Most businesses pick a Microsoft 365 plan from the price list. Do people need desktop Word and Excel? Then buy the cheapest plan that has them. That gets the productivity part right and skips the part that matters most on a bad day.

This guide breaks down Microsoft 365 Business Basic, Standard, and Premium: what each one includes, why the jump from Standard to Premium is about security and evidence rather than apps, and why we now treat Business Premium as the starting point for most small businesses.

Key Takeaways

• As of July 2026, Business Premium costs $22 per user per month, $8 more than Standard (Microsoft, 2026).
• Basic vs Standard is about apps. Standard vs Premium is about who can sign in, from where, and on what device.
• Without Premium, detailed sign-in logs last only 7 days, and upgrading later won’t bring them back.

Which Microsoft 365 Business Plan Should a Small Business Choose?

In July 2026, Microsoft raised Business Basic to $7 and Business Standard to $14 per user per month, while Business Premium stayed at $22, according to its Microsoft 365 pricing and packaging update. For any business that handles money or client data, Premium should be the default. The cheaper plans are fine as deliberate exceptions.

Plan	Price (per user/month, annual)	What it adds
Business Basic	$7	Email, Teams, OneDrive, SharePoint, web and mobile Office apps
Business Standard	$14	Everything in Basic, plus desktop Office apps
Business Premium	$22	Everything in Standard, plus sign-in controls, device management, and advanced threat protection

All three plans top out at 300 users. For a small business, the choice is never about size. It’s about what you get.

What’s the Difference Between Business Basic and Business Standard?

The gap between Basic and Standard is $7 per user per month after Microsoft’s 2026 update, and it buys one thing: the installed desktop apps. Basic users work in a browser and on a phone. Standard users get full Word, Excel, and Outlook on their computers. It’s a productivity choice, not a security one.

Basic works for someone who mostly reads email, joins Teams calls, and opens the occasional shared file. Standard fits anyone who lives in spreadsheets or builds real documents all day. That’s most office staff.

The 2026 update did give both plans a little more protection, including checking links when someone clicks them. But identity and device controls still sit one tier up.

What Does Business Premium Add Over Business Standard?

Identity-based attacks rose 32% in the first half of 2025, according to Microsoft’s Microsoft Digital Defense Report 2025. Premium is built around that problem. It uses the same apps as Standard. What you’re paying for is control over who gets into your accounts, from where, and on what device.

Per Microsoft’s Business Premium security FAQ, Premium adds four main pieces:

• Microsoft Entra ID P1 (Conditional Access). Rules about how people sign in, not just whether the password is right. Block sign-ins from other countries, shut off sign-in methods attackers abuse, or only allow company laptops to open company files. It builds on multi-factor authentication instead of replacing it.
• Microsoft Intune. Set security rules on laptops and phones and wipe company data off a lost device. It’s the tool behind mobile device management in most Microsoft offices.
• Defender for Office 365 Plan 1. Opens suspicious attachments in a safe sandbox first and flags emails pretending to be your owner or a vendor.
• Defender for Business. Endpoint protection with detection and response for your computers.

Microsoft 365 Business Premium costs $22 per user per month in 2026 and includes Microsoft Entra ID P1, Intune, Defender for Business, and Defender for Office 365 Plan 1. Business Standard includes none of those. The apps are identical, so the $8 difference pays entirely for identity, device, and threat protection.

Microsoft 365 Log Retention: Why 7 Days Isn’t Enough

The average breach took 241 days to identify and contain in 2025, according to IBM’s Cost of a Data Breach Report. Microsoft 365 Business plans without Premium keep detailed sign-in logs for just 7 days. Well before the average breach is contained, the record of how the attacker got in is gone.

Basic and Standard come with the free tier of Microsoft Entra ID, the system that handles sign-ins. Per Microsoft’s Entra data retention documentation, that tier keeps sign-in and directory audit logs for 7 days. Premium’s Entra ID P1 keeps them for 30 days and lets you export them for longer storage.

To be fair, every business plan includes Microsoft’s unified audit log, which keeps 180 days of activity like mailbox access and file changes. It shows what happened inside an account. The sign-in logs show how someone got into it, and that’s what tells you whether the hole is closed.

We saw this firsthand on an account compromise we worked this fall. An attacker used a phishing trick that got around MFA, then quietly read the mailbox for months.

On the client’s plan, the detailed sign-in logs only covered the last 7 days, so most of the timeline had to be pieced together from the less detailed audit log, and the start of the attack predated even that. We could prove what the attacker did, but never pin down exactly when they first got in.

The trick was device code phishing, a technique Microsoft’s own threat researchers documented in 2025. Microsoft’s guidance is to block that sign-in method with Conditional Access. That’s a Premium feature, so the rule that would have stopped this exact attack was never available.

Here’s the catch: log retention isn’t retroactive. Microsoft’s documentation says so directly. Upgrade today and you get 30 days of history starting now, not the month you needed. If a mailbox takeover like business email compromise worries you, the logs have to be collecting before it happens. (If it already has, start with our guide on what to do after a cyberattack.)

Is Microsoft 365 Business Premium Worth the Cost?

In 2025, Verizon’s Data Breach Investigations Report SMB Snapshot found ransomware in 88% of small and mid-sized business breaches, compared with 39% at larger organizations. When a small business does get breached, ransomware is usually part of it. Next to that, $8 per user per month is cheap. For a 10-person office, Premium costs $960 a year more than Standard.

Compare that to a single incident. The FBI’s 2025 Internet Crime Report counted more than $3 billion in reported business email compromise losses. Even a small case means hours of investigation, password resets, and calls to clients and your bank.

There’s one trap worth naming: paying for Premium and never turning anything on. None of these features configure themselves. A Premium license on default settings is mostly an expensive Standard license, which is why who manages your Microsoft 365 matters as much as which plan you buy.

When Business Basic or Standard Is Still Enough

You can mix Basic, Standard, and Premium licenses in one Microsoft 365 account, so not everyone needs the same plan. A seasonal worker who only needs email on a phone can live on Basic. A shared mailbox or room calendar usually needs no license at all.

The thing to watch: Microsoft licenses Premium’s protections per person. Anyone who handles money, client information, or admin access should be on Premium. Everyone else is a judgment call.

Not sure what plan your business is on, or whether the Premium features you’re paying for are actually turned on? A short conversation is an easy way to find out where you stand. Reach out to Engel Tech and we’ll take a look.

Frequently Asked Questions

Is Microsoft 365 Business Premium worth it for a small business?

For most businesses that handle money or client data, yes. As of July 2026, Premium costs $22 per user per month, $8 more than Standard. That buys sign-in controls, device management, stronger email protection, and 30 days of sign-in logs instead of 7.

What’s the difference between Microsoft 365 Business Basic and Business Standard?

Business Basic ($7 per user per month in 2026) includes email, Teams, OneDrive, SharePoint, and web and mobile Office apps. Business Standard ($14) adds the full desktop apps like Word, Excel, and Outlook. Their security features are nearly identical.

How long does Microsoft 365 keep sign-in logs?

On Business Basic and Standard, Microsoft Entra keeps sign-in and directory audit logs for 7 days. Business Premium includes Entra ID P1, which keeps them for 30 days. All business plans keep the unified audit log, covering mailbox and file activity, for 180 days.

Do I have to migrate anything to upgrade to Business Premium?

No. Moving from Basic or Standard to Premium is a license change in the admin center, and email, files, and settings stay put. Just remember that upgrading only starts the 30-day log window from that day. It doesn’t recover the 7-day logs that already expired.

Does Business Premium replace my antivirus?

It can. Business Premium includes Microsoft Defender for Business, which adds detection and response to endpoint protection. Some businesses run it as their main protection. Others keep a separate endpoint tool and use Premium for its identity and email security.

The email looks completely normal. It comes from a vendor you’ve paid for years, in the same thread as last month’s invoice, with a short note: “We’ve changed banks, please use the account below going forward.” Your bookkeeper updates the payment details, the invoice gets paid, and nobody notices anything until the real vendor calls asking where their money is.

That’s business email compromise (BEC). It has no virus, no suspicious attachment, and often no link at all. It’s simply a believable request to send money somewhere it shouldn’t go. This guide covers how the scam works, the one business rule that stops most of it, and what to do in the first hour if your business already paid.

Key Takeaways

• In 2025, the FBI received 24,768 BEC complaints, with reported losses of more than $3 billion.
• The control that saves the money is a process, not a product: verify any payment change by phone, using a number you already have.
• If you’ve already sent the money, call your bank’s fraud line right away. Speed decides whether you get it back.

What Is Business Email Compromise?

Business email compromise is a scam where criminals pose as someone you trust, by email or text, to get your business to send money or sensitive information. In its 2025 Internet Crime Report, the FBI counted 24,768 BEC complaints and $3.05 billion in reported losses, up from $2.77 billion in 2024. That makes it the second most costly crime type the FBI tracks. Closer to home, Coloradans filed 18,847 internet crime complaints with the FBI in 2025, reporting $355 million in losses across all scam types.

Most BEC attempts fall into a few patterns:

• Fake invoices or “new bank details” from a vendor. Often sent from the vendor’s real, hacked mailbox, so it lands inside a real conversation.
• Owner or executive impersonation. “I’m in a meeting, I need this wire sent before 3:00, don’t call.”
• Payroll diversion. An “employee” asks HR to switch their direct deposit to a new account.
• Gift card requests. A message that appears to come from the boss asks someone to buy gift cards for a client and send the codes.

If you’ve read our overview of phishing and small business email security, BEC is the variant that does the most financial damage. It’s also the one email filters catch least often, because there’s nothing technically malicious to catch.

Why Does BEC Fool Smart, Careful People?

