.

At least every three to six months, carry out a simple restore check. Pick a few files, restore them to a safe location, and open them. Confirm that the version is recent enough, the file is usable and the right people know what to do. Once a year, test a more realistic scenario, such as recovering a whole folder or replacing data on a spare device.

This test is where hidden problems appear. The backup may have been running under an old staff account. It may be missing a folder added after the original setup. It may be protected by a password nobody can find. Catching those issues on an ordinary Tuesday is far better than discovering them during a rushed recovery.

Keep more than one copy, in more than one place

A good backup routine protects against more than accidental deletion. Devices can fail, be stolen, suffer water damage, or be affected by malicious software. One extra copy on a USB drive in the same office is better than nothing, but it may be lost in the same incident as the computer.

A straightforward approach is often called the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy kept separately from your usual equipment. The wording sounds technical, but the principle is simple. Do not put all your eggs in one digital basket.

For many organisations, this means the working copy, an automatic local backup and a securely stored off-site copy. The off-site copy helps if there is a problem at the premises, while a local copy can make recovering a large amount of data quicker. The exact arrangement will depend on your budget, internet connection, data volumes and how quickly you need to be operational again.

Security matters here too. Backups can contain personal data, financial information and confidential documents, so they should be encrypted and access should be limited to the people who need it. If you use a removable drive, keep it secure rather than leaving it in a desk drawer next to the computer it backs up.

Decide how long to keep old versions

Backing up frequently is helpful, but keeping only the latest copy has a weakness. You may not notice that a file has been corrupted, overwritten or deleted for several days. By then, the one saved version could contain the same problem.

Version history gives you a way back. A sensible retention approach might keep daily copies for a month, monthly copies for a year, and selected records for longer where legal, financial or contractual duties require it. Your accountant, regulator or funder may have specific retention expectations, so do not rely on a generic schedule where those rules apply.

There is a trade-off. Longer retention uses more storage and can make the system harder to manage. The goal is not to preserve every draft forever. It is to keep enough history to recover from the mistakes and incidents that are most likely to affect your organisation.

Common backup mistakes that are easy to avoid

The biggest mistake is relying on someone to remember. Manual copying has its place for an extra archive, but it is rarely dependable as the main plan. Holidays happen, busy periods happen, and the one person who knows the process may leave.

Another common issue is assuming a synced folder is automatically protected. Syncing is excellent for helping people work from different devices, but it can copy unwanted changes as efficiently as wanted ones. Check whether your chosen system offers version history and whether it covers all the folders you rely on.

Finally, do not overlook the recovery instructions. Write down where the backups are, who has access, how to restore them and who to contact if the usual person is unavailable. Keep those details somewhere accessible if your main computer is unavailable.

Make the plan fit your working day

The best backup plan is not the most expensive or complicated one. It is the one that runs reliably in the background, protects the right information and has been tested before an emergency. If you are unsure where your important data is held, or whether your current setup can actually restore it, that is a sensible place to get help rather than guessing.

A short review now can save days of disruption later. Choose the amount of work you can afford to lose, automate protection around that decision, and put a reminder in the diary to test a recovery. That small bit of housekeeping gives your team something far more valuable than extra storage: the confidence that a bad day does not have to become a crisis.

A stolen password should not be enough to open the door to your business. Yet passwords are still guessed, reused, leaked and tricked out of people through convincing-looking emails. So, what is multi factor authentication? It is a simple extra security check that asks you to prove it is really you before giving access to an account.

For a small business or charity, multi factor authentication, often shortened to MFA, is one of the most useful protections you can put in place. It takes a few extra seconds when someone signs in, but it can prevent a far more disruptive problem: an outsider reading emails, changing bank details, accessing customer information or pretending to be a member of staff.

What is multi factor authentication?

Multi factor authentication means using two or more separate ways to verify your identity. Your password is the first factor. The second factor might be a code from an authenticator app on your phone, a prompt you approve in that app, a fingerprint or a physical security key.

The key idea is that a criminal needs more than your password. Even if they have obtained it, they should still be stopped because they do not have your phone, fingerprint or security key.

You may also hear the term two factor authentication, or 2FA. This is a type of MFA that uses exactly two checks, usually a password plus one other method. In everyday conversation, people often use MFA and 2FA to mean much the same thing.

