Published
Before planting and harvest, verify that the office can restore essential records, reach trusted contacts, and keep receiving, scheduling, and billing organized through an outage.
Start with the systems that keep work moving
For an agricultural retailer, farm-supply business, agronomy provider, or smaller cooperative, a disrupted mailbox, unavailable supplier records, locked account, or questionable payment request can create a real operational problem at the wrong time. Consider a plausible example: the office receives a supplier bank-change request while seasonal orders are being placed. If the team cannot quickly verify the request, find a trusted contact, or reach the records they need, an ordinary administrative task can turn into a delay or loss.
Use this checklist to guide a conversation with your team and IT provider before your busiest period. For each item, capture the evidence, owner, and next action.
1. Protect business email and require appropriate MFA
Question: Are business email accounts protected by appropriate multifactor authentication, and do employees know how to recognize an unexpected sign-in request? Evidence to request: the Microsoft 365 or email-provider MFA policy, a current list of excluded accounts or exceptions, and confirmation that administrator accounts have stronger protections where supported.
Ask the responsible IT person which account types have MFA, which exceptions remain, and how they review them. Review public SPF, DKIM, and DMARC records alongside that internal evidence, and require independent callbacks for payment changes.
2. Remove unused employee accounts and review administrator access
Question: Can the business show that former employees, temporary users, and unneeded vendor accounts no longer have access? Evidence to request: an active-user list, a list of administrator roles, the offboarding checklist, and a recent example showing that access was removed after a departure.
If you cannot confirm who has access, assign an owner to reconcile the employee roster with the account list and identify every privileged account. That gives the business a clear answer about who can access email, files, supplier portals, and remote tools—and why.
3. Verify supplier bank changes independently
Question: Does accounting verify a supplier bank-detail change through an established phone number or trusted channel rather than using the phone number, reply address, or link in the change request? Evidence to request: a written verification step, approval requirements, and a redacted example of a completed callback or trusted-channel confirmation.
If accounting cannot show a completed verification, set a simple rule: do not process a bank-detail change until a known contact confirms it using independently sourced contact information. Email authentication is useful, but it is not a substitute for this process because fraudulent requests can come from lookalike domains or compromised legitimate mailboxes.
4. Identify who owns vendor and remote-access accounts
Question: Does the business know which vendor, support, remote-access, and shared accounts exist, who owns each one, and whether access is still needed? Evidence to request: an inventory of remote-access methods, vendor account owners, access approvals, and the process for disabling access when a relationship changes.
Start with the systems used for email support, accounting, point-of-sale or ordering support, file sharing, and remote administration. Confirm the owner, business purpose, authentication method, restrictions, and support responsibility first.
5. Review backup coverage and restoration evidence
Question: Which business systems and records are backed up, who watches for failures, and is there documented evidence of a successful restoration? Evidence to request: a backup coverage summary, job-status reports, restore-test records, known exclusions, and named owners for failed jobs.
Before harvest, select representative records the team needs to receive and weigh loads, schedule hauling, invoice, and run payroll: a customer document, a recent delivery record, and an accounting or scheduling export. Restore them to a safe test location and have their business users confirm completeness, usability, and acceptable age.
Record what was restored, the test date, elapsed time, and missing information. Identify who can reach the backup system if the normal administrator is locked out. Keep recovery instructions and provider contacts outside the affected system, without putting passwords in a broadly shared checklist. A successful job notification is not a restoration test.
6. Give staff a clear way to report suspicious requests
Question: Do staff know exactly where to send a suspicious email, payment request, sign-in prompt, or unexpected attachment without worrying that they are overreacting? Evidence to request: a short reporting instruction, a monitored email address or support route, escalation contacts, and a recent staff reminder or training record.
Without a clear reporting path, publish a simple instruction that works under time pressure: stop, do not reply or use the supplied contact details, and report the request through the business's established IT or manager channel. Practical phishing testing can reinforce this habit with realistic scenarios and short follow-up training.
7. Prepare an offline contact list and practical fallback procedures
Question: If email, shared files, or a primary business system is unavailable, can the team reach key people and continue the next essential tasks? Evidence to request: a current offline contact list, IT-provider escalation information, supplier and banking contacts, and short fallback procedures for communicating with customers and staff.
Rehearse a busy harvest morning: at 6 a.m., the office cannot sign in, a supplier reports a suspicious payment email from your company, and trucks are due in an hour. Decide what pauses, who calls IT, who can authorize support, and how staff reach customers and haulers without business email.
Test one fictional receiving or scheduling transaction using the approved fallback, then decide how temporary records will be reconciled when systems return. Record recovery priorities, after-hours contacts, alternate approvers, and corrections from the exercise. Pause activities that cannot maintain safe operation or reliable records; coordinate equipment procedures with qualified vendors.
8. Assign every unresolved issue an owner and completion date
Question: Does every unresolved safeguard have one named business owner, an agreed next step, and a completion date? Evidence to request: a short action list showing the issue, accountable person, due date, dependency on an IT provider or vendor, and the evidence that will show completion.
If the next step is unclear, reduce the list to a manageable first set of actions. A clear owner and date are more useful than a broad statement that security needs improvement. Review the list with leadership and the IT provider so responsibilities are agreed rather than assumed.
Example action table
These suggested owners are examples. Actual responsibilities vary by business, provider relationship, and system owner.
| Check | Evidence to request | Suggested owner |
|---|---|---|
| Supplier-payment verification | Written callback or trusted-channel procedure; a recent approval example with sensitive details removed | Controller or accounting lead |
| Employee and administrator accounts | Current user list, administrator-role list, and offboarding checklist or ticket evidence | IT provider with a business owner |
| Backup recovery | Coverage summary, restore-test record, system owner, and follow-up for failed jobs | IT provider and operations lead |
| Suspicious-request reporting | Published reporting path, escalation contacts, and short staff reminder | Operations manager or office manager |
Write down the response before you need it
Use our free small business incident response plan template to record contacts, insurer notice instructions, and recovery priorities. The 18-page fillable PDF includes industry add-ons and a short tabletop exercise for your team and IT provider.
Related resources
Practice the pause before the next urgent request.
Managed phishing testing and staff training can use realistic office, purchasing, and operations scenarios to help employees verify requests and report suspicious messages.