In 2025, the FBI found businesses lost more than $30 million to BEC scams that used AI, including AI-written emails and cloned voices. But most BEC doesn’t need AI at all. It works because it borrows trust that already exists. An attacker inside a real mailbox reads old emails, learns who pays whom, and waits for the right moment.

Three things make it convincing:

• Real threads and lookalike domains. The message is either from the real account or from a domain that’s one letter off (acmesupp1y.com instead of acmesupply.com), which is nearly impossible to spot on a phone.
• Urgency and authority. The request comes from the owner or a key vendor, and it’s due today.
• Hidden inbox rules. Once inside a mailbox, attackers often create rules that quietly move or delete replies, so the real vendor’s “we never sent that” message never gets seen. Microsoft’s guidance on compromised accounts lists suspicious inbox and forwarding rules as one of the main signs a mailbox has been taken over.

And with cloned voices in the mix, “it sounded just like him” no longer proves anything. This isn’t a careless-employee problem. The people who fall for BEC are usually the ones doing their job quickly and well.

How Do You Prevent Business Email Compromise?

The most effective defense against BEC wire fraud is a simple business rule: never change payment details or send an unusual payment based on an email alone. The FBI’s own guidance for BEC victims says the same thing: never make payment changes without verifying with the intended recipient.

Here’s what that looks like as an office policy you could adopt today:

1. Call back on a known number. Confirm any change to bank details, routing numbers, or payment method by phone. Use the number on file or from a past invoice. Never use the one in the email.
2. Two people for big payments. Set a dollar threshold, say $5,000, above which a second person approves the payment.
3. Same rule for payroll. Confirm direct deposit changes with the employee, in person or by phone.
4. Urgency is a reason to slow down. Tell your team, in writing, that no one will ever get in trouble for pausing a payment to verify it. Including you.
5. No gift cards by email request. Ever. Real bosses and real clients don’t pay in gift card codes.

Why does this work when technology alone doesn’t? Because a phone call to a number the attacker doesn’t control breaks the scam completely. Even if the email came from a real, compromised mailbox, the real vendor on the other end of the call will say “we didn’t change anything.”

What Technology Makes BEC Harder to Pull Off?

In 2025, phishing and spoofing was the most-reported crime type in the FBI’s Internet Crime Report, with 191,561 complaints. That’s usually how attackers get into a mailbox in the first place. The right settings lower those odds, and most are already included in Microsoft 365 or Google Workspace. They just have to be turned on and checked.

• MFA on every mailbox. Mailbox takeovers usually start with a stolen password. Multi-factor authentication means a stolen password alone isn’t enough to get in. It has to cover every account, including old ones nobody uses anymore.
• Email authentication on your domain. SPF, DKIM, and DMARC make it much harder for someone to send email that appears to come from your exact domain. Our guide to email authentication for small businesses walks through it.
• External sender warnings. A banner that says “this message came from outside your organization” makes a fake “owner” email stand out.

Two more settings close the gaps attackers count on. Alerts on new forwarding and inbox rules tell you the same day if someone starts hiding or copying a mailbox’s mail. Prompt offboarding shuts down former employees’ mailboxes, which often keep receiving invoices behind an old password. None of these replace the callback rule. They make it less likely you’ll ever need it.

What Should You Do If You Already Sent the Money?

Act within the hour. In 2025, the FBI’s Recovery Asset Team froze $679 million in stolen funds through its Financial Fraud Kill Chain. In this process, the FBI works directly with banks to freeze the receiving account before the money moves again. For transfers to U.S. accounts, it froze 61% of reported losses. That only works if the report comes in fast.

1. Call your bank’s fraud line now. Don’t email. Tell them it’s a fraudulent wire or ACH and ask for a recall or reversal.
2. File a complaint at ic3.gov. Include full banking details for both accounts. The FBI uses them to contact the receiving bank.
3. Lock down the mailbox. Reset the password, sign the account out of all sessions, confirm MFA is on, and remove any inbox or forwarding rules you didn’t create.
4. Warn the other party through a known channel. Call the vendor or customer. If your mailbox was compromised, your customers may be getting fake invoices from you right now.
5. Call your cyber insurer. Many policies cover funds transfer or social engineering fraud under a separate, smaller limit. Most also require prompt notice.

If the attacker was inside your systems, the response goes beyond the payment. Our guide on what to do after a cyberattack covers the broader steps. Our post on cyber insurance requirements for Colorado businesses explains the state’s 30-day notification clock if customer data was exposed.

Is Your Business Set Up to Catch This?

Most businesses we talk to have never written down a payment verification rule, and very few have looked at the inbox rules in their own mailboxes. Does MFA cover every account? Would anyone notice a new forwarding rule? Would your team pause on a “new bank details” email? If you’re not sure, a short conversation is an easy way to find out where you stand. Reach out to Engel Tech and we’ll take a look.

Frequently Asked Questions

What is business email compromise in simple terms?

It’s a scam where a criminal pretends to be someone you trust, like a vendor, your boss, or an employee, to get you to send money or change payment details. It usually arrives as an ordinary-looking email with no virus or link, which is why spam filters often miss it.

How do I know if a vendor’s email has been hacked?

You often can’t tell from the email itself, because it may come from the vendor’s real account. Treat any request to change bank details as suspicious by default, and confirm it by calling the vendor at a number you already have on file.

Can I get my money back after a wire fraud scam?

Sometimes, if you move fast. Call your bank’s fraud department immediately to request a recall, and file a report at ic3.gov with the full banking details. In 2025, the FBI’s Recovery Asset Team froze about 58% of the funds it tried to stop, and speed is the biggest factor.

Does Microsoft 365 or Google Workspace protect against BEC?

Both include tools that help, like MFA, email authentication, external sender warnings, and alerts on suspicious inbox rules. But many of these have to be configured, and none of them can stop an employee from paying a convincing fake invoice. A payment verification policy covers that gap.

Does cyber insurance cover business email compromise?

Many policies do, but often under a separate “social engineering” or “funds transfer fraud” limit that may be much lower than the main coverage. Some policies also require proof that you had verification procedures in place. Check your policy before you need it.

Who is responsible if we pay a fake invoice?

It depends on the contracts and whose mailbox was compromised, and it often ends up as a dispute between the two businesses. That’s another reason to verify payment changes by phone: it protects you whether the breach happened on your side or the vendor’s.

Most Google Workspace vs Microsoft 365 comparisons are giant feature grids. They all say the same thing: both do email, file storage, video calls, and documents. That’s true, but it doesn’t help you decide.

Google Workspace is Google’s business suite: Gmail, Drive, Docs, Sheets, and Meet, running under your own domain. Microsoft 365 is Microsoft’s version: Outlook, OneDrive, SharePoint, Teams, and the Office apps. This guide skips the spec sheet and covers the few differences that actually matter for a small business.

Key Takeaways

• As of October 2026, both platforms cost $7, $14, and $22 per user per month at their three small business tiers. As a result, price no longer decides it.
• How your team works, and what your other software expects, should drive the choice.
• Serious security controls live in the $22 tier on both sides, and neither platform backs up your data for you.

Isn’t Google Workspace Cheaper Than Microsoft 365?

Not anymore. For years, Google was the budget option. However, after Microsoft’s price change on July 1, 2026, the two lineups match dollar for dollar on annual billing:

Tier	Google Workspace	Microsoft 365
Entry	Business Starter: $7/user/month	Business Basic: $7/user/month
Middle	Business Standard: $14/user/month	Business Standard: $14/user/month
Top small business tier	Business Plus: $22/user/month	Business Premium: $22/user/month

These prices come from Google’s Workspace pricing page and Microsoft’s business plan comparison. They assume an annual plan. Google charges more if you pay month to month, and both companies run intro discounts that expire.

In other words, the decision comes down to three things a pricing page won’t show you. How does your team work? What does your other software expect? And what do you actually get at the tier you’ll buy?

How Does Your Team Actually Work?

Google Workspace was built for the browser. Docs, Sheets, and Drive live online, and several people can edit the same file at once. There’s nothing to install. As a result, teams that write together and work from a mix of devices tend to find Google simpler.

Microsoft 365, on the other hand, is built around the desktop Office apps: Word, Excel, Outlook, and PowerPoint. They also run in a browser, but the desktop versions are where Microsoft is strongest. For example, if your business lives in complex spreadsheets or Excel macros, Microsoft is usually the better fit. Similarly, heavily formatted Word documents shared with clients tend to behave better there.

One trap catches a lot of people here. In our experience, it’s the most common licensing mistake we see. Microsoft’s cheapest tier, Business Basic, does not include the desktop Office apps. It’s web and mobile versions only, as Microsoft’s Office apps service description shows. Businesses buy Basic because it looks like the obvious starter plan. Then, for instance, the bookkeeper finds out they can’t install Excel. If your team needs desktop Office, start at Business Standard.

Storage is the other practical difference. Specifically, Microsoft gives each user 1 TB of OneDrive storage plus a separate mailbox. In contrast, pooled storage is how Google does it: one shared allowance for the whole business. That works out to 30 GB per person on Starter and 2 TB per person on Standard. As a result, Google’s entry tier gets tight fast if your team stores large files. For more on organizing files either way, see our guide to the best way to store small business files.

What Do Your Other Software and Clients Expect?

This is the factor most owners don’t think about. In fact, it’s often the one that decides it.

Start with the software your business already depends on. For instance, some accounting and industry-specific apps are built to work with Outlook or Excel. Others assume Windows computers that sign in through Microsoft. However, many connect just as well to Google. Either way, check before you choose, not after.

Then think about who you swap files with. If clients, lenders, or partners send Excel workbooks and Word files with tracked changes, Microsoft will save you formatting headaches. On the other hand, if your clients mostly share Google Docs links, the reverse is true.

Finally, consider your industry. Businesses that handle health, financial, or legal information can meet their requirements on either platform. That said, it takes the right tier and the right setup. If a client, auditor, or insurance carrier will ask how your email and files are protected, make sure your plan can answer.