Why passwords alone are no longer enough

A strong, unique password still matters. It is your first line of defence. The problem is that passwords can be exposed without anyone breaking into your computer.

A staff member may reuse a password from another service that later suffers a data breach. Someone may enter their details into a fake Microsoft 365 sign-in page after receiving a realistic phishing email. Or a password may be shared informally and then forgotten about when a volunteer or employee leaves.

Without MFA, that password can be all an attacker needs. With MFA turned on, a sign-in attempt from an unfamiliar device triggers another check. The attacker may know the password, but they cannot complete the sign-in.

This matters especially for email. Email accounts often contain invoices, personal information, reset links for other services and conversations that reveal how your organisation works. Once inside an email account, a criminal can watch messages, impersonate a director or request a payment at exactly the wrong moment.

The common types of MFA, in plain English

Not all second checks offer the same level of protection. The best option depends on the systems you use, how your team works and how much support they need.

Authenticator app

An authenticator app generates a short code that changes regularly, or displays a sign-in prompt for you to approve. Common examples include Microsoft Authenticator and Google Authenticator.

For most small organisations, this is a sensible starting point. It is quick, does not rely on a mobile signal and is generally safer than receiving a code by text message. Each person should use their own app on their own phone, rather than sharing codes or setting up one device for the whole team.

Push notification

With a push notification, a message appears on your phone asking whether you are trying to sign in. You tap approve or deny. It is convenient, but it needs care.

Never approve a prompt you did not expect. Criminals sometimes try repeated prompts in the hope that a tired or busy person taps approve just to make them stop. If that happens, deny the request and change your password. Where available, use number matching, which asks you to enter a number shown on the sign-in screen before approval.

Text message code

A code sent by SMS is better than having no MFA at all, and it can be useful where a person cannot use an app. However, it is not usually the first choice. Text messages can be delayed, phones can be lost, and there are more ways for criminals to interfere with a mobile number than with an authenticator app.

Treat SMS as a practical fallback, not your preferred method for your most important accounts.

Security key

A security key is a small physical device, often plugged into a USB port or tapped against a compatible phone. It provides very strong protection and is particularly useful for people with access to finance, sensitive records or administrator accounts.

It does bring a practical responsibility: keys can be misplaced. Keep a spare key securely stored and make sure more than one trusted person knows the recovery process.

Where should a business start?

Start with the accounts that could cause the greatest damage if they were taken over. For most organisations, that means email, Microsoft 365 or Google Workspace, accounting software, banking, payroll, customer databases and any account used to manage staff access.

Do not forget administrator accounts. These accounts can create users, reset passwords and change security settings. They need particularly careful protection, ideally with an authenticator app or security key and a separate, unique password.

If you run a charity, this is just as relevant. Donor details, grant applications, financial records and beneficiary information can all be sensitive. MFA is not only about avoiding inconvenience; it helps you meet the trust people place in your organisation.

A sensible way to introduce MFA to your team

Turning on MFA without a little planning can create avoidable frustration. The goal is to make the secure choice the easy choice.

First, make a short list of the accounts your organisation relies on and identify who owns each one. Check that personal accounts are not being used for business logins where a shared or managed account would be more appropriate.

Next, choose your standard method. An authenticator app is usually the clearest option for staff and regular volunteers. Give people time to set it up while they have access to help, rather than forcing everyone to do it during a busy morning.

Then, record recovery details safely. Many services provide recovery codes when MFA is enabled. Store these in an approved, access-controlled password manager or another secure location. Do not leave them in an open spreadsheet, a desk drawer or an email inbox.

Finally, explain the one rule everyone must remember: no unexpected prompt should ever be approved. A five-minute explanation can prevent a costly mistake.

What happens if someone loses their phone?

This is the question that often puts people off. A lost phone is inconvenient, but it is manageable if you prepare for it.

Make sure the phone itself has a screen lock. Where your chosen service allows it, register a backup method, such as a second authenticator device, recovery codes or a security key. Keep a clear process for who can help a member of staff regain access and how their identity will be checked first.

Avoid making one person the only route back into every account. If the owner is on holiday, unwell or has left the organisation, you still need a safe way to manage access. This is one area where a little documentation saves a lot of stress later.

MFA is powerful, but it is not magic

MFA dramatically reduces the risk from stolen passwords, but it does not make every scam disappear. Someone can still be persuaded to share a code, approve a fraudulent prompt or send money after receiving an impersonation email.

