Managed IT Services and IT Support for Small Businesses in the GTA: What to Expect

Small businesses are not exempt from attack, but the official numbers are easy to misread. Statistics Canada found that 16% of Canadian businesses were impacted by a cyber security incident in 2023, and that survey only covers firms with 10 or more employees. Scams and fraud were the most common method, affecting half of impacted businesses.

For a small office the risk is less about sophisticated attacks and more about missing basics: one shared admin password, no MFA on the bookkeeper's account, backups nobody has tested. The lists below are built around those basics.

Any provider taking you on should do most of this in the first week or two and give you the results in writing.

• Inventory of every device, user account, licence, domain and software subscription, with renewal dates.
• Admin review: who holds Global Administrator in Microsoft 365 (or Super Admin in Google Workspace), registrar and firewall access. Remove anyone who should not be there.
• MFA check on every account, including the owner's and shared mailboxes' sign-in paths.
• Backup check: what is backed up, where, and one test restore. Microsoft 365 on its own keeps deleted mail for only a short window, so cloud mail usually needs its own backup.
• Email authentication check: SPF, DKIM and DMARC status for your domain. Our email spoof check shows yours in seconds.
• A written documentation pack you own: network details, passwords held in a business-owned vault, vendor contacts.

Most small offices run Microsoft 365 close to its defaults. These are the changes we expect a provider to make or explain why not. Details and licence requirements are in our Microsoft 365 security guide.

'Monitoring' is meaningless until you know what triggers a call. For a small office, ask for alerts on at least these, and ask who receives them.

See how our managed IT plans are structured and our managed IT support practice, or go straight to IT support across the GTA.

• Backup job failed or did not run.
• A device has not received updates in 30 or more days, or antivirus is off.
• Disk nearly full or a disk reporting errors on a server or NAS.
• Sign-in from an unusual country, or impossible travel, on any account.
• New inbox rule forwarding mail outside the company.
• New admin role granted or MFA method changed.
• Internet connection or firewall down at the office.

• Patch status by device, with anything overdue named.
• Backup results and the date of the last restore test.
• Tickets opened and closed, and anything recurring.
• Security alerts and what was done about each.
• Upcoming renewals and end-of-support dates (for example the Windows 10 end of support).

Is there a minimum term, and what does it cost to leave? Who owns the documentation you are paying them to write? Are new-starter and leaver requests included? What is billed hourly? Who do we call if something looks like a breach outside business hours? For the full buying process, see the IT support buyer's guide.

IT Rapid Support has supported businesses from Vaughan since 2018, with offices in Vaughan and Vancouver. Support and the incident line are both 24/7 at (289) 582-9930. Two examples of small-office work are our email authentication fix for a Vaughan smart-home integrator and our DMARC enforcement and Wi-Fi project for a Mississauga developer.