Your IT provider keeps the business running. Most of them do that well, and the good ones do it very well.
Security is a different question, and it usually isn't in their contract. That's not a criticism. Support agreements are written to cover support, and security obligations sit in a different place, which is with you.
Which leaves owners in an awkward spot. You'd like to know whether you're in good shape. The people who could tell you are mostly people who'd like your IT contract, so a straight answer is hard to come by.
Here are four questions you can ask yourself, today, without paying anyone. They aren't gotchas. Any provider doing this work properly will have the answers to hand.
1. Can we see the results of the last successful backup restore test?
Not whether backups are running. Whether anyone has ever proved they'd come back.
Backups that run and can't restore are extremely common, and businesses find out at the exact moment they can least afford to. The test is cheap. Nobody does it unless they're asked.
A good answer is a date, a scope, and what was recovered. A weak answer is "backups are running fine." That's not the question.
2. Which of our staff have administrator access, and when was that last reviewed?
Admin rights accumulate. Somebody needs them for an afternoon, gets them, and keeps them for six years. Someone leaves and their account stays live.
Every account with admin rights is a way in. The list should be short, deliberate, and reviewed on a schedule.
A good answer is a list, and a date it was last checked. A weak answer is "only IT has admin," which is almost never true.
3. What does our agreement actually say you're responsible for on security?
Not what you assume. What's written down.
Most support contracts say considerably less about security than owners believe. Patching might be in there. Monitoring might not. Backup testing usually isn't. Incident response almost never is.
This isn't about catching anyone out. It's about finding out who's actually holding the thing you assumed was held.
A good answer is a clause. A weak answer is a reassurance.
4. If we were breached tomorrow, who notifies the OAIC, and how quickly?
Under the Notifiable Data Breaches scheme, a breach likely to cause serious harm has to be reported to the regulator and to the people affected. There's a clock on it.
That obligation is yours. It doesn't transfer to your IT provider because they run your servers.
Most businesses work this out during a breach, which is the worst possible time to be working anything out.
A good answer names a person and a timeframe. A weak answer is a pause.
What to do with the answers
If they come back clear and documented, you're in better shape than most and you don't need to do anything else. That's a real outcome and it's worth having.
If they come back vague, that usually isn't anyone's fault. It's the gap between what a support contract covers and what your obligations require, and somebody has to be looking at it. Your provider probably wasn't asked to.
Either way, you now know something you didn't know this morning, and it cost you an email.
Nova Sec is an independent security consultancy in Gippsland. It doesn't do day-to-day IT support and isn't looking for your provider's work. A second opinion on your IT provider →