That is why MFA works best alongside a few sensible habits: unique passwords stored in a password manager, software updates, limited access for each role and a clear process for checking unusual payment requests. For example, a request to change supplier bank details should be confirmed using a known phone number, not the number included in the email.

There is also a balance to strike. If security is so awkward that staff look for workarounds, it is not doing its job properly. Choose a method people can use confidently, provide straightforward guidance and review access when somebody joins, changes role or leaves.

A small step that protects real work

MFA can sound like another piece of IT jargon, but the everyday benefit is straightforward: a password leak does not automatically become a business breach. Set it up first for the accounts you would least like to lose, make sure your team knows what an unexpected prompt looks like, and keep recovery options organised. That modest extra check can protect a great deal of time, money and trust.

A convincing phishing email rarely looks like the old-fashioned scam messages full of spelling mistakes. It may appear to come from Microsoft, your bank, a supplier, a charity colleague or even your own director. Learning how to spot phishing emails is less about becoming suspicious of everything and more about knowing which small details deserve a pause.

For a small business or charity, that pause can prevent a stolen password, a fraudulent payment or a locked computer at the worst possible time. The good news is that you do not need to be an IT specialist to make safer decisions. A calm, repeatable check is usually enough.

How to spot phishing emails: start with the request

Do not begin by judging the logo or the layout. Criminals can copy both very well. Start with what the message wants you to do.

Phishing emails commonly push you to sign in, open an attachment, pay an invoice, change bank details, share information or buy something quickly. None of those actions is automatically unsafe, but urgency is often the giveaway. A message claiming your account will be closed in 30 minutes, that a payment must be approved immediately, or that the chief executive needs gift cards before a meeting is designed to rush your judgement.

Take a breath and ask: would this person or organisation normally ask for this by email? Is the timing believable? Can I confirm it another way? A genuine request can usually wait for a quick phone call, Teams message or conversation with the sender using contact details you already trust.

This is especially useful for payment requests. If a supplier says their bank details have changed, do not reply to that email to check. Call the number you have on file or from a previous legitimate invoice. A compromised supplier account can send very believable messages, so a familiar name alone is not proof.

Check who really sent it

The display name at the top of an email is easy to fake. What matters is the full email address behind it.

A message may say it is from “Microsoft Support” while the actual address ends in a completely unrelated domain. Other scams use lookalike spellings, such as replacing a letter with a number or adding an extra word: `accounts@micros0ft-security.example` rather than a genuine business address. On a phone, you may need to tap the sender’s name to reveal the full address.

Be alert, but do not assume every unusual-looking address is a scam. Some organisations use external mailing services, and smaller suppliers may have a different domain from the name you know. The key is whether it makes sense in context. If it does not, verify independently before acting.

Reply addresses matter too. An email can appear to come from a colleague but send replies somewhere else. If you hit Reply and the address changes to one you do not recognise, stop there.

Treat unexpected attachments with care

An attachment can be genuine and still be dangerous. An invoice, delivery note, CV or shared document is a common route because it looks routine in a busy office.

Be particularly cautious if you were not expecting a file, if the email gives little explanation, or if the attachment has an unusual type. Files ending in `.exe`, `.js`, `.zip` or `.html` deserve extra scrutiny. Microsoft Office files that ask you to “enable content” or “enable macros” should also raise a red flag. In most everyday work, there is no good reason to enable macros in a document sent unexpectedly.

A PDF is not automatically safe either. If an email says “view document” and the attachment or button takes you to a sign-in page, treat it as a possible password-stealing attempt. Confirm with the sender first.

Hover before you click

Links are where many phishing emails do their damage. The visible words may say “View invoice” or “Sign in to Microsoft 365”, but the actual destination could be somewhere entirely different.

On a computer, hover your mouse over a link without clicking it. Most email programs show the web address near the bottom of the window. On a mobile, press and hold the link carefully to preview it. Look for misspelt names, odd domains and long strings of random characters.

A safe-looking beginning does not guarantee a safe destination. For example, `microsoft-login.example.co.uk` is not a Microsoft address simply because the word “microsoft” appears at the start. The important part is the actual domain near the end, before any final extension such as `.co.uk` or `.com`.

