IT Support for Small Business: What a 10, 30 and 80-Person Company Needs

The short version: A 10-person company needs a reliable help desk, managed accounts and devices, backup that has been restore-tested, and basic security. A 30-person company adds written processes, patch reporting, a documented network and a named escalation path. An 80-person company adds role-based access, security monitoring, a yearly IT plan and budget, and often a part-time on-site presence. The checklists below show the step up at each size.

This is for owners and office managers who handle IT as a side job, and want to know what to put in place for their headcount. After reading it you can mark what you already have, see what is missing, and decide what to buy as a service. The headcounts are rules of thumb: a 10-person law firm and a 10-person design studio have different needs, so adjust for how much your business depends on IT and on sensitive data.

What does every small business need regardless of size?

1. One reachable support contact and a way to raise a request that leaves a record.
2. A list of every user, device, subscription and vendor, kept up to date.
3. Individual accounts for every person, with MFA on email and any system with business or customer data. See MFA rollout for an accounting firm for the pattern.
4. Device encryption and screen lock on every laptop and phone that touches company data.
5. Automatic updates, with someone checking that they actually happened.
6. Backup of business data to a location that an infected laptop cannot overwrite, with a restore test.
7. Admin accounts held by the company, not by one person or by a former supplier.
8. A leaver checklist, so access is removed on the last day.

What does a 10-person company need?

Support model

1. A help desk that answers during business hours, mostly remote, with a promised first-response time.
2. An on-site visit option for hardware and cabling, not a standing presence.
3. A named backup contact, so one person on leave does not stop support.

Identity and email

1. Microsoft 365 or Google Workspace with MFA for all users.
2. Shared mailboxes for info@ or sales@ addresses, instead of shared passwords.
3. A standard way to onboard and offboard a user.

Devices

1. Standard laptop builds, a spare laptop, and a record of who has what.
2. Encryption and automatic updates on.
3. A short list of approved software.

Security

1. Anti-malware or endpoint protection on every device.
2. Email filtering for spam and phishing.
3. A one-page rule set for staff: report suspicious email, no shared passwords, lock the screen.
4. A password manager for business logins.

Backup

1. Cloud data (Microsoft 365, Google) backed up to a separate location.
2. File server or NAS backed up offsite.
3. A restore test twice a year.

Network

1. A business-grade router or firewall with current firmware and a guest Wi-Fi network separate from staff.
2. A note of the internet line supplier and contact.

Planning

1. A yearly review of devices due for replacement.

Signs you should move up to the next tier

1. Staff keep a second email or file system outside the main one.
2. You add a second office or a regulated client.
3. One person's absence stops IT work.

What does a 30-person company need?

Support model

1. A service desk with written priorities and targets. See P1 to P4 priority levels. Example target (illustrative, set your own): first response within 1 hour for normal tickets during business hours.
2. A monthly report: tickets, response times, repeat issues.
3. Scheduled on-site visits, or on-demand dispatch within an agreed time. See onsite vs remote IT support.

Identity and email

1. Conditional access or equivalent rules: MFA for all, block legacy sign-in, review of admin accounts.
2. Groups for departments and a written access request process.
3. A named owner for the Microsoft 365 or Google tenant.

Devices

1. Device management (such as Microsoft Intune) for laptops and phones, with remote wipe.
2. A patch process with monthly reports. See patch management compliance in APAC.
3. A hardware refresh cycle and a spares pool.

Security

1. Managed endpoint protection that someone watches, not just installed software.
2. Phishing awareness for staff at least twice a year.
3. A first security review of the Microsoft 365 tenant. See Microsoft 365 security audit cost.

Backup

1. Recovery targets agreed with the business. See RTO vs RPO.
2. A monitored backup with alerts on failure and a documented restore procedure. Example routine (illustrative): a restore test every quarter.

Network

1. Documented network: IP plan, VLANs, devices, line contracts.
2. Managed firewall and Wi-Fi with scheduled firmware updates.
3. Remote access for staff through a reviewed method.

Planning

1. A half-yearly review with your provider: tickets, risks, upcoming changes.
2. A simple IT asset register and licence list.

Signs you should move up to the next tier

1. Customers send security questionnaires.
2. More than one site, or staff working abroad.
3. Downtime of a key system would cost more than the annual IT spend.

What does an 80-person company need?

Support model

1. A service desk with extended hours or on-call cover for critical systems, and a defined escalation matrix. See the escalation matrix template.
2. Part-time or scheduled on-site IT presence, or a full-time person with a provider backing them. See full-time onsite IT support.
3. A service request catalogue: new starter, access change, equipment, software.

Identity and email

1. Role-based access, regular access reviews and privileged account separation.
2. Single sign-on for main business applications where available.
3. Joiner, mover, leaver process tied to HR.

Devices

1. Managed laptops, phones and shared devices under policy, with compliance reporting.
2. A software deployment method and a vulnerability and patch report.

Security

1. Security monitoring and alert triage. See the security operations centre service.
2. Incident response steps written and rehearsed once a year.
3. Regular vulnerability scanning and an annual security assessment. See the IT security assessment.

Backup

1. Backup of every critical system with tested recovery against agreed targets. Example routine (illustrative): restore one critical system every month, and run a full recovery rehearsal once a year.
2. A disaster recovery plan for the top systems.

Network

1. Redundant internet where an outage is costly, and monitored devices.
2. Network documentation kept current, with change records.

Planning

1. A yearly IT roadmap and budget. See vCIO services.
2. Vendor and contract review, and a risk register.

Common mistakes

1. Relying on one person who "knows IT". Document everything so the knowledge is not in one head.
2. Treating backup as done once it is configured. A backup you have not restored is a guess.
3. Buying tools instead of processes. Software without an owner and a routine does not protect anyone.
4. No leaver process, leaving old accounts active.
5. Not owning the admin accounts when a supplier sets up the system.
6. Waiting for a breach to start. Start with identity, devices and backup; they cover the most common problems.

How to check it worked

1. Pick a random user and see if you can show their account, device, licence and backup status within five minutes.
2. Ask: if our IT person were away for two weeks, what would stop?
3. Run a restore test of one file and one mailbox item.
4. Check that the last leaver has no active account.
5. Compare tickets and repeat issues against last quarter.

For choosing a provider, see how to choose a managed IT services provider in Hong Kong.

FAQ

How do I find someone to help with my business IT?

Write a one-page scope from the checklist above, ask two or three providers for their written service levels and a sample monthly report, and run a short pilot. Our selection scorecard gives a structured way to compare them.

What are examples of technology solutions in business?

Examples are Microsoft 365 or Google Workspace for email and files, device management for laptops and phones, endpoint protection, managed backup, a managed firewall and Wi-Fi, and a help desk for users.

What IT products does a small business need most?

Start with email and file platform, managed devices, endpoint protection, backup and a firewall. Add monitoring, a password manager and phishing training as the company grows.

What is managed IT for a small business?

It is a monthly arrangement where a provider runs support, monitoring, updates and backup for a defined scope. Read more about IT support and managed services.

Find out how we support companies of your size on our for SMEs page.

Brocent publishes its managed IT support plans with per-user monthly prices for Hong Kong, Singapore, mainland China and the United States, so you can compare before you talk to anyone: see the plans and pricing.