Ringwood businesses rely on email, cloud software, laptops and phones to keep work moving. A fake invoice, stolen account or failed backup can interrupt jobs and create a difficult clean-up.
This checklist covers the controls to confirm first, whether the team works from an office, shop, warehouse, home or customer sites.
Secure Microsoft 365 and email
Microsoft 365 often holds business email, files, calendars and Teams conversations. Review the setup rather than assuming an old configuration is still suitable.
Check that:
- Every person has their own account and multi-factor authentication.
- Administrator access is limited and separate from everyday email and browsing.
- Former staff and unused accounts are disabled.
- Unexpected mailbox forwarding rules and broad file-sharing links are investigated.
- Recovery details belong to the business and remain current.
Your email domain should also have correctly configured SPF, DKIM and DMARC records. These help receiving mail systems confirm which services may send email in your name.
Technology cannot verify a supplier's new bank details. Call the supplier on a number already held in your records, and require another authorised person to check larger or unusual payments.
Manage devices and access
Keep a current list of computers, phones and tablets that can reach business information, including devices used away from the main workplace.
Each work device needs current security updates, supported device protection, a screen lock and a clear owner. Use storage encryption where suitable and have a way to remove business access if the device is lost.
Decide whether personal devices are allowed. If they are, record the minimum settings and what happens to business data when a staff member leaves.
Give staff access based on their role. Use one joining and leaving checklist for email, files, software, remote access, phones and supplier portals. Contractors should have their own access with an end date where the service supports it.
Give staff a business password manager so they can use a different password for every service. For important accounts, use a passkey, security key or authenticator app where supported. A text message code is still safer than a password alone, but other methods offer better protection against fake sign-in pages and mobile number theft.
Back up what the business needs
List the information and systems required to keep operating. This may include Microsoft 365 data, accounting records, job systems, server files and information stored on individual computers.
For each backup, know what it covers, how long copies are kept, who controls the account and how information will be restored. Cloud file syncing is useful, but it may also copy a deletion or unwanted change. It is not always a separate backup.
Test a restore and record the result. The test should show that the right information can be recovered within a useful timeframe.
Train staff and prepare for an incident
Keep training short and relevant. Use examples such as fake invoices, delivery notices, Microsoft 365 sign-in pages and payment changes. Staff need to know how to pause a request, verify it through a trusted channel and report a mistake without fear of blame.
Keep a short response plan outside the systems that may be affected. It should name the IT contact, the person making business decisions, bank and insurer contacts, and a way to reach staff if email is unavailable.
Insurance applications may ask about MFA, backups, device protection, training and access controls. Answer from records rather than memory. Save restore results and training dates, and ask the insurer or broker to explain unclear policy terms.
Know when to ask for help
Get support when you cannot confirm how Microsoft 365 is configured, backups have not been tested, personal devices hold business data or a suspicious message nearly caused a payment. It is also sensible to review these controls before a move, provider change, major system rollout or insurance renewal.
Use our Microsoft 365 Security Checklist to record the account, email and recovery controls you can confirm.
JCPIT Support is based in Croydon and works with small businesses in Ringwood and Melbourne's eastern suburbs. If the checklist leaves unanswered questions, book a Ringwood cybersecurity consultation. You will receive a prioritised list of Microsoft 365, device and backup gaps that could interrupt work.