If you receive a message from a service you use, the safer habit is to open the service yourself from your normal bookmark or app, then check for notifications there. This takes a few extra seconds and removes the risk of following a disguised link.

Watch for pressure, secrecy and unusual tone

Phishing works because it targets normal human reactions: wanting to be helpful, avoiding trouble and getting a task off the list. The language often creates pressure or secrecy.

Watch for messages that ask you to keep a request confidential, bypass the usual approval process, or act while someone is travelling and cannot be contacted. A supposed manager asking a member of staff to buy gift cards is a classic example. So is a request to send payroll details or customer information “just this once”.

Tone can help, although it is not a reliable test on its own. An email from a colleague that suddenly sounds formal, vague or unlike them may be suspicious. Equally, modern scams can be well written, particularly when criminals use copied messages or automated writing tools. Good grammar is not a safety certificate.

Look out for QR codes and fake sign-in pages

QR codes are increasingly appearing in phishing emails because they encourage you to switch from a work computer to a personal phone. The code may claim to let you view a document, renew a password or complete security checks. Once scanned, it can lead to a fake sign-in page that steals your account details.

Do not scan a QR code in an unexpected email. If the request might be genuine, go directly to the relevant service instead.

A fake sign-in page can look almost identical to a real one. Before entering your password, check the address bar carefully. Also notice whether the page asks for more than usual, such as your password, recovery details and a one-time code all at once. Never approve a multi-factor authentication prompt you did not initiate yourself. That approval can be the final step a criminal needs.

Use a simple three-step check

When an email creates even a small sense of doubt, use this routine before clicking, replying or forwarding information:

1. Pause. Do not let an urgent subject line make the decision for you.
2. Inspect. Check the sender address, the request, any attachment and the link destination.
3. Verify. Contact the person or organisation using a trusted phone number, saved contact or a separate new message.

It is better to verify a real email than to apologise after responding to a fake one. Legitimate suppliers, colleagues and banks understand that security checks are part of doing business sensibly.

What to do if you think an email is phishing

If you have not clicked anything, report the message through your email program’s phishing or junk reporting option, then delete it. If it claims to be from a known organisation, you can forward it to that organisation’s fraud-reporting address if one is provided through its official channels. In the UK, suspicious emails can also be reported to the National Cyber Security Centre’s Suspicious Email Reporting Service.

If you clicked a link but did not enter any details, close the page and let your IT support provider know. They can check whether anything else needs attention. If you entered a password, change it immediately from the genuine service site, not from the email link. If you use that password elsewhere, change those accounts too, starting with email, banking and other important services.

If money, bank details or sensitive personal information may have been shared, contact your bank promptly and tell the relevant people in your organisation. Speed matters here, but there is no need for panic. Clear information about what happened, when, and what was clicked helps support teams respond effectively.

Make phishing harder to succeed

The strongest protection is a team that feels comfortable asking questions. Make it normal for staff and volunteers to check unusual requests, particularly payments and changes to personal data. Nobody should be embarrassed for pausing a task that looks wrong.

Use a different, strong password for every important account and turn on multi-factor authentication wherever it is available. Keep devices and software updated too, since updates fix known weaknesses that criminals may exploit. These steps will not stop every phishing email from arriving, but they can greatly reduce the harm if one slips through.

Most phishing attempts rely on you feeling rushed, isolated or unsure. Give yourself permission to slow the moment down. A quick independent check is not being difficult – it is good business practice, and it keeps the people and information you look after safer.

A staff member cannot open an invoice five minutes before it is due to be sent. A laptop asks for a password nobody recognises. Microsoft 365 is working for everyone except the person who needs it most. These are the moments when remote IT support for small business earns its keep.

For many small businesses and charities, IT is not a full-time job until something breaks. Then it becomes everyone’s problem: work stops, customers wait and the least technical person in the room is often left searching for answers. Remote support gives you a reliable person to call without paying for a full-time IT employee.

What remote IT support for small business actually means

Remote IT support means a technician can securely view or control an approved computer over the internet, with your permission, to diagnose and fix a problem. Often, this can be done while you stay at your desk. You can see what is happening, ask questions and get back to work without packing up equipment or waiting for a visit.

It is a practical fit for common day-to-day issues: computers running slowly, software not opening, email account problems, printer settings, access to shared files, user accounts and security updates. It can also cover proactive care, where your provider monitors agreed devices and deals with smaller issues before they become a disruptive Monday-morning surprise.