Which One Is More Secure for a Small Business?

Neither, by default. Both platforms are secure at the right tier, and both are weaker than most owners assume at the entry tier. So the comparison that matters is between the plans you’ll realistically pay for.

Here’s what a small business should look for, whichever platform it picks:

• Enforced multi-factor authentication (MFA). Both platforms support it at every tier, and Google lets admins enforce 2-Step Verification for everyone. That said, what matters is whether it’s required or left optional. Our guide to MFA covers why this is the first setting to check.
• Device management. This lets you require a passcode, encrypt a laptop, and wipe company data from a lost phone. Microsoft includes it with Intune in Business Premium. Google includes basic device management in every business tier, with advanced controls in Business Plus.
• Sign-in rules. These block sign-ins from unexpected countries or unmanaged devices. On Microsoft, this is called Conditional Access, and it comes with Business Premium. Google’s version, Context-Aware Access, isn’t in any Business plan. It requires an Enterprise plan.
• Endpoint protection. Business Premium adds Defender for Business, which protects the computers themselves, not just the inbox. Google, however, focuses on protecting Gmail and Drive and leaves computer protection to separate tools.
• Retention and search. This means keeping and searching email and files for legal or compliance reasons. Google includes Vault starting at Business Plus. Similarly, Microsoft’s top small business tier includes its own retention tools.

The pattern is the same on both sides: the $22 tier is where the serious security controls live. In contrast, a $7 plan with default settings doesn’t get much protection from either company. In particular, someone has to turn these features on and keep them configured. That’s the real question behind who should manage Microsoft 365 for your business, and it applies to Google too.

Neither One Backs Up Your Data for You

This surprises a lot of owners. Microsoft and Google keep their services running and protect against their own hardware failing. However, they don’t promise to bring back a file deleted three months ago. The same goes for a mailbox removed when someone left, or data encrypted by ransomware that synced to the cloud.

Both platforms have recycle bins and version history, but they have time limits. For example, Google Drive empties its trash after 30 days. Microsoft’s SharePoint and OneDrive recycle bins hold items for 93 days. In other words, neither is a backup. If your business can’t afford to lose its email and files, you need a separate backup either way. We go into detail in are your business backups actually backing anything up?

Already Picked One? When Switching Is Worth It

If you’re already on one platform, the bar for switching should be high. Moving means migrating every mailbox, file, calendar, and shared permission. In addition, it means updating your domain’s email settings and retraining staff. It’s very doable, but it’s a project, not an afternoon.

Switching makes sense when the platform is actively fighting how your business works. For example, your team is constantly converting files, or a key app only works with the other platform. Similarly, watch for half the office quietly using the other one on the side. It’s also worth a look if you’re on Microsoft through a reseller plan that limits what you control. We cover that in why GoDaddy 365 holds businesses back.

In our experience, most requests to switch are really about something else: spam, lost files, messy permissions, or people not knowing where things live. Those are setup problems. As a result, they follow you to the new platform. Configuring what you have is almost always the cheaper fix.

Google Workspace or Microsoft 365: Which Should You Pick?

If your team works mostly in the browser and shares documents, Google Workspace is likely the simpler fit. If your business runs on desktop Office, complex Excel, or software that expects Microsoft, Microsoft 365 is likely the better one. Still unsure? The software you already use and the files your clients send will usually settle it.

That said, either platform is only as good as its setup. If you’re choosing a platform, thinking about switching, or unsure your current one is set up right, a short conversation with Engel Tech is an easy way to find out where you stand.

Frequently Asked Questions

Is Google Workspace cheaper than Microsoft 365?

Not anymore. On annual plans, both cost $7, $14, and $22 per user per month at their three main small business tiers, as of October 2026. Google charges more if you pay month to month, and both run introductory discounts, so compare the price you’ll pay after the first year.

Which is better for a small business, Google Workspace or Microsoft 365?

Neither is better across the board. Google Workspace tends to fit browser-based teams that collaborate on shared documents. Microsoft 365 tends to fit businesses that rely on desktop Excel and Word, or on software built around Microsoft. The apps your business already uses usually decide it.

Does Microsoft 365 Business Basic include Word and Excel?

Only the web and mobile versions. Business Basic does not include the installable desktop Office apps. If your team needs desktop Word, Excel, and Outlook, you need Business Standard or Business Premium.

Can I use Gmail with Microsoft 365, or Outlook with Google Workspace?

You can open Google Workspace email in the Outlook app, and you can view Microsoft 365 email in other mail apps. But your mailboxes, files, and calendars still live on one platform. Running both platforms side by side usually means paying twice and keeping files in two places.

How hard is it to switch from Google Workspace to Microsoft 365, or the other way?

It’s a real project, but a common one. Email, files, calendars, and sharing permissions all have to be moved, your domain’s email records have to be updated, and staff need a little retraining. With planning, most small businesses can switch with little or no downtime.

Do I need a separate backup for Google Workspace or Microsoft 365?

Yes, if your business can’t afford to lose its email and files. Both platforms protect against their own outages, but recycle bins and version history have time limits and won’t cover every deletion, departed employee, or ransomware event. A separate backup covers what they don’t.

Someone in your office probably drafted an email in ChatGPT this week, and nobody decided that should happen. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. An AI acceptable use policy for small business puts a few simple rules around something that’s already helping, without shutting it down.

Is Your Team Already Using AI at Work?

Almost certainly. In most small offices, AI showed up the way any free app does. One person tried it to clean up an email or summarize a contract, it saved them twenty minutes, and they told a coworker. A few months later, half the office uses it, mostly on personal accounts they signed up for with their own email.

That’s not a crisis on its own. The problem is that with no rules, everyone makes their own. One person won’t paste anything with a client’s name in it. Another pastes the whole file. IT people call this shadow AI: AI tools used for work that the business never approved and can’t see. At a small business, shadow AI is usually just people trying to get their work done.

It tends to come up when someone asks about it. A client security questionnaire or a cyber insurance application starts asking how your team uses AI. Or an employee asks, “Am I allowed to use this?” and nobody has an answer.

Same Tool, Different Rules: Personal vs. Business Accounts

Here’s the part a lot of owners miss: the same AI tool follows different rules depending on which account you’re signed into. The screen looks identical. What happens to what you type does not. Three differences matter.

Training. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s help page on model training explains where that setting lives. OpenAI’s business plans, like ChatGPT Business and Enterprise, don’t train on your data by default.

Control. A business account sits under the company’s admin. You decide who has access and what’s turned on. A personal account belongs to the employee. You can’t see it, set rules for it, or shut it off.

Offboarding. When someone leaves, a personal account leaves with them, along with every chat that had client details in it. A business account gets closed as part of your normal employee offboarding process.

You May Already Own the Safe Version

Many small businesses already pay for a business AI tool and don’t realize it. If you’re on Microsoft 365, Copilot Chat comes with enterprise data protection at no extra cost when people sign in with their work account, and Microsoft says prompts and responses aren’t used to train foundation models. If you’re on Google Workspace, Gemini in qualifying paid plans isn’t used for AI model training outside your domain without permission.

So a good AI policy for small business is less about banning tools and more about steering people onto the account the business already controls. Those admin controls only help if someone actually keeps an eye on them, which is why it matters who manages your Microsoft 365 setup. And if you’re planning to add the paid Copilot that works across your company files, run a permissions audit before you turn on Copilot. That post covers what AI can reach on its own. This one covers what your people hand to it.

What Actually Goes Wrong With AI at Work?

The real risks are ordinary: everyday shortcuts that go sideways.

Sensitive data in personal accounts. An employee pastes a client’s tax return into a personal chatbot to “summarize it.” It works great. But now that return sits in an account the business doesn’t control, and it’ll still be there after that employee moves on.

Confident, wrong output. AI writes smoothly whether it’s right or wrong. A staff member sends a customer an AI-drafted email with the wrong price, the wrong date, or a policy you don’t actually have. The customer doesn’t care that a chatbot wrote it. Your name is on it.

Browser extensions and add-ons. AI extensions and “assistant” add-ons often ask for permission to read every page you visit. That can include email, your banking portal, and client files. Someone installs one to summarize articles and never thinks about what else it can see.

IBM’s 2025 Cost of a Data Breach Report found that one in five organizations it studied reported a breach due to shadow AI. Organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs than those with little or none. The takeaway for a ten-person office is simple: the risk comes from the AI nobody’s managing, not from AI itself.

Banning AI usually doesn’t fix that. It tends to push the activity onto personal phones, where you can’t see it at all.

What to Put in Your AI Acceptable Use Policy for Small Business

For a 10-person office, an AI acceptable use policy is one or two pages, not a governance binder. Write it as an AI policy for employees: plain language that answers the questions your team is already asking. If your office mostly uses ChatGPT, this is your ChatGPT policy. Here’s a copy-ready outline:

1. Purpose. One line: we use AI to work faster without putting client or company data at risk.
2. Approved tools and accounts. Which AI tools are approved, and that work happens only on the business account, never a personal one.
3. Data that never goes in. Client personal information, financial and tax records, health information, passwords, and anything under a confidentiality agreement.
4. Human review. A person checks AI-written work for accuracy before it reaches a customer, a client, or an official document.
5. Disclosure. When staff should say AI helped, such as client deliverables where the client would reasonably expect to know.
6. Add-ons and extensions. No AI browser extensions, plugins, or app connections without approval first.
7. Who to ask. One named person for questions and for reporting mistakes, with no penalty for speaking up quickly.
8. Review date. When the policy gets revisited, at least every six months.

The “data that never goes in” list is the heart of it. Make it specific to your business. A bookkeeping office and a dental office will have different lists, and examples from your own work stick better than generic categories.

