7 Ways To Reduce IT Risk In Your Business
A short, practical guide to reduce IT risk, which you can use to check whether your current provider is doing the things that actually prevent an incident.
Most Businesses Cannot Tell Good IT From Bad IT
That is not a criticism. It is the nature of the service. When IT is done well, nothing happens, and when it is done badly nothing happens either, right up until the morning it does. Both look identical from the outside, which is why businesses often stay with an underperforming provider for years without knowing.
This guide gives you seven specific ways to reduce IT risk. Each one is answerable by your existing provider in a sentence, and each one has a right answer. No technical background is required to put it to work, and nobody needs to know where the questions came from.
7 Ways To Reduce IT Risk
Seven questions to ask your IT provider to reduce IT risk, and what a good answer sounds like. Four pages, no jargon, and nothing you need to be technical to use.
We will email you the guide. One follow-up, then nothing unless you ask. We do not sell or share the list.
What To Ask, And What A Good Answer Sounds Like
When did you last test a restore?
Not a backup that ran. A restore that was actually performed and verified. If the answer is vague, or describes a backup job rather than a dated, verified restore, that is your answer.
Is our backup immutable?
Modern ransomware deletes backups before encrypting anything. If your backups can be deleted with the same credentials that reach your servers, they are not protection.
Who is watching at 2am?
Most attacks begin outside business hours specifically because nobody is looking. Monitoring that only runs during the working day covers roughly a third of the risk.
How many administrator accounts exist?
The count should be small and every one should have a name attached. Shared, generic or former-employee admin accounts are how most breaches escalate.
Is multi-factor authentication on everything?
Not just email. Remote access, the firewall, the backup console, the management portal. A single gap is the one that gets used.
What is the incident plan?
It should be a document naming people, sequences and contacts, not a promise to respond quickly. If nobody can produce it, it does not exist.
What did you find last quarter?
A provider genuinely working to reduce IT risk has findings to report. A quarterly review with nothing in it is a review that did not happen.
How To Use The Answers To Reduce IT Risk
To reduce IT risk, ask all seven, in writing if you can, and give your provider a reasonable amount of time to respond. Most will answer four or five well. If two or more answers are evasive rather than simply unfavorable, that is worth taking seriously, because evasion on these particular questions usually means the work is not being done rather than that it is being done differently.
You do not have to change provider on the strength of it. Plenty of businesses take these findings back to their existing provider and get the gaps closed, which is a perfectly good outcome. What matters is that you now know which questions to keep asking.
If you would rather have somebody independent check the answers, our free cyber assessment covers all seven and quite a bit more, and you keep the written findings either way.
Each One Maps To A Way Businesses Actually Get Hurt
These are not the questions a provider expects, and that is deliberate: they are how you reduce IT risk. A prospective client normally asks about response times, ticket volumes and price, all of which are easy to answer well and none of which predicts whether you survive a bad week. The seven above are chosen because each corresponds to a specific, documented failure mode.
Untested restores are the reason ransomware payments still happen: the backups existed, they simply did not come back. Mutable backups are the reason attackers now delete the backup first, because it converts a recoverable incident into a negotiation. Business-hours-only monitoring is why intrusions are so often discovered on a Monday morning after a weekend of quiet activity.
Excess administrator accounts turn a single compromised laptop into a full estate compromise. Partial multi-factor coverage is why an attacker with valid credentials can still walk in through the remote access path nobody remembered. And a missing incident plan is why the first two hours, which matter more than the following two weeks, get spent deciding who to call.
The seventh question is the honest one. A provider doing real work accumulates findings, because systems drift and people leave and vendors ship changes. Quarterly reviews with nothing to report are not evidence of a healthy estate; they are usually evidence that nobody looked.
Questions We Get Asked
Questions about the guide to reduce IT risk.
The full guide is sent by email so we know where to send it. We do not sell or share the list, and one reply unsubscribes you.
No. You will get the guide and one follow-up. If you would rather not get the follow-up, say so and we will send the guide alone.
The seven apply across all three industries we specialize in. Law firms, distributors and manufacturers each have additional questions, which we cover on those pages.
Then you have a good provider and you have just confirmed it, which is worth knowing. We would tell you the same.
Yes. The free cyber assessment verifies all seven independently, and you keep the written findings regardless of what you decide.
It helps. Written questions get considered answers, and it gives you something to compare against in six months.
Then the same seven describe what you should be putting in place, in roughly the order they appear.
The restore question. Everything else limits the damage; a verified restore is what determines whether a bad incident is survivable.
How To Reduce IT Risk Without Buying More Tools
Reducing IT risk depends less on a provider’s pitch than on the promises it puts in the contract. Ask three things: how fast a security event gets a response, which named person takes a 2am call, and whether the security stack is part of the agreement or returns later as an extra charge.
Often the cheapest way to reduce IT risk is proving that what you already have works. Restore a backup and check it, and map your controls to a recognized standard so the gaps are visible. That is why our own controls are measured against NIST CSF, CISA guidance and CIS v8, each where it applies.
That is how we measure our own work to reduce IT risk for clients, and it explains why many arrive from a provider that met the contract on paper but was rarely there when needed.
Get The Guide, Then Get The Answers Checked
Request the guide to reduce IT risk, or book a free assessment and we will verify all seven for you.