That does not mean someone has unrestricted access to every device forever. A reputable provider should explain how remote access works, when it is used and how it is protected. You should know who can connect, what information they can see and how to stop a session if you need to.

When remote support is a good fit

Remote help is most useful when your team relies on a handful of essential devices and services but does not need an in-house technician. It suits businesses that want quick answers, predictable support and advice in plain English when buying or setting up technology.

It can be especially helpful when staff work from different locations. Rather than asking someone to bring a laptop into the office for a small issue, a technician can often resolve it from wherever the employee is working. This saves travel time and helps keep minor problems from turning into a lost afternoon.

For a growing business, it also creates consistency. New starters can be set up properly, departing staff can have access removed, and everyone can use the same sensible approach to passwords, updates and file sharing. The aim is not to make your business more complicated. It is to remove the little bits of technology friction that keep interrupting real work.

What a helpful remote IT service should cover

The right level of support depends on your business. A two-person practice with a few laptops has different needs from a charity with volunteers, shared tablets and several office computers. Still, a good service should be clear about what is included rather than hiding behind vague promises of “complete IT solutions”.

Day-to-day troubleshooting should be part of the conversation. If an application freezes, a computer cannot connect to the office printer or a staff member is locked out of an account, you need to know how to request help and how quickly you can expect a response.

Preventative work matters too. Updates, device health checks, antivirus management and sensible backup arrangements are less exciting than rescuing a broken laptop, but they reduce the number of urgent calls. Your provider should explain these in terms of the risk they reduce, not just a list of technical features.

Security guidance is another valuable part of the service. Small organisations are regularly targeted because criminals expect fewer safeguards. Clear advice on spotting suspicious emails, using multi-factor authentication and protecting customer information can prevent a costly mistake. Good support should make security feel achievable, not frightening.

Finally, look for practical purchasing advice. Before you replace a laptop, add a printer or choose a new mobile phone for work, it helps to ask someone who understands how it will fit with what you already use. The cheapest option is not always the best value, but neither does every small business need enterprise-grade equipment.

How remote support works in practice

Most support requests start simply: a phone call, email or support request describing what has gone wrong and when it started. The more detail you can give, the quicker the diagnosis is likely to be. A screenshot of an error message can be more useful than a description such as “it has stopped working”.

The technician may first talk you through a quick check. Sometimes the answer is genuinely simple: a cable has worked loose, a program needs restarting or an account has been signed in on the wrong device. There is no shame in that. Straightforward fixes are still fixes.

If a closer look is needed, they will ask you to approve a remote session. You should be able to see when the session is active and end it when the work is finished. A capable technician will explain the issue without turning the call into a lecture. You need to know what happened, what has been done and whether there is anything your team should do differently next time.

Some jobs need more than remote access. A damaged laptop screen, a failed hard drive, a network fault in the building or setting up several new devices may require an on-site visit. For businesses in Somerset and Wiltshire, having a support partner that can combine fast remote help with local hands-on assistance can be reassuring. Remote support is not a replacement for every kind of IT work. It is a way to solve the majority of everyday problems faster.

Questions to ask before choosing a provider

The best support arrangement is not necessarily the one with the longest feature list. It is the one your team will actually use when they are stuck. Start by asking how you contact the provider and what response times apply during your working hours. “Unlimited support” sounds attractive, but it is worth understanding what that means in real situations.

Ask whether support is charged per issue, by the hour or through a monthly agreement. Pay-as-you-go support may work well for a very small organisation with occasional needs. A monthly arrangement can be easier to budget for if you have several users, rely heavily on your systems or want regular maintenance included. There is no universal right answer – it depends on how disruptive downtime is for you.

You should also ask about communication. Will you speak to a familiar person who understands your setup, or be passed around a large helpdesk? Can they explain recommendations without jargon? Do they document key details, such as who has access to which accounts and what equipment you own? These details make support calmer and quicker when something goes wrong.

Privacy deserves a direct question as well. Your provider may see business records, customer details or staff information while helping you. They should have clear processes for remote access, passwords and data handling. If an explanation feels vague, keep asking. Trust is part of the service, not an optional extra.