The “who to ask” line matters more than it looks. If someone pastes the wrong thing into the wrong tool, you want to hear about it that afternoon, not months later. A policy that punishes honest mistakes teaches people to hide them.

How Do You Make an AI Policy Stick?

A policy only works if following it is easier than ignoring it.

Start by giving people the approved tool. If the business account is harder to use than the personal one, people will keep using the personal one. Set it up and sign everyone in before you hand out the policy.

Training can be short. Fifteen minutes at a staff meeting is enough to walk through the “never goes in” list with real examples from your own work. While you’re at it, review the settings your business account offers and pick them on purpose, instead of living with defaults nobody chose.

Then put a date on the calendar. AI tools change their plans and settings often, so a quick look every six months keeps the policy honest.

One more note for Colorado businesses. Colorado’s SB 26-189 applies starting January 1, 2027, and covers AI used in consequential decisions such as hiring. If you use AI to screen applicants or make similar calls, talk to your attorney about what it means for you. Our overview of IT compliance requirements for Colorado businesses covers the broader picture.

Not sure which AI tools your team is using, or whether you already pay for a business version? That’s a quick thing to sort out together. If you’re in the Denver/Aurora area, a short conversation is an easy place to start.

Frequently Asked Questions

Does my small business really need an AI policy?

If anyone on your team uses AI for work, yes, and they probably do. Microsoft’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. A one-page policy gives everyone the same rules instead of each person making up their own.

Is it safe to use ChatGPT for work?

It can be, if three things are in place: staff use a business account, sensitive data stays out, and a person checks the output before it goes anywhere. The biggest risk is usually personal accounts the business can’t see or control.

Does ChatGPT train on what my employees type into it?

On personal accounts, it can. Personal ChatGPT accounts can use your conversations to improve models unless the setting is turned off. OpenAI’s business plans, such as ChatGPT Business and Enterprise, don’t train on your data by default.

Do we already have a business AI tool through Microsoft 365 or Google Workspace?

Quite possibly. Copilot Chat signed in with a Microsoft 365 work account includes enterprise data protection at no extra cost. Gemini in qualifying paid Google Workspace plans doesn’t use your content for AI model training outside your domain without permission. Check what your current plan includes before buying something new.

What should employees never paste into an AI tool?

Client personal information, financial and tax records, health information, passwords, and anything covered by a confidentiality agreement. Even on an approved business account, share only what the task actually needs. When in doubt, leave it out or ask first.

Should I just ban AI at work?

Usually not. Bans tend to push AI use onto personal phones and accounts where you can’t see it at all, which is the problem you were trying to solve. Giving people an approved tool and a few clear rules works better.

Your HIPAA compliance consultant has you covered on policies, staff training, and the paperwork binder. But when was the last time anyone checked whether your access logs would actually hold up if HHS came asking? HIPAA compliance splits into two halves, and the technical half, the one that lives in your IT rather than your policy binder, is where small medical and dental practices most often have a real gap. Here’s what that half actually covers, and what’s worth checking in your own practice.

HIPAA Compliance Has Two Halves — and Most Practices Only Have One Covered

Most practices treat “HIPAA compliant” as one thing: a binder of policies, a staff training module, maybe a consent-form update. That’s real work, and it matters. It’s also only half the law. HIPAA is actually two separate rules. The Privacy Rule governs how patient information is used and disclosed, which is where policies and training live. The Security Rule is a different, more technical requirement: it governs how electronic patient health information, usually shortened to ePHI, is actually protected on the systems that store and move it.

A compliance consultant typically owns the Privacy Rule side. The Security Rule side is IT’s job, and it’s the half a generic IT setup usually misses entirely, because nobody framed it as a HIPAA requirement in the first place. A stolen laptop with an unencrypted patient database, an old employee’s EHR login still active six months after they left, a scanner vendor with standing remote access and no signed agreement — none of these show up in a policy binder. They’re ordinary IT gaps that become HIPAA problems the moment patient data is involved. General Colorado business compliance requirements layer on top of this, but healthcare has its own, more specific bar to clear.

The Technical Safeguards a Generic IT Setup Usually Misses

The Security Rule doesn’t hand practices a shopping list of products to buy. It sets standards and leaves the implementation to the practice, which is exactly why it’s easy to under-deliver on without realizing it. NIST’s implementation guide for the Security Rule is the closest thing to a plain-English translation of what regulators actually expect, and a handful of items come up again and again as the ones small practices miss.

Access control is the biggest one. It’s not enough to have a password on the EHR system. The real question is whether the list of people who can open patient records matches the list of people who currently work there. Role-based access controls keep that list accurate as staff join, change roles, and leave, instead of accumulating logins nobody remembers to remove. Layered on top of that, multi-factor authentication on anything touching patient data is close to table stakes at this point; a password alone is a thin barrier around records this sensitive.

Beyond access, the Security Rule expects audit controls, meaning a system that actually records who accessed what record and when, not just a login screen with no memory behind it. It expects encryption for patient data both at rest, on laptops and servers, and in transit, when it moves between systems. And it expects basics like automatic logoff on shared workstations, so a computer at the front desk doesn’t sit open to the last patient’s chart after the staff member steps away. None of this is exotic. It’s the kind of thing a healthcare-aware IT setup builds in by default, and a generic one usually doesn’t, simply because nobody asked for it specifically.

Business Associate Agreements: The IT Piece Nobody Signs

Any vendor that can access, store, or transmit patient data on a practice’s behalf is what HIPAA calls a business associate, and the law requires a signed Business Associate Agreement, or BAA, with every one of them. This isn’t a formality or a box-checking exercise. It’s a real, legally binding contract, and it’s also the single piece of HIPAA IT compliance practices most often skip entirely.

The obvious candidate is a practice’s IT provider, since they can typically reach anything on the network, patient records included. But the list is longer than that: cloud backup services, the EHR hosting company, and yes, the copier or scanner vendor with a remote-support agreement that lets their technician log in from off-site. If any of them touch patient data and haven’t signed a BAA, that’s a gap, regardless of how good their actual security is. It’s worth asking every vendor with system access a direct question: can you show me our signed BAA? A vendor that hesitates or doesn’t know what that is has already answered it.

What a Breach Looks Like From the IT Side

A stolen laptop, a compromised login, or a ransomware incident is a bad day for any small business. When patient data is involved, it’s also a legal clock. HIPAA’s Breach Notification Rule requires notifying affected individuals without unreasonable delay, and in no case later than 60 days from the date the breach was discovered. That clock starts the moment the practice knew, or reasonably should have known, something happened, whether or not the full picture is clear yet. The immediate response steps after any cyberattack still apply here; HIPAA just adds a firm deadline and a specific notification process on top of them.

Detection speed is where this gets serious. Healthcare has been the costliest industry for data breaches for fourteen years running, according to IBM’s 2025 Cost of a Data Breach Report, averaging $7.42 million per breach and, more relevant here, taking 279 days on average to even identify and contain. That gap between when something happens and when anyone notices it is exactly what audit logging and access monitoring are for. A practice that can’t quickly answer “who accessed this record, and when” isn’t just missing a technical safeguard, it’s the reason breaches run long and get expensive before anyone even knows to start the 60-day clock.

What to Actually Ask When You’re Evaluating IT Support for a Healthcare Practice

Nobody hands out an official “HIPAA compliant” certification to IT providers, no matter what a sales pitch implies. Compliance isn’t a stamp you buy once; it’s an ongoing practice, verified through what an IT provider actually does. A few direct questions cut through the marketing:

• Do they know what counts as PHI? If they can’t distinguish patient health information from any other business data, they’re not thinking about your practice’s specific risk.
• Will they sign a BAA? A “yes” without hesitation is the baseline. A provider who’s never been asked before is a sign they haven’t worked with healthcare clients.
• Can they show you an access log on request? If access controls and audit logging aren’t already something they can demonstrate, they’re not built in, they’re an afterthought.
• Do they support encryption and automatic logoff as standard, not as an upsell? These are baseline expectations for a healthcare-aware setup, not premium add-ons.

If you’re not sure how your current IT setup would answer those questions, that’s worth a short conversation before a compliance questionnaire, an insurer, or an actual incident asks them for you. Reach out here.

Frequently Asked Questions

What’s the difference between HIPAA’s Privacy Rule and Security Rule?

The Privacy Rule governs how patient information can be used and disclosed, and typically lives in a practice’s policies, staff training, and paperwork. The Security Rule is a separate, more technical requirement covering how electronic patient health information is actually protected on the systems that store and move it, things like access controls, encryption, and audit logging. A compliance consultant usually handles the first half; IT handles the second.

Does my regular IT provider need to be HIPAA compliant?

Any IT provider with access to systems containing patient data needs to operate in a way that meets HIPAA’s Security Rule requirements and sign a Business Associate Agreement. There’s no official certification that makes a provider “HIPAA compliant” on paper; what matters is whether their actual practices, access controls, encryption, logging, and BAA included, hold up.

What is a Business Associate Agreement and who needs to sign one?

A Business Associate Agreement, or BAA, is a legally required contract between a practice and any vendor that can access, store, or transmit patient data on its behalf. That includes an IT provider, cloud backup services, EHR hosting companies, and any vendor with remote access to systems touching patient records, such as a copier or scanner company. If a vendor touches patient data without a signed BAA, that’s a compliance gap regardless of how secure their systems otherwise are.

How quickly do I have to report a HIPAA breach?

HIPAA’s Breach Notification Rule requires notifying affected individuals without unreasonable delay, and no later than 60 days after the breach is discovered. That 60-day clock starts when the practice knew, or reasonably should have known, that a breach occurred, not when the full scope is understood. Breaches affecting 500 or more people in one state also require media notification.

Can an IT company be “HIPAA certified”?

