Key takeaways
- You can’t protect or support what you don’t know you have — start with an inventory.
- Updates, MFA and tested backups stop the majority of everyday incidents.
- In Lebanon, power protection is not optional: generator switchovers and voltage swings damage equipment and corrupt data.
- Write things down, and decide before something breaks who you will call.
1. Know what you have: the IT inventory
An inventory is a simple list of every device, account and service the business depends on. It sounds boring, but it is the foundation for everything else: patching, licensing, warranty claims, security and budgeting.
- Hardware — PCs, laptops, servers, printers, firewall, switches, Wi-Fi access points, NVRs and cameras, UPS units. Note the model, serial number, location, user and purchase date.
- Software and licences — Windows and Microsoft 365 licences, accounting or ERP software, antivirus, and their renewal dates.
- Services — internet lines, domain name, website hosting, email, cloud storage — and who holds the login for each.
A shared spreadsheet is fine to begin with. What matters is that it is kept up to date when people join, leave or receive new equipment.
2. Keep everything updated
Most successful attacks exploit vulnerabilities that already have a fix available. Updates are the cheapest security control you will ever have.
- Turn on automatic updates for Windows, macOS and browsers, and make sure they actually install — check for machines that haven’t restarted in weeks.
- Don’t forget the devices people ignore: firewall, router, switches, NAS, printers and camera recorders all receive firmware updates.
- Replace systems that no longer receive security updates. An unsupported operating system is a permanent open door.
3. Accounts, passwords and MFA
Stolen or guessed passwords are one of the most common ways into a business. A few rules close most of that gap:
- One person, one account. No shared “reception” or “admin” logins — you lose accountability and can’t cut off one person without disrupting everyone.
- Multi-factor authentication (MFA) on email, Microsoft 365 or Google Workspace, remote access, banking and anything reachable from the internet. See our guide on phishing and MFA.
- A password manager so staff can use long, unique passwords without writing them on sticky notes.
- Least privilege. Everyday users should not be local administrators. Admin rights belong to separate accounts used only when needed.
- An offboarding checklist — disable accounts and change shared credentials the day someone leaves.
4. Backups that actually restore
Hardware fails, laptops get stolen and ransomware encrypts everything it can reach. Follow the 3-2-1 backup rule: three copies, two types of storage, one off-site — with at least one copy offline or immutable. Then test a restore regularly, because a backup you have never restored is only a hope.
5. A real firewall and a tidy network
The router your internet provider installed is designed to connect you, not protect you. A business needs a proper firewall with current firmware, no unnecessary open ports, and secure remote access (VPN with MFA rather than exposed remote desktop).
- Separate guest Wi-Fi from the office network, and keep cameras and other devices on their own segment.
- Label cables and ports, and keep the network cabinet locked.
- Change every default password on network equipment.
Our articles on next-generation firewalls and network segmentation go deeper.
6. Power protection: essential in Lebanon
Switching between the state grid, a building generator and private supply means frequent cuts, surges and unstable voltage. Each sudden shutdown risks corrupted databases, damaged disks and failed power supplies.
For desktops, a smaller line-interactive UPS or at least a quality surge protector is worthwhile. Proper earthing of the electrical installation matters as much as the UPS itself.
7. Documentation
When the one person who “knows how everything works” is unavailable, documentation is what keeps the business running. Keep, in a secure place:
- a simple network diagram and the IP addresses of key devices;
- admin credentials stored in a password manager or vault, not in someone’s head;
- vendor and ISP contacts, contract numbers and warranty details;
- short procedures: how to add a user, how to restore a file, what to do in a power cut or security incident.
8. A support plan
Decide in advance who handles IT, how staff report problems and how fast issues must be fixed. Whether it is an internal person, an external provider or a mix, write it down.
| Area | Minimum baseline | How often to check |
|---|---|---|
| Inventory | Every device, licence and service listed with owner | On every change; review quarterly |
| Updates | Automatic OS, browser and firmware updates | Monthly |
| Accounts & MFA | Individual accounts, MFA on email and remote access | On joiners/leavers; review quarterly |
| Backups | 3-2-1 with one offline or immutable copy | Daily alerts; monthly test restore |
| Firewall & network | Business firewall, guest Wi-Fi separated, defaults changed | Quarterly |
| Power | UPS on servers, network and NVR with auto-shutdown | Battery test every 6 months |
| Documentation | Diagram, credentials vault, contacts, procedures | Every 6 months |
The bottom line
Good IT for a small business isn’t about expensive tools. It’s about consistent basics: knowing what you have, keeping it updated, protecting accounts, backing up properly, securing the network, protecting against power problems and writing things down. If you’d like to know where your business stands against this checklist, book a free IT assessment.