Avoid treating support as an emergency-only expense

It is tempting to wait until a computer fails before paying for help. That can appear cheaper, particularly when the business is busy and technology seems to be behaving. The trade-off is that urgent fixes often arrive at the worst possible moment, when there is no time to compare options or recover calmly.

A little ongoing care can make technology feel far less dramatic. Regular updates, clear user access, tested backups and someone who knows your setup give you more control. They also mean your staff are less likely to spend their own time trying random fixes from internet forums.

The purpose of remote IT support is not to turn every small issue into a support ticket. It is to give your business a sensible safety net and a friendly route to an answer when technology gets in the way. When your team knows help is available, they can spend less time worrying about the tools and more time serving the people who rely on them.

A volunteer cannot open the shared files just before a funding deadline. The printer has stopped talking to the office computers. A staff member receives a suspicious email that looks as though it came from the chair of trustees. These are not glamorous IT problems, but they can quickly take time away from the people your charity exists to help.

Outsourced IT support for charities gives you a dependable person or team to call when technology gets in the way. Rather than asking an already busy colleague to become the accidental IT expert, you pay for practical help, guidance and preventative care. For many smaller charities, it is a more realistic option than employing a full-time IT manager.

The right arrangement should feel less like calling a distant call centre and more like having a calm, knowledgeable colleague who explains what is happening and what needs to happen next.

Why charities need a different approach to IT

Charities often work with limited budgets, a mix of paid staff and volunteers, and technology bought at different times for different needs. One person may use a charity-owned laptop in the office, while another uses a personal device from home. Trustees may need secure access to documents but only occasionally. New starters and volunteers need to get up and running without a complicated process.

That mix makes consistency difficult. It also means a small issue can affect a lot of people. If no one knows who controls an account, where important files are stored or whether a laptop is properly protected, the risk is not merely inconvenience. It can affect confidential information, donor trust and the charity’s ability to operate.

A good support partner starts with the way your charity actually works. They should not push expensive systems simply because they are familiar with them. Sometimes the answer is a better set-up for the tools you already pay for, clearer access rules, or replacing one unreliable device before it causes a bigger problem.

What outsourced IT support for charities should include

The details vary, but day-to-day support should cover the technology that people rely on to do their jobs. That might mean help with laptops, desktop computers, email, shared documents, printers, video calls and common software problems. Crucially, support should be available to the people using the equipment, not just to whoever happens to be confident with technology.

There should also be a preventative element. Waiting until something breaks is usually the most stressful and costly way to manage IT. Regular checks, software updates, security protection and sensible backups reduce the chance of a problem becoming a crisis.

Security deserves plain speaking. It is not about turning a small charity into a major corporation. It is about taking sensible steps: strong unique passwords, multi-factor authentication where available, controlled access when someone leaves, protected devices, and staff who know how to pause before clicking a suspicious link. Your support provider should explain these measures clearly and help make them workable.

Planning is another valuable part of the service. If several computers are nearing the end of their useful life, it is far easier to budget for replacements over time than deal with multiple failures in the same month. A useful provider keeps a simple record of your key equipment and advises you before decisions become urgent.

The real benefit is fewer interruptions

The most obvious reason to outsource is access to expertise without a full-time salary. That matters, but it is not the only saving. Think about the hidden cost of interruptions.

When the operations manager spends half a day trying to fix a login issue, their normal work does not disappear. When a volunteer is unable to access the information they need, someone else has to step in. When everyone shares the same old password because nobody is sure how to manage access properly, a small shortcut creates an avoidable risk.

Reliable support gives staff permission to stop guessing. They can raise the problem early, receive an answer in plain English and get back to their work. Over time, this can make technology feel less fragile and less dependent on one helpful but overstretched member of the team.

For charities in Somerset and Wiltshire, a nearby provider can be particularly helpful where an on-site visit is genuinely needed, such as setting up new equipment or resolving a problem that cannot be fixed remotely. Remote help is often quicker for everyday issues, but it is reassuring to know there is a real local point of contact when circumstances call for one.

What it costs, and what to watch for

Outsourced support is often charged as a fixed monthly cost per user, per device, or through an agreed support package. Some charities prefer this because it makes budgeting easier. Others need occasional help and may choose an hourly arrangement. Neither model is automatically better.