No official federal HIPAA certification exists for IT providers or any other vendor. Compliance is an ongoing practice, not a one-time credential. Be cautious of any provider that markets itself as “HIPAA certified” as if it were a fixed accomplishment rather than something maintained through actual access controls, encryption, logging, and a signed BAA.

What technical safeguards does HIPAA actually require?

The Security Rule requires access controls limiting who can reach patient data, audit controls that log who accessed what and when, encryption for patient data at rest and in transit, and safeguards like automatic logoff on shared workstations. NIST’s implementation guide for the Security Rule translates these into concrete practices a small practice’s IT setup should already include.

Somewhere right now, a stranger could send an email that looks like it came from your business. It could reach one of your customers or vendors, without ever touching your inbox or your website. Most business owners assume their email provider blocks this automatically. It partially does. The missing piece is usually a policy. That policy tells other mail servers what to do when someone fails the check. It also decides whether to tell you it happened at all. That policy has a name: DMARC. Together with SPF and DKIM, it makes up what’s called email authentication. So here’s what each piece does, and what having them actually in place looks like.

What Happens When Nobody’s Watching Your Domain

Email was never built with a way to verify who actually sent a message. Anyone can type any “from” address into an outgoing email, the same way anyone can write any return address on a paper envelope. Most of the time nothing comes of it. But it means your business domain can be used to send email you never wrote. That email can reach people you actually do business with. For example, a vendor might get an invoice that looks like it’s from you. Or a customer might get a payment request that looks like it’s from your billing address.

It’s easy to assume this doesn’t apply if you don’t send marketing email or bulk newsletters. That’s a different question. This isn’t about how much email you send. It’s about whether anything stops someone else from sending email as you at all. A business that sends five emails a day is exactly as exposed to domain spoofing as one that sends five thousand.

This is also a different problem from the phishing emails that show up in your inbox. That’s its own topic, worth understanding on its own. Instead, this is about your domain being used against someone else. Often, you won’t find out until they call to ask why you’re sending them strange invoices.

SPF, DKIM, and DMARC: The Building Blocks of Email Authentication

These three sit on top of each other, and each one covers something the others don’t.

SPF (Sender Policy Framework) is a list. It’s a record published in your domain’s DNS settings. It names exactly which mail servers are allowed to send email on your behalf. That includes your email provider, and anything else you actually use to send mail. Think of it as a guest list at the door. If a server isn’t on the list, receiving mail systems get suspicious of anything claiming to be from your domain.

DKIM (DomainKeys Identified Mail) is a digital signature. Your mail server signs each outgoing message with a private cryptographic key. The receiving server then checks that signature against a public key published in your DNS. If the message was altered in transit, or wasn’t actually signed by your legitimate mail server, the signature doesn’t match. Think of it as a wax seal on an envelope. It’s proof the message wasn’t tampered with, and that it genuinely came from where it claims to.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instructions. It tells receiving mail servers what to do when a message fails SPF, fails DKIM, or both. The options are to let it through anyway, send it to spam, or reject it outright. DMARC also asks receiving servers to send you reports on what they’re seeing sent from your domain. For many businesses, that’s the first time they discover someone has been impersonating them. Using the same analogy, DMARC is what tells the doorman what to do when someone’s not on the list. It also tells him to let you know it happened.

A domain can have SPF without DKIM, DKIM without a real DMARC policy, or a DMARC record that only watches and never blocks anything. Having some of these pieces isn’t the same as having all three working together.

Why Most Small Businesses Have This Half-Configured

Most small businesses already have SPF, usually without ever setting it up on purpose. Microsoft 365 and Google Workspace both publish a baseline SPF record automatically, as part of getting your account working. That’s so outgoing mail doesn’t immediately land in spam. That’s often where setup stops. DKIM frequently isn’t turned on. DMARC, if it exists at all, is commonly set to monitor-only. That means it collects reports, but doesn’t actually block or flag anything that fails.

This isn’t negligence. It’s the natural result of setup that was done to get email sending, not to get the domain protected. Nobody sat down and decided to skip DMARC enforcement — it just wasn’t part of the original checklist. This gets worse when domain and email management are split across different providers. That’s exactly the situation a GoDaddy-plus-Microsoft-365 setup tends to create. DNS records live in one place. Mail flow is managed in another. Nobody has a clear view of both.

In practice, this is one of the first gaps we find when reviewing a new client’s domain. SPF is present from day one, because the email platform put it there automatically. DKIM is never turned on. DMARC is either missing entirely, or quietly set to monitor-only. Nobody did anything wrong. Nobody ever finished the job.

Why This Is Becoming Harder to Ignore

This used to be treated as an enterprise-only concern. That’s no longer true. Since February 2024, Google has required this for high-volume senders. Any business sending 5,000 or more daily messages to Gmail addresses needs SPF, DKIM, and at least a baseline DMARC record in place. Otherwise, those messages risk being rejected outright. Google tightened that enforcement further in November 2025. Yahoo and Microsoft have followed similar paths. The practical effect: email authentication has quietly become table stakes across the entire email system. It’s no longer a checkbox reserved for large companies with dedicated IT security teams.

The stakes on the impersonation side are real too. The FBI’s 2025 Internet Crime Report recorded phishing and spoofing as the single largest category of complaints that year, at 191,561. That’s more than any other crime type tracked, including extortion and investment fraud. Business email compromise, a category closely tied to look-alike and spoofed sender addresses, accounted for just over $3 billion in reported losses. Phishing that reaches your business is one side of that threat. Your own domain being used to phish someone else is the other side. It’s the side SPF, DKIM, and DMARC are built to close off.

What Getting This Set Up Actually Looks Like

This is a small number of DNS record changes, not new software or hardware to buy. If you’re on Microsoft 365 or Google Workspace, whoever manages that environment can typically confirm and complete SPF and DKIM in well under an hour. Most of the groundwork is already provided by the platform. Microsoft publishes its own step-by-step DMARC setup guide for exactly this scenario.

DMARC is the step worth doing carefully rather than quickly. The realistic path starts with a monitor-only policy. It does nothing but collect reports on what’s being sent from your domain, including anything you didn’t send. After a few weeks of watching those reports, you confirm every legitimate sender is accounted for. Then the policy moves to actually rejecting or quarantining anything that fails. Jumping straight to full enforcement, without that monitoring step, risks silently blocking a legitimate tool you forgot about. That could be an invoicing platform, or a marketing tool sending mail on your behalf.

If you’ve never checked whether your domain has all three of these in place, that’s worth a quick look. The same goes if you’re not sure what your current DMARC policy actually does when something fails. Better to find out now, before it’s your customers fielding the fake invoice instead of you fielding the report. Reach out here.

Frequently Asked Questions

What is DMARC and does a small business actually need it?

DMARC is a DNS record that tells receiving mail servers what to do when an email fails SPF or DKIM checks, and asks them to report that activity back to you. Any business with a domain that sends or receives email is a potential target for spoofing, regardless of how much email it sends. Without DMARC, a business typically has no visibility into whether someone else is sending email pretending to be them.

What’s the difference between SPF, DKIM, and DMARC?

SPF lists which mail servers are allowed to send email for your domain. DKIM adds a cryptographic signature proving a message wasn’t altered and genuinely came from an authorized server. DMARC sets the policy for what happens when a message fails either check, and provides reporting on spoofing attempts. They work together — SPF and DKIM do the checking, DMARC decides the consequence.

Can someone spoof my domain even if I use Microsoft 365 or Google Workspace?

Yes. Microsoft 365 and Google Workspace both publish a basic SPF record automatically, but that alone doesn’t fully protect your domain. Without DKIM and an enforced DMARC policy, someone can still send email that appears to come from your domain, and you likely won’t know it happened unless a recipient tells you directly.

Will setting up DMARC stop phishing emails from reaching me?

Not directly. DMARC protects outbound trust in your own domain — it stops (or exposes) someone using your domain to send email to others. It doesn’t screen the phishing emails landing in your own inbox from other spoofed or malicious domains; that’s a separate problem handled by email filtering and user awareness.

Is setting up SPF, DKIM, and DMARC expensive?

No. These are DNS record changes, not paid software or hardware. For most businesses on Microsoft 365 or Google Workspace, the time investment is the main cost — typically well under an hour for SPF and DKIM, plus a few weeks of monitoring before moving DMARC to full enforcement.

How do I check if my business already has SPF, DKIM, and DMARC set up?

Free online lookup tools can check your domain’s DNS records for all three in seconds. The harder part isn’t checking whether they exist — it’s confirming DKIM is actually signing outgoing mail correctly and that your DMARC policy is set to actually act on failures, not just silently monitor them.

Your guest WiFi has its own name and its own password. But is it on a separate network from the computer running your books, your point-of-sale system, and your files? Most owners assume so. The honest answer, once you check, is usually “I’m not sure.” That gap is where a surprising amount of small business risk hides. Closing it is what’s called network segmentation. Here’s what it actually does, what it protects against, and what putting it in place looks like. You don’t need an IT department to follow along.

The Network Most Small Businesses Actually Have

Most small business networks grow the same way. One router, or one set of wireless access points, ends up running everything. Devices get connected to it as the need comes up. The office computers. The shared drive or file server. The point-of-sale system. A couple of security cameras. Maybe a smart thermostat. And, eventually, a guest WiFi network for customers or visitors, added on top of whatever was already there.

Nobody sits down and designs this. It accumulates, one device at a time. Eventually a dozen different systems are running on a single flat network. That means every device on it can, in principle, see and reach every other device on it. A different WiFi name and password for guests feels like a separation. But unless the network is actually split into isolated sections, it isn’t one. A guest’s phone and the computer running payroll can still be neighbors on the same network. Neither one has to realize it.

That’s not a hypothetical edge case. It’s the default state of most small business networks. Plenty of them already have strong passwords, current software, and antivirus in place. Segmentation isn’t a sign something else is broken. It’s a layer those other protections don’t cover.

