Small Business IT Basics: A Practical UK Checklist
A plain checklist of IT essentials for UK small businesses: devices, backups, accounts, email, security and who to call, without the enterprise jargon.
You do not need an IT department to run a tidy, secure small business. You do need a handful of habits and a clear picture of what you own. This checklist is written for teams of one to twenty who rely on computers but would rather not think about them.
1. Know what you have
Make a simple list in a spreadsheet:
- Every computer, phone and tablet, and who uses it.
- Software and subscriptions, with renewal dates and who pays.
- Online accounts: domain name, email, website, accounting, payment tools.
- Network equipment: router, switches, printers.
This list is surprisingly valuable when something breaks, when someone leaves or when you need a quote.
2. Backups you can restore
Backups only count if you have tested them.
- Decide what must be kept: accounts, customer records, project files.
- Use at least two copies, with one stored away from the premises, such as cloud storage.
- Automate them so nobody has to remember.
- Try restoring a few files every few months.
Our guide to backing up your computer and the comparison of cloud storage versus an external hard drive can help you choose.
3. Account security
Most small-business compromises start with stolen or guessed logins.
- Use a password manager and unique passwords. See the password manager guide.
- Turn on two-factor authentication for email, banking, accounting and cloud storage. See two-factor authentication explained.
- Avoid shared logins where possible, so you can see who did what and remove access cleanly.
- Keep a record of who has admin rights.
4. Updates and protection
- Turn on automatic updates for operating systems and key software.
- Replace devices that no longer receive security updates.
- Use the built-in security features of your operating system, and a reputable additional tool only if you have a clear reason.
- Lock screens when away from the desk.
5. Network and Wi-Fi
- Change the default router password and keep its firmware current.
- Use a separate guest Wi-Fi for visitors and for smart devices.
- Use strong encryption and a long passphrase. See securing your home or office Wi-Fi.
- Check whether coverage works where staff actually sit.
6. People and process
Technology fails most often through people being rushed, not through clever attacks.
- Train staff to recognise phishing and fake invoices. See spotting phishing emails and texts.
- Agree a rule for checking payment-detail changes by phone.
- Have a simple checklist for new starters and leavers: accounts created, devices issued, access removed.
- Decide who to call and how when something goes wrong.
7. Data protection
If you handle personal data about customers, you have legal responsibilities in the UK. Keep access limited, avoid storing more than you need and dispose of old devices carefully. Our article on disposing of old computers and phones safely is a good starting point. This is general information, not legal advice.
8. A support plan
Decide ahead of time how you will get help: a retained technician, a local provider you call as needed or a managed service. Our guide to small business IT support costs explains common models.
Finding help
On Compito you can search by postcode, compare ID-verified local providers and send a request describing your setup. You receive an offer to accept and pay online and can message the provider to agree the scope. See tech support services.
A worked example: a five-person practice
A small accountancy practice has five staff, cloud accounting software and a shared printer. Their basics: a spreadsheet of devices and accounts kept by the practice manager, a password manager with shared client-portal logins, two-factor authentication on email, automatic backups checked quarterly, and a leaver checklist. Total ongoing cost is modest, and it takes the manager an hour a month. When a laptop is stolen from a car, they lock the account, revoke access, and restore a new machine from backup within a day.
A monthly and quarterly rhythm
| How often | Task |
|---|---|
| Monthly | Check updates are applied, review who has access, test one backup file |
| Quarterly | Restore a sample from backup, review software subscriptions, check devices still get security updates |
| Yearly | Review the device list and refresh plans, refresh staff awareness, check domain and certificate renewals |
| Whenever someone joins or leaves | Run the starter or leaver checklist |
What to do when something goes wrong
- Note what happened and when.
- Isolate the affected device from the network if you suspect a compromise.
- Change passwords from a clean device and revoke any shared access.
- Contact your IT provider, bank or software supplier as appropriate.
- If personal data is involved, find out whether you need to report it, and keep a record of what you decided and why.
Mistakes small businesses make
- One person holding every password, with no record.
- A founder's personal email as the master account for everything.
- Leaving former staff with access to shared drives.
- Relying on a single external drive for backups, kept next to the computer.
- Paying for tools nobody uses because the subscription is not reviewed.
Sole traders and home offices
Keep it light: a password manager, two-factor on email and banking, a backup that runs on its own and a list of subscriptions and renewal dates. That list alone often saves money. Keep business files separate from family ones so a shared computer does not put client data at risk.
Frequently asked questions
What is the single most important thing?
Tested backups and two-factor authentication on email are the best protection per pound and per minute spent.
Do I need business insurance for cyber risks?
It may be worth considering depending on what data you hold and how you operate. Speak to an insurance adviser about your specific situation.
Can I use personal devices for work?
Many small businesses do. Set basic rules such as screen locks, updates and separate accounts, and agree what happens if the device is lost.