7 Practical Steps Before Jan 1st
Many small and mid-sized businesses head into January carrying last year’s technology risks. This practical health check helps you close open security gaps, validate backups, and confirm that your team, tools, and vendors are aligned. You’ll finish with a clear action list and a simple way to measure progress with TSG’s help.
1) Confirm what you’re protecting
Your team cannot secure what it cannot see. Start by listing the devices, cloud apps, user accounts, and third-party connections that handle company data. Note owners, locations, and the sensitivity of information in each system. Look for any “shadow IT,” such as unapproved file sharing tools or personal email used for work—your cloud data and integration review can help uncover this. Remove or migrate anything that does not belong in your environment with help from installation & support. Capture license counts and support end dates so you can plan renewals with intention rather than urgency. The goal is a living inventory that becomes your foundation for decisions in the year ahead. When leaders see the full picture, conversations about budget and risk become easier and more grounded. This step alone often uncovers quick wins like removing unused accounts and tightening vendor access. 2) Tighten account access and sign-in safeguards
Once the inventory is clear, review who has access to what. Remove former employees from every system, not just email—this fits neatly into managed IT workflows. Reduce broad administrator rights and grant access based on job role, supported by network configuration & security. Turn on strong sign-in protection for all users with advanced cyber-security (MFA/EDR), ideally with a simple mobile prompt rather than codes that frustrate staff. Consider conditional access rules that block risky sign-ins from unknown locations. Set automatic timeouts on idle sessions, and require unique, long passphrases stored in a trusted password manager. Document exceptions so leaders understand where risk remains and why. The aim is to shrink the blast radius of a mistake and make it easy for people to do the right thing. Companies that standardize these basics see fewer support tickets and faster recovery when something goes wrong. 3) Test backups and recovery steps end to end
Backups that have not been tested are a hope, not a plan. Pick one critical system and perform a full restore into a safe test area using off-site data backup, and lean on on-site data recovery if needed. Measure how long it takes, verify data quality, and record the exact steps. Repeat for cloud services by exporting or restoring a small sample to confirm retention and version history. Ensure backups are protected from tampering, stored separately from production, and monitored for success—your server performance & security controls should reflect this. Document who declares a disaster, who does the work, and how you communicate status to the business. Clear runbooks reduce stress and shorten downtime during a real incident. Leaders appreciate seeing real numbers for recovery time and data loss. It turns a vague promise into a capability you can count on. 4) Close the loop on updates, monitoring, and response
Security tools only help when they are consistent. Verify that updates are delivered to every device through managed services and that alerts reach the right people with context. Review your endpoint protection, email filtering, and web safeguards with advanced malware & cyber-security to confirm they still match current threats and business needs. Tune noisy alerts that no one reads. Establish a simple monthly scorecard: patch coverage, backup success, failed sign-ins, and phishing test results. Share it with leadership so progress is visible and decisions are timely. Finally, run a short tabletop exercise where a manager, IT lead, and finance owner walk through a realistic incident—start by contacting TSG to schedule one. This builds muscle memory and exposes gaps that documents alone will not reveal. Small improvements here pay off quickly in fewer interruptions and faster resolution.
5) Strengthen people: phishing drills and simple reporting
Human speed matters. Run short, quarterly phishing simulations and awareness training and share results with grace, not shame. Add a single-click “Report Phish” button in mail so employees don’t overthink what to do. Track who reports first, repeat offenders, and the themes that fooled people. Use those insights to tune email filtering and write two or three real-world tips each month—screenshots, short captions, and what “good” looks like. Include vendors and contractors who use your email domain so the whole chain improves. Keep training snackable: five-minute micro-lessons beat long webinars no one finishes. When people know what to do and can do it fast, the whole system gets safer.
6) Review vendors and SaaS access
Start by making a single list of every outside tool that touches your business data—accounting, HR, marketing, chat, payments, backups, and anything else your team has signed up for. For integration and cleanup work, see cloud data solutions & integration. For each tool, note what information it holds and who can see it, both at the vendor and inside your company. Make sign-ins safer for managers and admins by adding a quick phone prompt after the password via TSG’s cyber-security services. When people change roles or leave, remove their access right away within your managed IT process, and clear out any old connections you no longer use. Change the “special passwords” that connect systems on a regular schedule. Ask vendors where they store your data and how long they keep it, and file their latest security report or a short questionnaire so you know how they operate. If the tool lets you, limit logins to your company and your office or VPN. Sort vendors into three buckets—critical, important, and basic—and review the critical ones twice a year. Fewer tools with stronger controls means less risk and less support work. 7) Refresh policies, logs, and insurance readiness
Policies only help if they match reality. Update acceptable use, remote work, password manager, and incident response docs so they mirror the tools you actually run—fold this into server performance & security and managed services. Confirm device encryption, screen lock, and auto-patch are enforced in policy and in tooling. Centralize logs from email, endpoints, identity, and firewalls long enough to investigate incidents; verify you can pull a 90-day story quickly. Check cyber-insurance requirements (MFA everywhere, EDR, backups, privileged access) and close any gaps now—renewals move faster when evidence is ready. Store contact trees, legal/regulatory steps, and customer notification templates where leaders can reach them under stress. Clear, current paperwork turns chaos into a checklist. If you’d like help refreshing policies or running a readiness review, contact us. Security is business-critical—one missed update or loose login can lead to downtime, fines, or lost customer trust. If a light year-end checkup would help, we’ll take a fresh look at what you’re using today, highlight the few items that matter most, and turn them into a simple plan your team can actually follow. If there are gaps, we’ll help you close them quickly so January doesn’t start with surprises. You’ll know what’s done, what’s next, and who owns it. To make that easy, schedule a 30-minute consult with TSG and step into the new year confident and prepared.
TSG Computer Services is a Vancouver-based IT Support company who specializes in Security and Solutions for Increased Productivity. Contact us now to see how we can help you.