What Network Segmentation Actually Means

Network segmentation means splitting one network into separate, isolated sections. These are often called VLANs, short for virtual local area networks. Rules then control what’s allowed to cross between them. Devices in one section can be walled off from devices in another. That’s true even when they connect through the same physical equipment.

Here’s a useful way to picture it. Picture an office with one big open room, compared to one with separate rooms and locked doors. A flat network is the open room. Anyone who gets in can walk anywhere. A segmented network has walls instead. Guests get the lobby. Staff get the offices. The server room has its own door, and only certain people can open it. Everyone is still in the same building, on the same internet connection. But what each person can reach is controlled.

This is usually a configuration decision, not a hardware purchase. Most business-grade WiFi equipment already supports multiple isolated networks out of the box. Ubiquiti’s UniFi line, common in small business setups, is one example. It typically just hasn’t been set up that way, because nobody flagged it as something that needed attention.

The Groups Most Small Businesses Should Separate

For a typical small business, segmentation usually comes down to separating a handful of groups:

• Business systems: office computers, shared drives or file servers, and line-of-business software. This is the network that needs the tightest access.
• Guest WiFi: customers, visitors, and anyone who isn’t staff. This network should reach the internet and nothing else on the business’s systems.
• IoT and smart devices: security cameras, smart thermostats, smart locks, and networked printers. These are usually the quietest source of risk. Nobody thinks of a thermostat as “a computer on the network,” but it runs software. It can be compromised, and by default it often sits right next to the file server.
• Point-of-sale systems, where applicable: payment processing carries its own compliance expectations and generally shouldn’t share a network with anything else.

This split shows up constantly at retail storefronts and franchise locations around Denver and Aurora. Picture a business handing out guest WiFi to customers up front. A few feet away, a POS system and back-office computers run on the exact same equipment. Coworking and shared-office setups push this even further. The network there is often shared with other businesses that have no relationship to each other at all.

Why This Matters More Than It Used To

Segmentation has always been good practice. It’s become a more pressing one for a specific reason. Modern ransomware doesn’t stop at the first device it infects. Once it has a foothold, it moves across the network looking for file servers, backups, and anything else worth encrypting. That lateral movement is exactly what segmentation is built to stop. Without a network path between them, a compromised guest device or IoT camera can’t reach the file server at all.

Federal guidance treats this as current, active advice, not a legacy checklist item. A 2025 CISA ransomware defense advisory recommends it directly: “segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.” CISA also released dedicated zero-trust segmentation guidance as recently as July 2025. The numbers back this up too. Verizon’s 2025 Data Breach Investigations Report found extortion malware in 88% of small and medium-sized business breaches. That category covers ransomware and similar attacks. It compares to just 39% at larger organizations. The median ransom demand was $115,000.

Small businesses aren’t a secondary target anymore. In some ways they’re the primary one. They typically have fewer layers of defense standing between an initial compromise and real damage. The pressure to fix this is showing up well above the small business level, too. Cisco’s 2025 Segmentation Report found that 79% of security professionals at larger organizations now rank segmentation a top priority. Only about a third have it fully in place. The same logic applies at a much smaller scale. Separate what doesn’t need to talk to each other, and a single infected device stops being a business-wide problem.

It’s also becoming a checklist item rather than just a technical nicety. Cyber insurance applications increasingly ask directly whether a business’s guest, IoT, and business networks are separated. That question now sits right alongside ones about multi-factor authentication and backups.

What Getting This Set Up Actually Looks Like

For most small businesses already running business-grade access points, this is a configuration project, not a hardware overhaul. It typically starts with defining the separate networks: business, guest, IoT, and point-of-sale if applicable. From there, it’s a matter of setting rules for what each one can and can’t reach. Existing devices then move onto the right network. Network performance problems often get noticed before the security gap does. It’s worth checking both while the network is already being looked at.

None of this replaces device-level protection. Managing the devices themselves and controlling the network they connect to are two different layers. A business needs both. Segmentation limits where a compromised device can go. Device management limits what can happen to the device in the first place.

A basic segmentation setup on existing hardware is usually a matter of days, not weeks. What takes longer is configuring it correctly for the business’s specific mix of devices. The goal is not to quietly break something like a point-of-sale terminal or a networked printer in the process. Doing it once, correctly, is worth more than doing it fast.

Guest WiFi, cameras, and business systems should all be on separate networks, not just separate names. If you’ve never checked whether yours are, that’s worth a short conversation. Better to have it now than after something worse than a customer asking for the password puts it to the test. Reach out here.

Frequently Asked Questions

What is network segmentation and does a small business actually need it?

Network segmentation splits one network into isolated sections, commonly called VLANs, with rules controlling what can communicate between them. Most small businesses run everything on a single flat network without realizing it. That means a compromised guest device or smart camera can potentially reach business systems. Once a business has more than a handful of devices, a guest WiFi network, or any smart or IoT devices, segmentation becomes worth putting in place.

Is a separate guest WiFi name and password the same as network segmentation?

No. A different WiFi network name and password controls who can join the network, not what that network can reach once someone’s connected. Without true segmentation, a guest network and a business network can still see and communicate with each other behind the scenes. They just look separate to the person connecting. Segmentation adds the actual isolation between them.

Does network segmentation stop ransomware?

Segmentation doesn’t prevent an initial infection, but it limits how far that infection can spread. Modern ransomware relies on moving across a network after gaining a foothold, reaching file servers and backups along the way. CISA’s own ransomware defense guidance specifically recommends segmentation to restrict that lateral movement. It’s one layer among several, working alongside endpoint protection and backups rather than replacing either.

Do I need new equipment for network segmentation, or can I use what I have?

Most business-grade WiFi and networking equipment already supports segmentation. It’s more often a configuration change than a hardware purchase. Ubiquiti’s UniFi line, common in small business setups, supports multiple isolated networks out of the box. Older consumer-grade routers are more likely to need a hardware upgrade to support it properly.

How long does setting up network segmentation take for a small business?

On existing business-grade equipment, a basic segmentation setup typically takes a matter of days. That includes separating business systems, guest WiFi, and IoT devices. The larger time investment is making sure it’s configured correctly for the business’s specific device mix, so nothing like a point-of-sale system or networked printer breaks in the process.

What’s the difference between network segmentation and device management (MDM)?

They control different layers. Network segmentation manages what a device can reach once it’s connected: the network path. Mobile device management controls the device itself, enforcing encryption, pushing settings, and wiping it if it’s lost or an employee leaves. A well-protected small business network typically uses both. Segmentation limits where a compromised device can go. Device management limits what can happen to the device in the first place.

Corporate handed you a point-of-sale system, a brand-approved network standard, and maybe a helpdesk number to call. Then the printer at the front counter died on a Saturday, the ticket you opened is somewhere in a two-day queue, and it turns out none of that “IT support” was ever meant to fix the thing actually costing you customers today. If you run a franchise in the Denver or Aurora area, that gap between what corporate covers and what runs your store day to day is where most of your real IT problems live.

This isn’t a knock on corporate. Franchise agreements are built to standardize the brand — not to babysit the Wi-Fi at your specific location. The trouble is that almost no one spells out that line for you, so franchise owners end up assuming corporate has IT handled when, in practice, a large chunk of it lands squarely on them. Here’s where that line actually falls, and who should own each side of it.

What corporate actually covers — and what it doesn’t

Corporate IT support is usually scoped to the systems that carry the brand. That typically means the point-of-sale platform, any brand-mandated software you’re required to run, sometimes a defined network standard your location has to meet, and occasionally a national helpdesk for issues with those specific systems. Those are the big-ticket items, and corporate has good reason to keep tight control over them — consistency across every location is the whole point of a franchise.

What that coverage almost never includes is everything local. The Wi-Fi and network reliability inside your four walls. The back-office computer, the front-counter printer, the tablet the manager uses for scheduling. Day-to-day device issues. Getting a new hire logged in and working. And critically, response time for anything that falls outside corporate’s defined systems. If the problem isn’t the brand’s software, it’s usually not the brand’s problem — it’s yours.

That’s the distinction to hold onto: franchise agreements standardize the brand-facing systems, not the local operational ones. Corporate owns the POS. You own the network it runs on, the hardware around it, and the people using it.

Where franchise owners feel the gap first

The gap rarely announces itself. It shows up as a series of ordinary-looking problems that no one seems responsible for.

A corporate helpdesk ticket that takes days to move — for something happening right now. Corporate’s queue is built for the whole system, not your Tuesday lunch rush, so a “we’ll get to it” response is common even when a dead terminal is backing up your line.

A new hire who can’t work on day one. There’s no local onboarding process, so the account isn’t set up, the login doesn’t exist, and someone spends the morning improvising instead of training. In a location with steady turnover, that friction repeats constantly. (Fast, repeatable onboarding and offboarding is one of the clearest places local IT earns its keep.)

An internet or Wi-Fi issue corporate has no visibility into. Your POS might phone home to a system corporate manages, but the connection itself — the router, the local ISP, the access points — is invisible to them. When it drops, they can confirm their system is fine and leave you exactly where you started.

Hardware that fails with no clear owner. Printers, terminals, back-office PCs — when one dies, corporate won’t touch it, and you’re left calling around for someone who can. The question “whose job is this?” has no answer, so it becomes yours by default.

The multi-location problem

If you run more than one location, every one of those gaps multiplies — and gets messier.

Each store solves its local IT problems its own way. One manager found a guy who set up the network; another bought a router at a big-box store and hoped for the best; a third is running on whatever the previous owner left behind. Now you have inconsistent setups across locations, no single record of what’s configured where, and no one who actually knows how each store’s local IT is put together.

