IT Resilience Assessment: A 20-Question Check for Houston Businesses

Step 1: who belongs in the room and what to bring.

Run the IT resilience check with three people: the owner, the office manager and whoever handles IT, whether that is an employee or an outside provider. Between them they hold the answers on spending, daily operations and systems, and one hour is enough when nobody tries to fix anything during the meeting.

Bring the last IT invoice, the list of software subscriptions from the company card statement and the most recent cyber-insurance application if there is one. Those documents answer several of the cost and vendor questions on the spot.

Keep the meeting to scoring. A gap found ten minutes in gets written down and fixed later, because stopping to solve it is how a one-hour check turns into an afternoon and never gets finished.

Step 2: the 20 questions, grouped by the six parts of IT resilience.

Ask the 20 questions in order, one part at a time: four on security, four on operations, then three each on data, people, vendors and cost. Write down the honest answer rather than the hoped-for one, and note who in the room actually knew it.

The questions are written so an owner can answer them without technical knowledge. Each one tests whether the business has a real, written answer to a common disruption.

Security (Q1 to Q4)

• Q1. Is multifactor sign-in turned on for every email account and every admin account?
• Q2. If an employee's account is taken over tonight, who would notice, and how fast could it be locked?
• Q3. Are all laptops and servers getting security updates, and can someone show the date of the last one?
• Q4. When an employee leaves, is their access removed the same day, every time?

Operations (Q5 to Q8)

• Q5. What single failure would stop the whole office: internet, power, phones, a server or one login?
• Q6. If the office internet line goes down, how do staff keep working?
• Q7. If the office is closed for a week, can staff work from home with the same apps and files?
• Q8. Is there a written list of every device, account and system the business runs on?

Data (Q9 to Q11)

• Q9. Is Microsoft 365 or Google Workspace data backed up separately from the service itself?
• Q10. When was a restore last tested, and how long did it take?
• Q11. Is one copy of the backups stored outside the Houston region, where it cannot be changed or deleted?

People (Q12 to Q14)

• Q12. If the person who handles IT left tomorrow, could someone else get into every system?
• Q13. Are shared passwords kept in a company password manager rather than a spreadsheet or someone's memory?
• Q14. Does every employee know who to call, and what to do first, when something breaks or looks suspicious?

Vendors (Q15 to Q17)

• Q15. Is there a list of the vendors the business cannot work without, with a support contact for each?
• Q16. For each of those vendors, is there a written workaround if the service is down for a day?
• Q17. Which vendors hold company data, and how would the business get it back if it left them?

Cost (Q18 to Q20)

• Q18. What does the business spend on IT per employee each month?
• Q19. Could the business add or cut ten users next month without a surprise bill?
• Q20. When do the major IT contracts and licenses renew, and what does it cost to leave each one?

The vendor questions ask about workarounds rather than vendor quality for a reason. On July 19, 2024, a faulty CrowdStrike update knocked Windows computers offline around the world, and Microsoft said it affected 8.5 million Windows devices. The businesses hit had done nothing wrong, so the only part of that day they controlled was what staff did next.

Step 3: a strict scoring rule and what the total out of 40 tells you.

Score each answer 0, 1 or 2. A zero means nobody in the room could answer, a one means only one person knows or nothing is written down, and a two means the answer is written down and has been checked. With 20 questions at two points each, 40 is the maximum.

Be strict about the ones. A password that lives in the office manager's head scores a one even if the office manager has never missed a day, because the check measures what happens when that person is out.

Read the zeros first and the total second. A business can score 30 and still have a zero on backups, and that zero goes to the top of the fix list ahead of any total. As a rough guide, 0 to 19 means the business mostly runs on memory, 20 to 31 means it is partly written down, and 32 to 40 means most answers are written and tested.

Step 4: which zeros to fix first and the Houston deadline that sets the pace.

Fix every zero before improving any one, and work in this order: security and data first, operations and people next, then vendors and cost at the next contract renewal. Security and data come first because an account takeover or a failed restore does the most damage in the least time.

Many first fixes take about a week: turning on multifactor sign-in, moving shared passwords into a company password manager, testing one restore, or writing down the workaround for the vendor the office cannot work without. None of them needs new hardware.

Houston sets a natural deadline. The Atlantic hurricane season runs from June 1 to November 30, according to the National Hurricane Center, and a Gulf Coast storm tends to take out power, roads and cell service across the region at once. Run the 20 questions each spring so the operations and data zeros are fixed before June 1, and again after any big change such as a new office, a key person leaving or a vendor switch.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Security zeros: cybersecurity services add 24/7 threat monitoring and multifactor sign-in across email and admin accounts.
• Operations zeros: SD-WAN runs across redundant service providers, such as 5G data and Starlink, alongside the primary line.
• Data zeros: backup and disaster recovery keeps immutable, offsite copies of laptops, servers, Microsoft 365 and Google Workspace outside the Gulf Coast flood zone.
• People zeros: managed IT support gives every client a named engineer who knows the network and a help desk that answers in under 15 minutes.
• Vendor and cost zeros: CTO/CIO services cover vendor and contract reviews, and managed IT is billed at a flat monthly rate per user.
• Local coverage: CinchOps works with businesses in Houston, Katy and Sugar Land, including CPA firms, engineering firms and oil and gas companies.

An IT resilience assessment only pays off when the zeros get fixed. Run the 20 questions this month, close the security and data zeros before anything else, and talk to CinchOps if you want help turning the score into a plan.