When does a growing business need an IT plan?

Key takeaways

• Growth is the trigger. A new location, an acquisition, regular new hires or one person holding every password all mean ad-hoc IT has run out of road.
• Fix access and backups first, then simplify, then improve. Order matters more than speed.
• You can write a first version yourself. Get help when you can't answer basic questions about what you have.

You've outgrown ad-hoc IT when nobody has the whole picture

You've outgrown ad-hoc IT when problems keep coming from the same cause: nobody has the whole picture. One sign alone is normal. Several together mean it's time to plan.

A new location

A second office usually means another network, more printers and phones, and a new set of local problems to look after. It also adds a question: who sets it all up, and to what standard? If the first office was built over years, the second one is your chance to do it on purpose.

An acquisition

When you buy a business, you also buy its email system, its accounts and its habits. Two sets of tools may do the same job. Old staff accounts may still be open. Nobody may know who has admin access. Plan the technology before the deal closes, not after.

New hires every month

Each new person needs a laptop, an email account, access to the right files and nothing more. If setting someone up depends on who happens to be free, it will be done differently every time. The same goes for leavers: an account that stays open after someone leaves is a quiet risk.

Tools that overlap

Two file-sharing tools. Three ways to hold a video call. A subscription nobody remembers buying. Overlap costs money, and it splits your data across places nobody checks.

Insurer questionnaires

Cyber insurers and larger clients may ask about multi-factor authentication, backups, patching and who has access to what. If you read those questions and guess at the answers, that's a sign. An IT plan gives you answers you can stand behind.

One person holding all the passwords

This one is common, and it is fragile. If the owner, an office manager, a friend who "does the computers" or one IT person holds every login, then a bad day for that person becomes a bad day for the whole business. Access should sit in your business's name, with more than one person able to reach it.

A good IT plan contains five things

A good IT plan contains five things: an inventory, a list of risks, priorities in order, a budget range and a named owner for each item. It can be short. A few pages that people actually read beat a large document nobody opens.

An inventory

The inventory is a list of what you have. Include computers, phones, servers, network gear, software, subscriptions, user accounts and domain names. For each one, note who uses it, who pays for it and who can administer it.

This is often the step that surprises people. You may find accounts for people who left, subscriptions nobody uses and devices nobody can account for.

Risks

Next, list what could go wrong and how badly it would hurt. Think in plain questions:

• If our main laptop or file store failed today, what would we lose?
• If an email account was taken over, who could be affected?
• If the one person who knows our setup left, what would we be unable to do?

Rank each risk by how likely it is and how much damage it would do. High, medium and low is enough. A list of problems isn't a plan until it is put in order, which the next section covers.

For security risks in particular, two US government resources are worth reading alongside your list. CISA Cyber Essentials is guidance for business leaders on building a culture of cyber readiness. The NIST Small Business Cybersecurity Corner collects NIST's cybersecurity resources for businesses.

A budget range

A budget range is a general sense of what the plan will cost over the next year or two, split into three buckets: keeping things running, fixing what's weak, and new projects. Keep it as a range, not a single number. Prices change, and your plans will too.

The point is to stop surprises, so a failed device doesn't arrive as an emergency purchase.

Who owns what

Every item on the plan needs a name beside it. That might be you, a manager, an IT person or an outside provider. If an item has no owner, it won't get done.

Also record who owns the accounts themselves. Admin access, licenses and documentation should be in your business's name, not an individual's.

Fix what could stop the business first

Fix the things that could stop the business first, then the things that cost you money, then the things that make work easier. In the table below, that becomes four stages, in order, that work for many growing businesses.

1. Access and ownership

Start with who can get into what. Make sure the business owns its domain name, its main admin accounts and its software licenses. Turn on multi-factor authentication for email and any admin account. Close accounts for people who have left.

This stage is often a good place to start, because it tends to be work you can do yourself and it targets single points of failure. Check how much effort it takes in your own setup.

2. Backups you've tested

A backup you haven't restored from is a hope, not a backup. Check that email, files and key computers are backed up, then try getting something back. Do this before you change anything big, so you have a way back if something goes wrong.

3. Simplify

Now deal with overlap. Compare your inventory against what people actually use. Cancel what's duplicated, and move to fewer tools that work together. Fewer logins and fewer bills also mean less to go wrong and less to protect.

4. Standardize, then improve

Once the basics are steady, write down how new starters and leavers are handled, how devices are set up and how updates are applied. Then look at the projects: the new location, the network upgrade, the migration, or an automation that could give a team some time back.

Doing projects before steps one to three can backfire. A new office on top of untracked accounts and untested backups carries the old problems into the new place.

How can you build an IT plan yourself?

You can build a useful first version yourself in an afternoon or two. You don't need special software. A spreadsheet and a few honest conversations are enough.

1. List everything. Walk through the business and write down every device, account and subscription. Check your bank and card statements for software you forgot.
2. Ask your team. Ask what slows them down, what they work around and what they pay for personally. People know where the problems are.
3. Find the single points of failure. Mark anything only one person can do or reach.
4. Rank the risks. Use high, medium and low.
5. Put the work in order. Use the four stages above.
6. Name an owner and a rough budget range for each item. Broad figures are enough.
7. Set a date to review it. A plan that nobody revisits turns into another forgotten document.

Keep it short. The goal is a plan you will use, not one that looks complete.

When should you get help with an IT plan?

Get help when you can't answer the basic questions, when the stakes are high or when you've lost track of time. Doing it yourself works up to a point. Past that point, an outside view can save money and avoid mistakes.

Consider outside help when:

• You can't say what you have, who has access or what you pay for.
• A big change is coming, such as an acquisition, a move or a new location.
• An insurer or client is asking questions you can't answer with confidence.
• Your IT person is stretched thin and has no backup.
• The plan keeps slipping because nobody has the time.

Our IT assessment is a good place to start. It's a free 30-minute call, then a look at how your business runs and what you have.

If it's a fit, the next step is a Blueprint: a written plan of what to fix, simplify, automate and build, in order. The Blueprint is paid work, priced for your business, and the plan is yours to take to anyone.

If you want a senior person to check in and keep the plan on track, that is CTO-level guidance, an alternative to hiring a full-time CTO.

Once the plan is set, managed IT covers the day-to-day: help desk, maintenance and the care of your accounts and devices. Planning and day-to-day care can be used together or on their own.

Self-check: do you have an IT plan?

Answer yes or no to each question. Every "no" is a place to start.

• Do we have a written list of our devices, accounts and subscriptions?
• Is our domain name registered in the business's name?
• Can more than one person reach our main admin accounts?
• Is multi-factor authentication on for email and admin accounts?
• Do we close accounts promptly when someone leaves?
• Have we restored something from a backup, not just set one up?
• Is there a named owner for each part of our technology?

If you answered "no" to several of these, book a free IT assessment to see where you stand.

How we wrote this: from the questions businesses ask about IT, reviewed against the way we work. No outside statistics are used.