A fixed monthly service is usually a good fit when staff need regular help, your team handles sensitive information, or you want ongoing maintenance and security checks. Pay-as-you-go support can suit a very small charity with few devices and straightforward needs, provided you accept that response times and preventative work may be more limited.

Ask what is included before comparing prices. A low monthly figure may only cover remote fault-finding during restricted hours. It may not include new-starter set-up, advice on buying equipment, on-site visits, security tools or project work. There is nothing wrong with extra charges when they are clearly explained. The problem is discovering them after you thought an issue was covered.

It is also worth asking whether the provider has experience working around charity realities. You may need to make purchasing decisions carefully, seek trustee approval, work with part-time staff or support volunteers with varying confidence. A provider who communicates clearly will make those moments easier, rather than making you feel you need to learn technical language first.

How to choose a support partner you can trust

Start with a short, honest picture of your current situation. How many staff and volunteers need support? Which devices are charity-owned? What systems are essential each week? Are people mostly office-based, remote or a mixture? Where are the recurring frustrations?

Then look for a provider that asks sensible questions before recommending anything. They should be interested in your priorities, budget and existing setup. Be cautious if the first conversation is full of acronyms or a long list of products you supposedly need immediately.

The best relationship is built on clarity. You should know how to request help, who can contact support, typical response times, what happens outside normal hours and what information is needed when a staff member joins or leaves. Ask how they record passwords, device details and key contacts. Your charity should retain control of important accounts and documentation, even when an external company manages them for you.

It helps to discuss communication style too. Some teams want a named contact who can explain options to a manager or trustee. Others simply need quick help for users and a regular update on anything that needs attention. Geeking It Simple believes both are possible: capable technical support, explained without making anyone feel foolish for asking.

Make the handover manageable

Moving to a new support provider need not mean a disruptive overhaul. A sensible first stage is an assessment of users, devices, accounts, access and immediate risks. This gives everyone a clearer view of what exists and what needs attention first.

Prioritise the essentials. Confirm that key information is backed up, remove access for people who have left, make sure devices receive updates, and identify the systems that would cause the greatest disruption if they failed. Bigger improvements can then be planned in stages around your budget and calendar.

Give staff and volunteers a simple route for asking for help. A short guide explaining who to contact, what details to provide and what to do if they suspect a security issue can prevent panic and speed up resolution. Technology support works best when people feel comfortable reporting a problem early.

The aim is not to fill your charity with more technology. It is to make the technology you already depend on quieter, safer and easier to use, leaving your people with more time and energy for the work that matters.

A laptop that will not connect to the printer may sound like a small problem. Until it stops an invoice being sent, a care record being updated, or a team member doing their job. For many owners, small business IT support UK services are not about having flashy technology. They are about knowing there is a calm, capable person to call when work grinds to a halt.

The right support should make technology feel less like another responsibility on your list. It should help you make sensible decisions before a problem happens, explain issues without a dictionary of acronyms, and get you back to work without fuss.

What small business IT support in the UK should cover

IT support is sometimes treated as a break-fix service: something you buy only when a computer fails. There is a place for that, particularly for a very small business with simple equipment. But waiting for things to go wrong can be expensive. A lost afternoon, missed customer calls, or inaccessible files can cost more than the repair itself.

A dependable support partner takes a broader view. They look after the everyday building blocks that keep your business working: computers, email, Wi-Fi, shared files, Microsoft 365 or Google Workspace, printers, backups and cyber security. The aim is not to add technology for its own sake. It is to make the tools you already rely on more reliable and easier to manage.

For a Somerset or Wiltshire business, this could mean a mix of remote help for quick issues and on-site support when a visit is genuinely needed. Remote support is often the fastest option for password problems, software updates or email settings. A new office set-up, unreliable network or repeated printer fault may need someone in the room who can see what is happening.

Good support prevents problems as well as fixing them

The most reassuring IT support is often the work you barely notice. Devices are kept up to date, backups are checked, old accounts are removed when staff leave, and security warnings are dealt with before they become a serious incident.

That does not mean every business needs the same level of monitoring. A sole trader using one laptop has different needs from a charity with volunteers accessing shared data, or a growing firm with ten people working from home. Good advice starts with how you work, what information you hold and what would cause the most disruption if it disappeared.

