Start With Clear Responsibilities
Your business, staff, IT provider and online service providers each have a role. A hosting account, computer repair or ongoing support arrangement does not automatically include every security task. Agree the improvements, products, costs and ongoing responsibilities before starting.
Identify the accounts and information your business relies on: email, customer details, quotes, invoices, website content and important working files. Record where they live, who owns them and who can approve changes. Tell us about sensitive information and any industry, insurer or contractual requirements so the proposed work can be considered against them.
No product or provider can remove every risk or guarantee that information will never be lost. This page describes useful planning questions; it does not establish a certification, an audit result or a particular security service for your business.
Safer Sign-Ins and Account Access
Use a separate account for each person where the service allows it. Give people access to the information they need for their role. Administrator accounts can make wider changes and should be limited to people who need that authority.
Use strong, unique passwords or supported passkeys. A password manager can help keep different passwords organised. Add a second sign-in check, often called multi-factor authentication or MFA, to important accounts where available. Protect the password manager and recovery options too.
Keep account recovery details current and know who holds recovery codes. Plan access for new staff, role changes and departures. Agree how any provider access is approved, reviewed and removed when no longer needed. Never approve an unexpected sign-in prompt or share a one-time code because an unexpected caller asks you to.
Devices, Software and Websites
Security updates address known weaknesses in computers, phones, business software, routers and websites. Agree who installs updates, which devices and applications are covered, and how interruptions or compatibility problems will be handled. Devices or software that no longer receive security fixes may need replacement or a different arrangement.
Discuss suitable security software, screen locks and device encryption. Encryption helps protect stored information when a device is lost, but recovery keys need careful handling. Confirm what is supported and actually configured rather than assume it comes with a new computer.
For websites, agree responsibility for the hosting account, website software, plugins, domain renewal and backups separately. Renewing hosting does not by itself confirm that website maintenance or file recovery is included.
Know What Your Backups Cover
A backup plan starts with the information you need to recover. Copies of one computer folder may leave out email, accounting records, website databases or files kept in another online service. File synchronisation can copy deletions and unwanted changes too; check the actual recovery options.
Before choosing a backup arrangement, record:
- The devices, accounts, folders and website information included, plus anything excluded.
- How often copies are made and how much recent work the business could afford to recreate.
- Where copies are stored, how long versions are retained and who can restore or delete them.
- Who checks results, receives failure notices and follows up missed backups.
- How storage growth, changed accounts, new devices and service fees will be handled.
Backup setup, ongoing checks and recovery work are separate responsibilities to confirm in the accepted scope. Tell the responsible person whenever the location or importance of your information changes.
Protect Copies and Check Recovery
Consider copies kept separately from the original device and copies protected from unwanted changes. Depending on the arrangement, that may involve an offsite location, disconnected storage or a service that restricts alteration. Discuss access controls, encryption, recovery keys, storage location and retention against your business needs. These protections must be specifically selected and configured.
Agree restore checks and their frequency. Restoring a representative file can show whether a copy is readable; recovering an entire computer, website or business system needs broader checks. A successful backup message alone does not demonstrate full recovery.
Record the result, gaps and who will address them. Recovery depends on the available copies, their age and condition, working equipment, internet capacity and provider access. Discuss the order in which essential work would resume. Recovery times and recovery of every file cannot be assumed.
Make Suspicious Requests Easier to Check
Give staff a clear way to report unexpected attachments, unusual sign-in messages and requests for passwords or remote access. Encourage people to pause and ask, including when they have already clicked something.
Confirm changed bank details and unusual payments through a trusted contact method you already hold, rather than contact details supplied in the suspicious message. Check unexpected support requests before allowing access to a computer. Staff awareness, account safeguards and payment approval processes need to work together.
Avoid sending unnecessary personal information in support messages. Our Privacy Policy explains how information provided to Outpost IT is handled.
If You Suspect a Security Incident
Use your agreed incident contact method if one is in place. Tell the responsible person what happened, when it started, which accounts or devices may be affected and whether money or customer information is involved. The public enquiry form is not an immediate incident response channel.
Stop interacting with suspicious messages or callers. Avoid further changes, deleting evidence or attempting a restore until the situation and safe next steps have been assessed. Follow your business incident plan; containment may require isolating affected equipment or restricting access, with the effect on business and safety considered first. Use a separate trusted device or contact method if the usual account may be compromised.
If money or financial details may be involved, contact your bank promptly using trusted contact details. Report scams through Scamwatch and cybercrime or cyber security incidents through the Australian Government’s ReportCyber reporting pathway. Immediate danger requires emergency services on 000. Government reporting does not book support with Outpost IT.
Keep the Plan Useful
Agree who can authorise urgent work, contact suppliers and decide which business functions come first. Keep essential contacts and recovery instructions accessible if normal email or computers become unavailable. Review the plan when staff, systems or providers change and after an incident or recovery check.
If personal information may have been exposed, assess the situation promptly and seek appropriate advice about notifications and other obligations. Relevant businesses can refer to the OAIC’s Notifiable Data Breaches guidance.
For practical independent guidance, read the ASD’s ACSC Small Business Cyber Security Handbook. To discuss your setup, use our enquiry form without passwords or private customer records. Our Support Approach and Terms of Service explain how work and responsibilities are agreed.