That last part is the quiet killer. When a location has a problem, you’re troubleshooting blind because there’s no documentation of what’s installed, how it’s connected, or why it was set up that way. Multiply that across three or five stores and “our IT” stops being a system and becomes a pile of one-off decisions no one can see all of. Staff turnover makes it worse — when the manager who “knew the setup” leaves, that knowledge walks out with them. This is a franchise-specific bind that generic small-business IT advice never touches, because it assumes one location and one owner keeping it all in their head.

What “local IT support” actually means for a franchise

To be clear, none of this is about replacing or fighting corporate’s systems. A good local IT partner works alongside the brand-mandated software and network standards — it doesn’t override them. Think of it as covering the half of the picture corporate was never going to.

In practice, that scope looks like a few concrete things. Device management: keeping the terminals, printers, and back-office machines patched, working, and quick to replace when they fail. Local network reliability: making sure the Wi-Fi and internet inside your location actually hold up during business hours, not just when someone runs a speed test. Onboarding and offboarding that matches your turnover, so a new hire is working on day one and a departed employee’s access is closed the same day. And documentation — so you, the owner, know what’s set up and why, instead of that knowledge living only in one manager’s memory or one vendor’s head.

If you’ve never had a clear picture of what your local IT even consists of, that’s the gap this fills. It’s the difference between a managed setup and a stack of loose ends — and it’s most of what a managed service provider actually does day to day.

What to look for in local IT support as a franchise owner

You don’t need a feature checklist. You need a partner who fits how a franchise actually runs. A few principles worth holding out for:

They understand they’re not replacing corporate. The right provider asks what corporate mandates and builds around it, rather than trying to rip-and-replace systems you’re contractually required to keep. If a candidate doesn’t get that distinction early, they’ll create friction with your franchisor, not remove it.

Engel Tech is not only familiar with working alongside Franchises/Franchisees, we actually have a partner program built specifically for it.

Pricing that works across one location or several. Flat, transparent billing matters more for franchise owners than almost anyone, because you need to compare costs across stores and predict them as you grow. Per-incident billing punishes you exactly when a location is already struggling. (If you’re trying to gauge what’s reasonable, here’s an honest breakdown of what IT support costs for a small business in Colorado.)

Response time that matches your pace. A two-day queue is fine for a corporate system change. It is not fine for a dead printer during a rush. Local support should mean local urgency — someone who treats a down terminal like the revenue problem it is.

That’s the whole case for a local partner: corporate keeps the brand consistent, and someone on the ground keeps your location running. In the Denver and Aurora metro — where retail, food-service, fitness, and service franchises are dense — that someone should understand both the franchise model and the local ground you’re standing on.

Where this leaves you

If you’ve read this far and recognized a few of these gaps in your own stores, that’s the useful takeaway: the problems weren’t yours to imagine, and they weren’t corporate’s to solve. They just never had a clear owner. A short conversation is an easy way to figure out where your local IT actually stands and what’s currently falling through the cracks. Reach out to Engel Tech — we’re a Colorado MSP that works alongside corporate systems, not against them, and there’s no pitch attached to a first conversation.

Frequently Asked Questions

Does my franchise need its own IT support if corporate already provides some?

Usually, yes — because corporate’s support and a franchise’s day-to-day IT needs cover different things. Corporate typically handles brand systems like your POS and mandated software, while your local network, hardware, and staff logins are left to you. Local IT fills that gap without touching what corporate manages.

Will local IT support conflict with my franchise’s corporate requirements?

It shouldn’t, if you choose the right provider. A good local IT partner works alongside corporate’s mandated software and network standards rather than replacing them. The goal is to cover the local operational side corporate doesn’t, not to override the brand systems you’re required to run.

How does IT support work if I own multiple franchise locations?

Multi-location ownership is where local IT support pays off most, because the same gaps repeat at every store. A single provider can standardize setups across locations, keep one source of documentation for what’s configured where, and give you consistent onboarding and response times instead of one-off fixes at each site.

Why does the corporate helpdesk take so long to fix my store’s problems?

Corporate helpdesks are built to support the brand’s systems across every location, not to prioritize a single store’s urgent issue. Anything outside their defined systems — local Wi-Fi, hardware, device problems — often sits in a queue for days. A local provider treats a down terminal as the immediate revenue problem it is.

What does IT support for a franchise in Colorado typically cost?

Costs vary with your number of locations, devices, and users, but franchise owners are best served by flat, transparent monthly pricing rather than per-incident billing. Flat pricing makes costs predictable and comparable across stores as you grow. You can see a fuller breakdown on our guide to what IT support costs for a small business in Colorado.

Who is responsible for fixing a broken printer or terminal in my franchise?

In most franchise agreements, local hardware like printers, terminals, and back-office PCs is the owner’s responsibility, not corporate’s. Corporate generally only supports the systems it mandates. That’s exactly the kind of day-to-day fix a local IT provider is meant to own so it doesn’t fall on you.

You’ve probably seen the letters “DNS” in a domain renewal email, or heard an IT person say “it’s a DNS issue” while your website was down. It sounds technical, and it is — but the idea behind it is simple, and it quietly controls something every business depends on: whether people can actually reach your website and email.

This guide explains what DNS is in plain English, where you’ll actually bump into it, and why it’s important to have the Network Management in place to ensure it’s being monitored.

What DNS actually is

DNS stands for Domain Name System, and the easiest way to understand it is as the internet’s phonebook. When someone types your domain name — say yourbusiness.com — into their browser, their computer doesn’t actually know where that is. Behind the scenes, DNS looks up your domain and translates it into a numeric address (an IP address) that computers use to find the right server. ICANN, the nonprofit that helps coordinate the internet’s naming system, calls DNS “the address book of the Internet.”

That’s the whole idea. People remember names; computers use numbers; DNS is the directory that connects the two. Every time a customer visits your site or sends you an email, a DNS lookup happens in the background — usually in a fraction of a second, and usually without anyone noticing.

Stick with that one picture — DNS as a phonebook that turns your domain name into the address computers actually dial — and everything else in this article follows from it.

Where business owners actually run into DNS

You don’t have to understand DNS to run a business, but you’ll cross paths with it more often than you’d think — usually at moments when something is being set up or is about to break.

The most common one is the domain renewal email. The company you bought your domain from (your “registrar” — often GoDaddy, Namecheap, or whoever built your site) is typically where your DNS settings live too. When that renewal notice lands, it’s a reminder that this account controls your domain’s phonebook entry.

You’ll also meet DNS when you launch or move a website. Pointing a domain at a new site means changing DNS records so the phonebook sends visitors to the right place. And you’ll meet it when you set up business email on Microsoft 365 or Google Workspace — connecting email requires adding specific DNS records so mail is routed correctly and so other servers trust that messages really came from you. That’s often when an IT provider starts talking about “DNS records” and “propagation” (the short waiting period while a change spreads across the internet).

If you use Microsoft 365, it’s worth understanding who should actually manage your Microsoft 365 setup, because whoever does usually ends up touching your DNS too.

What breaks when DNS goes wrong

Here’s why any of this matters: when DNS is misconfigured or points to the wrong place, the symptoms usually don’t look like a “DNS problem.” They look like your business disappearing.

The classic example is a website that appears to be down when the server is actually running fine — the phonebook is just handing out the wrong address, or no address at all. Customers see an error page; you see a working site from your own bookmarked cache and can’t figure out why they’re complaining.

Email is the quieter, more damaging failure. If your mail-related DNS records are wrong, emails can silently fail to deliver — landing in spam or getting rejected outright — with no bounce message to warn you. A common version of this: a new employee’s email seems to “take a day” to start working after setup, because DNS changes need time to propagate. When the stakes are invoices, quotes, and customer replies, silent email failure is expensive in a way that’s hard to measure until you lose a deal to it.

The thread running through all of these is that DNS is invisible until it isn’t. Most owners have no way of knowing something is wrong until customers tell them the site or email is broken.

DNS and security

DNS isn’t just an operations concern — it’s also a target. Because DNS controls where your domain points, an attacker who can tamper with it can quietly redirect your visitors to a fake site or intercept your email, all while your real domain name still appears in the address bar. ICANN notes that the DNS was designed decades ago without built-in verification, which is exactly why protections like DNSSEC were later added to help confirm that DNS answers are genuine.

DNS records are also part of how you stop criminals from impersonating your domain. Three record types — SPF, DKIM, and DMARC — work together to tell the world’s mail servers which systems are actually allowed to send email as your business. Without them, a scammer can spoof your address to phish your customers and staff. This isn’t optional anymore: as of February 2024, Google and Yahoo require these authentication records for anyone sending significant volumes of email, or messages get delayed and rejected.

It matters because email impersonation is the front door for the most common attacks. Phishing and spoofing were the most-reported cybercrime in the FBI’s 2024 Internet Crime Report, which tallied a record $16.6 billion in reported losses. Correct DNS records are one of the plainest, cheapest defenses you have. If you want to go deeper on that side, our guide to phishing and small business email security picks up where this leaves off.

Who should actually manage your DNS

The practical takeaway is less about the technology and more about ownership. DNS is powerful, largely invisible, and easy to lose track of — which makes it one of the most common things that quietly falls through the cracks.

The pattern we see with Colorado small businesses is a familiar one: nobody in the company knows where the DNS actually lives. It’s buried in a registrar account set up years ago, or locked inside a former IT person’s personal login, or tangled into a bundled hosting-and-email package no one fully controls. That last case is common enough that we wrote about why bundled GoDaddy-and-365 setups hold businesses back — the convenience often comes at the cost of clear ownership.

Three principles keep DNS from becoming a liability. First, the business itself should own the account where DNS lives — not an individual, not a vendor you can’t reach. Second, access should be documented, so the login and settings don’t vanish when a person leaves or a relationship ends. Third, changes should be made deliberately by someone who understands the downstream effects on your website and email.

This is exactly the kind of thing that a documented IT setup is meant to catch — the small, invisible dependency that costs you nothing until the day no one can find the keys to it.

