Information Technology (IT) falls into the triad of often underinvested disciplines in small businesses. Finance and HR are the other two areas. The risks for underinvesting in IT manifest themselves in various costly, inconvenient ways, not to mention the emotional rollercoaster ride you will experience. Let’s explore two common issues with underinvestment.
One risk that is an ever-present threat and receiving considerable notoriety (deservedly so) is cybersecurity risk. The possibility of being hacked is much more likely for a large, prominent entity than a small, less conspicuous business. Yet, a smaller company is not immune from hacking.
I once worked for a company whose email system was penetrated by a foreign entity. We were not aware of the cyber breach until a federal agency visited our office to inform us about the infiltration. Although we were not a large business, our company was well-known in Washington, DC. Additionally, we fit the profile of underinvestment in IT infrastructure. Our company grew rapidly over several years with minimal IT investment. We did not have a robust firewall, intrusion prevention system (IPS), modern servers, software, or an updated Microsoft exchange system to help forestall infiltrations.
After the meeting with the federal agency, we resisted the urge to panic. Having some nation-state trolling around in your email system left us on edge. We quickly overhauled the IT infrastructure, including new servers, switches, firewalls, IPS, virus/spam/malware protection, while hiring more knowledgeable consultants to provide us with sophisticated IT strategies. The investment was significant and akin to spending five or more years of budget in one year. We started to feel better about our security. Still, before implementing the IPS, I received a call from the same federal agency notifying me that the foreign intruders were still camped out in our email system.
We were flabbergasted. How are they still in our system, and what will they do with the intelligence gathered? The potential for reputational damage to the business was palpable, coupled with the accompanying potential for financial damage placed us in a precarious position. Fortunately, after the IPS was in place and we scrubbed our email system again of unverified users, the cyber hackers were ejected from the system. We did not experience any direct fallout that we were aware of, but that does not mean we were immune from business development losses, client attrition, or other issues we could not explain. The hazards associated with underinvestment in IT infrastructure can be debilitating at best and catastrophic at worst if your business experiences an extended systems failure.
Beyond cyber risks that may also include ransomware, there is the most significant IT risk of all: your critical system(s) going down. Unique to each business, critical systems include email, financial systems, collaboration software, e-commerce platforms, etc. Redundancy and automatic failover are two key IT terms/strategies to keep your critical systems running in the event of a systems outage. Think of your IT system as your company’s engineering plant. An engineering plant on a Navy ship or a power plant has automatic failovers and redundant equipment to prevent a complete power outage. Automatic failovers of the company’s servers, internet connections, and other critical IT systems are necessary for maintaining 24/7 business operations and communications.
The good news is there are many options available to outsource your IT management to competent firms capable of minimizing downtime and maximizing security and system reliability at an affordable cost. Always ask for referrals from your network when seeking skilled IT services providers and interview/benchmark several providers before pulling the trigger. Engage a business that can handle more complex IT strategies as your business grows. I have included a link below to a comprehensive article that discusses choosing the best IT support for your needs.
https://www.businesspundit.com/best-it-support-companies-small-business/
To secure your remote users, an immediate step is to ensure all remote access is controlled by a secure, encrypted connection called a Virtual Private Network (VPN). The security of remote access is crucial now because of the proliferation of virtual workers over the last two years.
In summary, investing in IT infrastructure as your company grows helps prevent catastrophic failures such as critical systems outages and cybersecurity breaches. Moreover, investing consistently in IT can help avoid the fallout of reputational damage and financial losses to your business. Then you can sleep well at night knowing your company’s intellectual capital and “secret sauce” are secure.
