What a small office actually needs from IT support: the short list for ten to fifty people

Between ten and fifty people, an office usually runs on Microsoft 365 or Google Workspace, a firewall or router that came from the internet provider, one switch, Wi-Fi from a box somebody bought, a copier that scans to email, laptops bought one at a time as people joined, and one application the business cannot work without: the accounting package, the practice management system, the estimating tool. Sometimes there is a server or a network drive in a cupboard, and nobody is sure what is on it.

Nobody owns any of it. The office manager resets passwords because they are the one who is always in. The owner renews the domain name when the warning email happens to be seen. The person who set up the Wi-Fi left two years ago. None of that is a failing; at this size a full-time IT person is a salary the business does not have a full-time job for. What the office needs is for the list below to be done, and then for somebody to answer when it breaks.

Under about ten people, with everything in Microsoft 365 and no server, the honest shape is a couple of projects and a number that answers, not a monthly arrangement. Above fifty, the office starts to look like the co-managed estates on our Enterprise IT services page, with an IT generalist of its own and a provider taking the layers underneath. The list is the same either way; what changes is how much of it already exists.

1. One account per person, with multi-factor sign-in switched on for everyone, and a list of who has what
2. A backup of the mailboxes, the shared files and the one important application, restored from at least once by somebody who wrote down how long it took
3. A firewall that belongs to the business rather than to the internet provider, with guest Wi-Fi kept apart from the office and remote access that does not depend on a port left open
4. Every laptop encrypted, patched on a schedule, and on a list that says whose it is, how old it is, and whether it can run Windows 11
5. Email that lands: the domain's sending records set so quotes and invoices stop arriving in the customer's spam folder
6. The copier, the printer and the line-of-business application each with a named vendor, a support number and a renewal date somebody can see
7. A password manager the business owns, holding the domain registrar, the internet account, the firewall, the Microsoft 365 admin and the copier portal, with the owner able to open it
8. A start-and-leave routine: the laptop and accounts ready before a new person's first morning, and every door closed on a leaver's last afternoon
9. Somebody who answers, at any hour, and who has read the sheet of paper before the call

Most offices this size have two or three of the nine. The rest are not expensive; they are unowned.

Items one and two carry most of the risk, so they go first. One account per person sounds obvious until the audit: the shared office mailbox four people sign into, the accounts of two people who left last year, the owner's login that is also the administrator for everything. Multi-factor sign-in on every account is the single change that stops most of the break-ins a small office actually suffers, which arrive as a stolen password rather than as anything clever. It takes an afternoon, and the afternoon mostly goes on the people whose phones need setting up.

The backup question is sharper than it looks. Microsoft 365 and Google Workspace keep deleted mail and files for a while, and that retention is useful, but it is not a backup: it sits under the same account and the same password, and a leaver's mailbox or a deleted site falls out of it on a timer. A backup is a separate copy, held somewhere the office's own credentials do not open, that someone has actually restored a file from. The application the business runs on is the item most often missed; if it lives on one PC in the back office, the backup of that PC is the backup of the business, and it should be tested as one.

Most small offices sit behind the modem and router the provider installed, with its default rules and whatever firmware it shipped with. It works, which is why it has never been looked at. The office PCs, the guest Wi-Fi, the printer, the thermostat and the camera recorder all share it, and the one open port that let the accountant in from home is still open.

The fix is a small firewall the business owns, configured once and written down: the office on one network, guests on another, the devices nobody trusts on a third, remote access through a VPN rather than a forwarded port, and the firmware date on the inventory sheet so it gets patched when it ages. At this size it is a day's work and one box. The network and firewall work described on the IT page is the same job at any size; here it is a short one.

An office that bought its laptops one at a time has one of everything: different ages, different Windows versions, local administrator rights on all of them, and at least one still on Windows 10, which stopped receiving security fixes on October 14, 2025. The small-office version of endpoint management is a list and a policy rather than a project. The list says whose each machine is, when it was bought, whether its drive is encrypted and whether it passes the Windows 11 hardware check. The policy says patches install on a schedule people know about, and that nobody is an administrator on their own machine without a reason written next to their name.

Enrolling the machines in device management is worth doing even at fifteen laptops, because it is what makes a lost laptop a wiped laptop and a new one a machine that sets itself up out of the box. The endpoint and patching work on the IT page describes the full version; the small-office version is the same tools with fewer rings.

Items five and six are the ones that cost money quietly. A domain without its sending records set has its quotes and invoices land in spam at some customers, and the office never hears about the ones that did. Setting SPF, DKIM and DMARC for the domain is an hour's work and a change at the registrar, and afterwards the mail from the copier and the accounting package needs including, because those send as the company too. The Microsoft 365 and email work on the IT page sets the same records for a larger tenant.

The vendor list is simpler and more often missing: the copier lease and who services it, the internet account number and the provider's business support line, who to call about the accounting package, and when each of them renews. Written on one sheet, it turns a two-hour hunt through old emails into a two-minute phone call, and it is the first thing the person on call reads.

Item nine is the one a small office goes without longest, because the alternatives look free: a relative who is good with computers, the copier technician who knows a bit, a search engine at eleven at night. Support for an office this size has a specific shape. There is one address or number to use, and a person answers it rather than a form that files a ticket for the morning. The response time is written down, so the office knows what it bought. The person who answers has read the sheet of paper, so the call starts from what the office runs on rather than from a questionnaire. And it covers the hours the office actually keeps, which for a contractor, a practice or a shop are rarely nine to five.

That is why our support is 24/7. When the accounting server is down at seven on a Saturday morning, or nobody can sign in at six on a Monday, an engineer answers, and the engineer who answers is one who did the work: the firewall, the backups and the laptop list in the sections above were set up by the same people who take the call. Routine requests, a new starter or a mailbox change, go through the same desk and are answered within the time written into the arrangement.

Sizing follows the headcount and the device count, so a fifteen-person office is supported, and billed, as one. The ticket queue, the start-and-leave routine and the runbooks for an office this size are described in the help desk and user lifecycle row of the IT page.

Every item above ends with something written down, and together they make the one document a small office needs: a page that says what the office runs on. The domain and where it is registered. The internet provider and the account number. The firewall, its address and where its login lives. The Wi-Fi networks and which one guests use. Each laptop, whose it is and how old. The copier and who services it. The one application, where it runs, where its backup goes and when that was last tested. Who has an account and who is an administrator. The support number.

It fits on one page at this size, and that is the point: the person who answers at night reads it before they pick up, the office manager reads it when the owner is away, and whoever the office hires or appoints next inherits it instead of starting from a search through old emails. It belongs to the business, in a place the business controls, and writing it is the first thing we do for a small office.

When the office has been running on the second owner's memory and the first one has gone. When a password reset means waiting for whoever is in. When the last backup anyone remembers is the external drive from the move. When the Windows 10 machines are still on desks and nobody has counted them. When the business is about to hire its fifteenth person and the way things are set up was built for six. Any of those is worth an hour's conversation, and the first deliverable is the sheet of paper, whether or not anything else follows.

Where the office is also the one that calls about a printer, the guide to a network printer that keeps going offline covers the usual cause, and where the safe harbor in Texas law is the reason the question came up, the SB 2610 guide walks through the tiers for a company of forty.