The bottom line

DNS is the phonebook that decides whether your website loads and your email arrives. You don’t need to become an expert in it. You do need to know that it exists, that it can break in ways that look like something else, and that your business — not a forgotten account somewhere — should be the one holding the keys.

If you’re not sure who controls your DNS, or whether your email records are set up correctly, that’s a quick thing to check and an easy problem to fix before it becomes an expensive one. A short conversation with Engel Tech is a simple way to find out where you stand.

Frequently Asked Questions

What is DNS in simple terms?

DNS (Domain Name System) is the internet’s phonebook. It translates a domain name people can remember, like yourbusiness.com, into the numeric IP address that computers use to find the right server. Every website visit and email send triggers a DNS lookup in the background.

Why is my website down when it’s a DNS issue?

If your DNS records point to the wrong place or are misconfigured, visitors’ browsers can’t find your server — so the site looks “down” even though it’s actually running fine. Because your own device may have the old address cached, the site can still load for you while customers see an error, which makes DNS problems tricky to spot.

Does DNS affect my business email?

Yes. Business email relies on DNS records to route messages and to prove your mail is legitimate. If those records are wrong, emails can silently land in spam or be rejected with no warning. Records called SPF, DKIM, and DMARC also stop scammers from spoofing your domain.

Who controls my company’s DNS?

Usually whoever manages your domain registration — the company you bought your domain from, such as GoDaddy or Namecheap — since DNS settings typically live in that same account. The risk is that many businesses don’t actually know where that account is or who has access, which is why documenting it matters.

Is DNS a security risk?

DNS can be targeted. Attackers who tamper with it can redirect your traffic or intercept email while your real domain still shows in the address bar. Properly configured DNS records — including email authentication and, where supported, DNSSEC — are a basic and inexpensive layer of protection for your domain.

What happens when you change DNS records?

Changes don’t take effect instantly. They “propagate” across the internet’s DNS servers, which can take anywhere from a few minutes to a day. This is why a new employee’s email or a website move can seem to work intermittently at first before settling into place everywhere.

You already know your IT support isn’t working. Tickets sit for hours, the bill changes every month, and the same problems keep coming back because nobody ever fixed the cause. So why are you still there? For most business owners, the answer is one fear: that leaving will mean downtime, lost data, or a handoff so painful it isn’t worth it.

That fear keeps people in bad contracts for years. It shouldn’t, because it’s mostly unfounded. A clean switch is a managed process, not a leap — and this guide walks through exactly what that process looks like so you can make the call with your eyes open.

The real cost of staying put

Staying with a provider who can’t keep up isn’t a neutral choice. Every slow response and every recurring outage is a cost — to your team’s time, your customers’ patience, and your own ability to run the business instead of babysitting it.

The numbers back this up. Information Technology Intelligence Consulting’s 2024 Hourly Cost of Downtime survey found that even a very small business — under 25 employees on a single server — loses on the order of $100,000 per hour when systems go down, a figure ITIC calls conservative. You don’t need to lose a full hour for it to hurt. A few unproductive afternoons a quarter, traced back to a provider who treats symptoms instead of root causes, adds up fast.

Here’s the part most owners miss: the thing that makes switching feel risky — undocumented systems, a provider who controls all the access — is the same thing quietly costing you right now. A good handoff fixes that problem permanently. Staying put just lets it compound.

Signs it’s actually time to switch

One bad week isn’t a reason to fire your IT provider. A pattern is. These are the signals that the relationship is structurally broken, not just having an off day:

• Support is unresponsive. You wait hours — or days — for a reply, and there’s no committed response time you can point to.
• Billing is a surprise. The invoice swings month to month and you can’t predict it. “Unlimited” plans somehow still generate extra charges.
• Service is reactive only. Nobody touches your systems until something breaks. The same issue breaks twice because the underlying cause never gets addressed.
• There’s no documentation. Ask how your network is configured or where your backups live, and nobody can answer cleanly. The knowledge lives in one person’s head.
• You feel locked in. Leaving feels deliberately difficult — vague contract terms, access you don’t fully control, a sense that the provider is the only one who knows how anything works.

That last one matters most. A provider who makes leaving hard is telling you something about how they keep clients. If you’re comparing what you have now against what good support should look like, our overview of what an MSP actually does is a useful baseline.

What a clean transition actually looks like

Here’s the reassuring truth: when a switch is done right, you barely feel it. The new provider does the work in the background, and your team keeps working. The process breaks down into three plain-English stages.

First, the new provider audits and documents your environment. Before changing anything, a competent MSP maps what you have — devices, accounts, network setup, software, where your data lives. This step is the whole game. The reason handoffs go badly is almost always missing documentation, so a provider who starts by building it is removing the risk, not creating it.

Second, they take over access in an orderly handoff. Administrative accounts, your domain, email administration, monitoring tools — these get transferred deliberately, with both sides confirming each step. Nothing gets ripped out from under you. This is the same disciplined process a good provider uses when onboarding and offboarding employees: a checklist, not a scramble.

Third, they run the cutover quietly. Monitoring, patching, and support shift to the new provider on a planned date. Done well, the only thing you notice is that tickets start getting answered. There’s no “down for the weekend while we migrate” — a real transition is staged so the business keeps running throughout.

What you should own — and what a bad provider holds hostage

This is the heart of it. A switch is only painful when your current provider controls things you should own. If those things are in your name and properly documented, changing providers is straightforward. If they’re not, you’ve just discovered your real problem — and it isn’t switching.

You should own, or have full administrative access to:

• Your domain name. The registration for your web address should be in your business’s name, not your provider’s.
• Your Microsoft 365 or Google Workspace tenant. Admin rights to your own email and files are non-negotiable. A provider can manage them, but they shouldn’t be the only one who can.
• Your documentation. Network diagrams, passwords (in a system you can access), software licenses, and account inventories belong to you.
• Your backups. You should know where your data is backed up, how to reach it, and that it leaves with you if you go.

If your current provider can hand all of this over cleanly, switching is easy. If they stall, charge a steep “offboarding fee,” or simply can’t produce the documentation, that resistance is the clearest possible sign you made the right call to leave. A provider who believes you own your own systems has no reason to make the door hard to walk through.

How to choose the replacement

Don’t replace one opaque relationship with another. Judge candidates on principles, not on the length of their feature list:

• A defined response-time commitment. Ask what their SLA is and get it in writing. “We’ll get to it” is not an answer.
• Transparent, predictable billing. You should know what you’ll pay before the work happens. A retainer-based model with a defined scope beats a vague “unlimited” plan that still surprises you. If you’re re-evaluating what you currently pay, our guide to IT support costs for Colorado small businesses gives you a benchmark.
• No long-term lock-in. A provider confident in their service doesn’t need to trap you in a multi-year contract. Look for terms that let you leave if it isn’t working.
• Local presence. When a problem needs hands on hardware, a provider who can be on-site in the Denver and Aurora metro is worth far more than a help desk three time zones away.

The Colorado layer: data handling during the switch

A handoff moves access to sensitive systems and data, so it has to be done carefully — and in Colorado, “careful” has a legal floor. State law (C.R.S. § 6-1-716) requires businesses to notify affected residents of a data breach within 30 days of determining one occurred — one of the tightest windows in the country. A sloppy transition that exposes customer data isn’t just embarrassing; it triggers a clock.

This is another reason documentation matters so much. A provider who knows exactly where your regulated data lives and who has access to it can run a transition without creating exposure. One who’s guessing cannot. For the broader picture, see our guide to IT compliance requirements for Colorado businesses. The breach numbers underline the stakes: IBM’s 2024 Cost of a Data Breach report put the global average at a record $4.88 million, and smaller businesses are the least able to absorb it.

The bottom line

Switching IT providers is not the risk. Staying with one who holds your access hostage and can’t tell you how your own systems work — that’s the risk. A clean switch is a defined, managed process, and the resistance you meet on the way out is just the original problem showing itself.

If you’re not sure whether your current setup would hand over cleanly, that’s worth knowing before anything goes wrong. A short conversation is an easy way to find out where you stand — get in touch with Engel Tech and we’ll walk you through it, no pressure.

Frequently asked questions

Will switching IT providers cause downtime?

It shouldn’t. A competent provider stages the transition so your team keeps working throughout — documenting your environment first, transferring access in planned steps, and scheduling the cutover deliberately. If a prospective provider can’t explain how they’ll avoid downtime, that’s a reason to keep looking.

How long does it take to switch managed IT providers?

For a small business, a typical transition runs a few weeks from first audit to full handoff, depending on how well-documented your current setup is. The discovery and documentation phase takes the most time; the actual cutover is usually quick. Poor documentation from your old provider is the main thing that slows it down.

What if my current IT provider won’t hand over access?

Your domain, Microsoft 365 or Google Workspace administration, documentation, and backups belong to your business — and a provider stalling on these is a serious red flag. A good incoming provider can guide you through reclaiming ownership of accounts registered in your name. Resistance to a clean handoff is exactly the problem you’re leaving to escape.

What should I own versus what my IT provider manages?

You should own (or hold full admin access to) your domain registration, email and file platform, system documentation, and backups. Your provider can and should manage these day to day, but they should never be the only party who can access them. Ownership stays with the business; management is the service.

How do I choose a new IT provider after a bad experience?

Judge candidates on principles, not feature lists: a written response-time commitment, transparent and predictable billing, no long-term lock-in, and a local presence that can show up on-site when needed. A provider confident in their service won’t need to trap you in a contract to keep you.

Are there extra data rules for switching IT providers in Colorado?

Colorado requires businesses to notify affected residents of a data breach within 30 days of determining one happened, which is stricter than most states. That makes careful, well-documented data handling essential during any transition. Choose a provider who can show exactly where your regulated data lives and who has access to it.