12 signs your small business needs IT support: a self-check

Your business likely needs outside IT support when basic upkeep has no owner. The clearest signs are things you can check today: nobody can say when a backup was last restored, email accounts lack multi-factor authentication, former staff still have logins, computers are running an unsupported version of Windows, and the person fixing problems has another full-time job. The 12 signs below are all observable, and the self-assessment at the end turns them into a score.

How to use this list

Each sign is something you can verify in a few minutes, not a feeling. Walk through them with whoever currently handles technology in your office. A “yes” is not a failure. It is a task that currently has no owner.

Signs in your accounts

1. You cannot say who has administrator access

Ask: who can sign in as an administrator to our email system, and who controls our domain name? If the answer is “not sure”, “someone who left”, or “only our web designer”, the business does not fully control its own email and website.

2. Multi-factor authentication is not on for everyone

Multi-factor authentication (MFA) is a second sign-in step beyond the password, such as a prompt on your phone. CISA’s guidance for small businesses asks IT leads to make MFA mandatory and to “regularly look for non-compliant accounts and remediate them”. If MFA is optional in your office, or on for some people and off for others, this sign applies. Our post on why multi-factor authentication matters explains how it works.

3. Former staff still have active accounts

Open the user list in Microsoft 365 or Google Workspace and look for anyone who no longer works with you. Check your accounting, banking, and industry software too. If accounts outlive employment, there is no offboarding process. Our guide to IT onboarding and offboarding gives you one.

4. Passwords are shared or stored informally

Look for a spreadsheet of passwords, sticky notes on monitors, or one login that several people use. The FTC’s small business guidance recommends passwords of at least 12 characters that are never reused across accounts, which is hard to achieve without a password manager.

Signs in your devices

5. Computers are running Windows 10 or skipping updates

Microsoft states that Windows 10 reached the end of support on October 14, 2025, which means no more routine security updates. On each Windows computer, go to Settings > System > About to see the version, and Settings > Windows Update to see whether updates are pending. If several machines are on Windows 10, or updates have been postponed for months, that is a sign. Our Windows 10 end of life guide covers the options.

6. You have no list of what you own

Could you produce a list of every computer, its age, its user, and its warranty status in under an hour? Without one, replacements are unplanned, and you cannot be sure every device is protected.

7. Setting up a new hire takes days and differs each time

If every new computer is set up from memory, with different software, different settings, and access granted by copying whatever a colleague has, setups will drift and gaps will appear.

Signs in your data and network

8. Nobody has restored a file from backup in the past year

Having a backup and being able to restore from it are different things. CISA asks small businesses to “regularly test partial and full restores”. Ask whoever looks after the backup to restore one folder from last week. If nobody knows how, or nobody knows where the backup is, this sign applies. See our business data backup guide.

9. Guests, personal phones, and business systems share one network

Check whether visitors use the same Wi-Fi password as your office computers and payment terminals. The FTC recommends a separate guest network and WPA2 or WPA3 encryption. If you have one network for everything, or the router still has its original admin password, this applies.

10. The same problems keep coming back

Note each recurring issue for two weeks: the Wi-Fi drop every afternoon, the printer that disappears, the shared drive that disconnects. Recurring problems mean the cause has never been found, only the symptom restarted.

Signs in how work gets done

11. Someone with another job spends hours a week on IT

Ask the owner or office manager to log time spent on technology problems for two weeks. If it is regularly several hours a week, multiply by what that person’s time is worth to the business. That is what do-it-yourself IT currently costs.

12. You cannot answer a security questionnaire

Insurers, larger customers, and regulators may send questionnaires asking about MFA, backups, encryption, and incident response plans. If you recently left answers blank or guessed, the gap is now affecting the business directly.

Self-assessment

Answer yes or no. Count one point for each “yes”.

#	Question	Yes / No
1	Are we unsure who holds administrator access to our email and domain?
2	Is MFA off for any email account?
3	Do any former staff still have active accounts?
4	Are passwords shared, reused, or kept in a document?
5	Are any computers on Windows 10 or months behind on updates?
6	Do we lack a current list of devices and warranties?
7	Is new-hire setup done from memory?
8	Has it been over a year since anyone restored a file from backup?
9	Do guests and business systems share one network?
10	Do the same problems recur without a root cause being found?
11	Does someone with another role spend hours a week on IT?
12	Have we struggled to answer a security questionnaire?

How to read your score. These bands are a rule of thumb for deciding what to do next, not a formal standard.

• 0 to 2: You are in good shape. Fix the one or two items yourself or with a short hourly engagement.
• 3 to 5: A one-time cleanup project would likely close the gaps. After that, decide whether the upkeep needs an ongoing owner.
• 6 or more: Routine upkeep has no owner. Ongoing support, or a project followed by a regular maintenance arrangement, is worth considering.

Questions 1, 2, 3, and 8 carry the most risk. A “yes” on any of them is worth fixing promptly whatever your total.

When do you not need outside IT support?

If you scored low, have a few people on cloud apps, and one of you is comfortable handling updates, accounts, and backups, you may not need anyone. Work through our small business IT checklist once or twice a year and get hourly help for the odd problem. That is a perfectly sound way to run a very small office.

What kind of help fits?

• A single project suits a defined gap: turning on MFA for everyone, cleaning up accounts, fixing the network, replacing Windows 10 computers, or setting up and testing backups.
• Ongoing support suits the situation where the tasks keep coming back because nobody owns them. Our explainer on what managed IT is sets out the models.
• Support for an internal person suits a business that has someone capable in-house who needs backup or specialist help.

Common mistakes

• Waiting for an emergency. Every item above is cheaper to fix on a quiet day.
• Buying tools instead of assigning ownership. New software does not help if nobody is responsible for it.
• Fixing symptoms. Restarting the router daily is a sign, not a solution.
• Assuming cloud means backed up. Cloud services keep your data available, but check what your plan actually lets you recover and for how long.

Common questions

How do I know if my small business needs IT support?

Check observable facts: whether backups have been test-restored, whether MFA is on for every account, whether former staff still have access, whether computers are supported and updated, and how many hours non-IT staff spend on technology. Several “yes” answers on the self-assessment above mean routine upkeep has no owner.

Is my business too small for IT support?

No business is too small for occasional help, but many are too small to need a recurring arrangement. A few people on cloud apps with the basics in place can manage with hourly help. The need grows with staff count, regulated data, and how costly downtime is.

What is the first thing to fix?

Administrator access and MFA. Confirm the business controls its domain and email tenant, then turn on MFA for every account, starting with administrators. After that, test a backup restore. Those three steps deal with the gaps that carry the most risk.

Can I get help with one problem without signing up for a plan?

Yes. Many providers, including Coastal Growth Co., take one-time projects. A defined project is also a practical way to find out how a provider works before considering anything ongoing.

How Coastal Growth Co. can help

If your self-assessment turned up gaps, we can review them with you and suggest whether a one-time project or ongoing support fits. We agree the scope and price before any paid work. The services page shows what we cover, or you can send us your score and your questions.