A useful support arrangement will usually include a clear way to report problems, agreed response times and regular checks on the essentials. It should also give you practical recommendations in plain English. If a laptop is nearing the end of its useful life, you should hear why it is worth replacing and what a suitable alternative costs – not simply be handed an expensive specification you do not understand.

Cyber security is a business issue, not just an IT issue

Small organisations are frequently targeted because attackers know that time and specialist knowledge can be limited. The usual route is not a dramatic Hollywood-style hack. It is a convincing email, a reused password or a staff member clicking the wrong link when they are busy.

Your IT support should make a noticeable difference here. That includes setting up multi-factor authentication, keeping devices patched, using sensible password management, protecting email and helping staff spot suspicious messages. It also means having a plan for the moment something looks wrong. Who should be told? Can access be stopped quickly? Are your files recoverable?

No provider can promise that an incident will never happen. Anyone who does is overselling. What they can do is reduce the likelihood, limit the damage and help your team respond without panic.

Questions to ask before choosing small business IT support UK services

It is tempting to compare providers only by their monthly price. Cost matters, of course, but a cheap arrangement that excludes the help you regularly need can become frustrating and costly. Ask what is included, what is charged separately and how the provider handles urgent issues.

You should also ask who will actually answer the phone or respond to a ticket. Some companies have a large helpdesk, which can suit businesses needing round-the-clock cover. Others offer a more personal service, where you speak to someone who already understands your set-up. For many smaller organisations, that continuity is valuable. You spend less time repeating the story and more time getting a solution.

It is worth asking these practical questions before signing anything:

• How quickly will you respond to a business-stopping problem?
• Can you support us remotely and visit us when necessary?
• Will you document our devices, accounts and important settings?
• How do you check that backups can actually be restored?
• What happens if we need support outside the agreed package?
• Can you explain recommendations without technical jargon?

The answers should be specific. “We offer excellent service” is pleasant to hear, but it does not tell you whether someone will help when your email goes down at 9am on a Monday.

Pay for the level of support you actually need

There are two common approaches. Pay-as-you-go support can work well when your technology is simple, problems are rare and you are happy to budget for occasional call-outs. It gives flexibility, but it can also encourage a wait-until-it-breaks approach.

A managed monthly service provides more predictable costs and usually includes proactive maintenance, a helpdesk and security checks. This is often a better fit once several people depend on shared systems. It can also be useful for charities, where a small team may be supporting staff and volunteers with limited internal resources.

Neither model is automatically better. The key question is how much downtime your organisation can tolerate. If one person cannot work for an hour, it may be inconvenient. If five people cannot access customer records or send quotes, the impact adds up quickly.

Be wary of packages with vague wording such as “unlimited support”. Clarify whether this covers new staff set-up, new equipment, software projects, home workers and on-site visits. Unlimited remote help may still exclude the very work you expect to need during a busy period.

Keep ownership and visibility in your hands

Outsourcing support does not mean giving up control. Your business should retain ownership of its domain name, software subscriptions, cloud storage, administrator accounts and data. A trusted provider may manage these for you, but you should know where they are held and how access would be transferred if circumstances changed.

Ask for a straightforward record of your key systems. It does not need to be a technical manual. A simple document showing your main services, renewal dates, device list and emergency contacts can save a great deal of stress. It is especially helpful if the person who normally deals with IT is away, leaves the business or is simply too busy.

Privacy deserves the same attention. Your support provider may need access to confidential customer information, staff records or financial documents while resolving an issue. They should be clear about how access is controlled and what steps they take to protect your data. If the explanation feels evasive or overly complicated, keep asking.

The value of a human point of contact

Technology problems are rarely convenient. They arrive when you are trying to open the shop, prepare for a meeting or meet a deadline. At that point, being told to restart something for the third time is not support.

A good IT partner listens to the outcome you need. Perhaps the real issue is not that a printer is offline, but that you need delivery notes printed before the driver arrives. Perhaps it is not merely a login problem, but a new starter unable to begin work. Context helps the right person make the right call about urgency.

That is the thinking behind Geeking It Simple: technology support should leave people feeling more confident, not talked down to. You do not need to become an IT expert to run your organisation well. You need advice that is honest, understandable and suited to the way you work.

When choosing support, look for the provider that makes you comfortable asking basic questions. The best working relationship is one where you can say, “I am not sure what this means”, and receive a clear answer, a sensible next step and a little more breathing room to focus on your business.