When you approve a cybersecurity expense, you expect it to help protect your business. You shouldn’t have to become a software expert to understand what you’re getting.

Still, a list of security subscriptions only tells part of the story. Antivirus, email filtering and backups each have a role, but they need to be set up correctly, maintained and checked as your business changes.

Before approving another subscription, ask your IT provider what gap it will close. The answer should explain what needs protecting and how the new service will help.

Here’s what else is worth checking.

Make sure everyday changes don’t leave gaps

A new employee gets a laptop, an email account and access to company files. They can sign in and start working.

That’s the part everyone sees. Behind the scenes, the laptop also needs security protection, monitoring and updates. The employee needs access appropriate to their role and secure sign-in settings.

A working laptop doesn’t confirm that all those steps are complete.

The same attention is needed when someone leaves. Their access needs to be removed across the systems they used, including any separate cloud applications.

For businesses using Microsoft 365, managing accounts, permissions and security settings should be part of everyday IT support.

Ask how your provider checks that new employees and devices are covered, and how they confirm access has been removed when someone leaves.

Know who follows up when something looks wrong

An alert about an unusual login needs a decision. Is an employee travelling, or is someone trying to access their account?

Security software can flag the activity. Someone still needs to investigate and take action when necessary.

That responsibility needs to be clear, including outside regular business hours. You don’t want to discover during an incident that your team and your IT provider each thought the other was handling it.

Before working with Foundation BTS, one York Region non-profit had experienced a compromised email account with no investigation or follow-up. Critical systems also lacked monitoring.

FBTS helped address those gaps through stronger account protection, monitoring, staff training and incident reporting processes. The work gave the organization a more consistent way to identify and respond to problems.

Read how the non-profit strengthened its cybersecurity.

For your business, ask who reviews warnings, who can take urgent action and when your team will be contacted.

Check whether backups can get people working again

If your team lost access to its files tomorrow, how would work continue?

A successful backup notification doesn’t answer that question on its own. You need to know what information is included, how recent the backup is and what it would take to restore access.

An Aurora construction company faced that test when a fire made its server room unusable on payroll day.

With verified backups and a tested recovery plan already in place, Foundation BTS restored the company’s servers in the cloud and gave the CFO secure remote access within 45 minutes. Payroll ran on time.

The disruption was caused by a fire, but the recovery lesson also applies to a cyberattack or equipment failure. Having a backup is one part of the job. Being able to use it when your business needs it is another.

See how the construction company recovered after the fire.

Ask when recovery was last tested and what that test covered. If your team has moved important files or added new systems since then, confirm they are included.

Understand what each subscription contributes

Over time, your business can end up paying for services that overlap. An older subscription keeps renewing, or a feature gets purchased separately even though it’s included in another service.

That’s a reason to review costs, but it isn’t a reason to start cancelling products.

Some overlap serves a purpose. Email filtering can help block a dangerous message, while security software on a laptop provides protection if a threat reaches the device.

Your IT provider should be able to explain why each service is needed, how it works alongside the others and who manages it. That explanation helps you spot unnecessary spending without removing useful protection.

Bring these five questions to your next IT meeting

You don’t need every technical detail. You do need clear answers about how your business is protected.

1. Are all company devices and accounts covered by our security setup?
2. Who investigates alerts, including outside regular hours?
3. What information is backed up, and when was recovery last tested?
4. How do you confirm that former employees can no longer access our systems?
5. What security gap needs attention first, and who will address it?

If something needs fixing, ask for a named person responsible and a target date. That gives you a way to follow up.

Before buying more, understand what needs attention

Another security tool may be the right investment. It may also be more useful to correct a setting, cover a missed device or improve how warnings are handled.

A recommendation should connect the expense to a specific need in your business. You should understand what will improve, who will manage it and how it will be checked over time.

If you’re unsure where your current protection stands, Foundation BTS can help you discuss your concerns and priorities. Book an IT & Cyber Security Review for your business in York Region, Toronto or the GTA.