A backup dashboard cannot tell you when dispatch, orders, or invoicing will work again. Four checks help owners verify the safeguards behind daily operations.
When systems stop, the work still has to move
The trucks are ready to leave, but dispatch cannot open the load details. Orders are waiting, but employees cannot reach customer files. Payroll is due, but the accounting system is unavailable.
For a small business, a cyber incident becomes an operating problem quickly. Having IT support and a backup service is a start; knowing what those safeguards can actually deliver takes a little more work.
Four checks can help: identify overdue security updates, review vendor access, restore a critical workflow, and practice the first response decisions.
1. Find the security updates that fall between responsibilities
Verizon's 2026 DBIR findings put vulnerability exploitation at 31% of breaches and identify it as the leading entry point, ahead of stolen credentials. That is a reason to ask about maintenance ownership, not proof that every affected business ignored an available patch.
The harder cases are often the systems no one is sure they own. One provider may handle employee computers while another maintains the order system. A web developer may look after the company site, while an older remote-access gateway sits outside either contract. Everyone can be doing their assigned work and still leave a gap.
Ask for a current system inventory alongside the patch report. For each outstanding security update, note the affected system, priority, responsible person, and planned completion date. Include products that no longer receive security fixes.
Pay particular attention to internet-facing systems and flaws known to be exploited. If an update has to wait, ask the technical owner to document why, what interim protection is in place, and when the decision will be reviewed. For production equipment, involve the supplier and operations team; an office-computer update routine may not be safe for a production controller.
2. Treat vendor access as a business decision
Verizon's 2026 executive summary reports third-party involvement in 48% of breaches, up from 30% in the prior edition. That measure includes involvement across services and software; it does not mean every case started with a vendor's remote login.
A useful question is simpler: who outside the company can reach its systems or information? Include IT support, software suppliers, bookkeepers, website administrators, and equipment-maintenance contractors. A former installer with permanent access is one example of a relationship that deserves a second look.
For each vendor, record what it can reach, what it can change, who approves access, and how that access can be disabled. Ask whether each person has an individual account, whether multifactor authentication is used, and whether important actions leave logs someone can review.
Where practical, limit support access to the systems and time window needed for the work. Do not assume a vendor's security badge tells you what it can do inside your environment.
3. Measure recovery in completed work
A green backup dashboard cannot tell you when dispatch, customer orders, or invoicing will be available again. Choose one workflow the business cannot comfortably lose and schedule a controlled restore with IT or the application provider. Keep the test separate from production, and ask the employees who use the system to check the result.
For dispatch, can the team retrieve current load information and contact details? For accounting, can someone open the restored company file and supporting records? For order processing, can employees find the orders and produce the documents needed to fulfill them?
Write down two results separately: recovery time, or how long it took to make the workflow usable; and data age, or how much recent work was missing from the restored copy. Compare both with what the business can tolerate. A successful restore of last week's data may still leave too much work to recreate.
Confirm that authorized responders can get the encryption keys, recovery credentials, configurations, and licenses they need if normal systems are unavailable. Store secrets securely and separately from ordinary planning documents. Also ask whether an administrator whose account is compromised could delete the backups.
Restoring files is only one part of recovery. It does not establish that stolen information, fraudulent transactions, or compromised accounts have been addressed.
4. Rehearse an outage with the people who run the business
Try a short discussion exercise: It is Monday morning. Business email is unavailable, and an employee reports a ransom message. Bring together the owner, operations lead, finance lead, and IT contact. The point is not to predict every detail; it is to find decisions the team would otherwise have to make under pressure.
Work through who receives the report and leads the response, how people communicate without business email, who can pause suspicious payments, and how urgent requests will be verified using a trusted channel. Decide who coordinates containment and evidence preservation with technical responders, and who sends operating updates to customers, drivers, suppliers, or staff.
Confirm who contacts the insurer and check the actual policy and reporting instructions rather than relying on an assumption about what it requires. Then agree how essential work could continue temporarily. A trucking company might need a secure way to reach drivers and view current shipment details; another business might need a controlled manual order process. Test the arrangement instead of assuming people can improvise it.
Give each gap an owner and a deadline
Take the evidence table above to your next conversation with your IT team or providers. If a report or test is missing, that does not by itself prove a safeguard has failed; it means the safeguard still needs verification. Assign someone to check it and agree on a date to review the result.
The Business Security Baseline is a separate, paid review of agreed internal safeguards, including patch-management evidence, backup-testing evidence, and incident-response planning. It does not automatically include running a restore drill, changing systems, or providing emergency incident response.
Four checks to take to your next provider meeting
Ask for current evidence, not a general assurance. Put an owner and a follow-up date next to anything that is missing.
| Check | Evidence to request | Suggested owner |
|---|---|---|
| Security updates | System inventory, patch report, overdue exceptions, and a named owner for each | IT provider and system owner |
| Vendor access | Approved access list, MFA status, and a documented way to disable access | Business owner and vendor |
| Backup recovery | A restore result showing elapsed recovery time, data age, and user verification | IT provider and workflow user |
| Incident response | Exercise notes, decision owners, and a working emergency contact list | Business owner and operations lead |
Find out what is verified and what still needs checking.
The $1,995 Business Security Baseline reviews evidence for agreed internal safeguards. The free Zero-Access Business Exposure Review checks public signals only; it does not verify internal controls or test recovery.