Practical IT learning.
Made for your business.

• Define what needs support. List your staff, locations, critical applications, devices and current pain points. Include remote work and any busy periods when interruptions are especially disruptive.
• Check what is included. Ask each provider to identify support hours, on-site visits, projects, after-hours work, onboarding and exclusions. Put the answers side by side.
• Understand response commitments. Ask how incidents are prioritised, who escalates them, and how you will receive updates. Separate an initial response from a resolution commitment.
• Identify ownership. Confirm who handles updates, security alerts, backups, staff onboarding and offboarding. Ask what remains your responsibility.
• Ask for useful reporting. Request an example of how recurring issues, outstanding risks, service performance and upcoming decisions are explained to a business owner.
• Plan the transition. Discuss account ownership, documentation, credentials, handover and the exit process before signing. Keep business ownership of your domains and core accounts clear.

Your next step: write down your three biggest support frustrations. Ask prospective providers how they would investigate each one and what evidence would demonstrate improvement.

• Protect account sign-ins. Check where multi-factor authentication is enabled, especially email and administrative accounts. Ask which accounts still have exceptions.
• Keep systems current. Identify who checks software updates and unsupported devices, and how urgent security fixes are handled.
• Test recovery. Ask when important files were last restored from backup. Confirm who can access or delete backups and how recovery would work during an incident.
• Make reporting easy. Give staff one clear way to report suspicious messages or account activity. Practise what to do before an incident happens.
• Check payment changes. Agree how staff independently verify requests to change supplier bank details or make unusual payments.
• Assign an owner. Record each unanswered question, who will investigate and the next review date.

These starting points draw on the ASD’s ACSC Small Business Cyber Security Guide. A completed checklist is a conversation starter, not a security assessment.

• State the reason for the review. Is it a customer questionnaire, internal risk review, insurance renewal, tender or certification project? Keep the actual request and deadline together.
• Set the scope. List the business entities, locations, systems, people and suppliers involved. Record any uncertainty for the reviewer.
• Gather current evidence. Collect approved policies, asset and supplier lists, access review records, incident contacts, backup test records and relevant training records.
• Show what happens in practice. For each process, identify an owner, a recent example and the next review date. Keep gaps visible rather than treating a template as evidence of implementation.
• Agree the framework with the reviewer. If SMB1001 or another framework is being considered, confirm the applicable version, scope, evidence requirements and assessment process before claiming readiness.
• Turn gaps into decisions. Assign an owner and a realistic next action to each gap. Separate actions your team can take from decisions that require business approval.

Your next step: make a one-page list of the outcome you need, the evidence you have and the questions you cannot yet answer. Bring that to the first governance discussion.

• Choose a practical starting task. Identify a repeatable activity, the team performing it and what a better outcome would look like.
• Check the environment. Ask your administrator to confirm the licensing and technical requirements for the exact product and features being considered.
• Review information access. Check shared files, Teams and SharePoint permissions, guest access and sensitive information. Copilot’s use of existing permissions makes access reviews an important preparation step.
• Set usage expectations. Explain what information staff may use, where human review is required and how to report an unexpected result.
• Run a focused pilot. Choose a small group, offer training and compare the result with the original task. Include quality and rework in the review.
• Decide what to expand. Use the pilot findings to improve training, access and workflows before wider adoption.

For product guidance, see Microsoft’s Copilot onboarding resources.