The Small Business Security Sanity Check

Here's a scene from a real category of Tuesday: an owner gets an email from a client's legal team. Nothing dramatic — a routine vendor questionnaire, one line buried in the middle: "Describe your data-handling and access-review practices." The owner stares at it, thinks about the password spreadsheet, the backup nobody has restored since the office move, and the former bookkeeper whose login probably still works. Then they close the email and feel vaguely sick.

Nothing was hacked. Nothing is on fire. But somewhere between that questionnaire and reality sits a gap the owner has never actually measured. Most small businesses don't know their exposure — not because they're careless, but because nobody ever handed them a map.

That's the idea behind the Security Sanity Check: a fixed, few-hour review that answers one question — where does our data actually go, who can still touch it, and what would we wish we'd tested? No sales deck, no jargon, no 80-page report. Here's what it looks for, and why these three areas are where small businesses reliably bleed.

Check one: the backup nobody has ever tested

Almost every small business has backups. Far fewer can answer the only question that matters about them: has anyone ever actually restored a file from it? Until that's happened at least once, a backup isn't a backup — it's a hope with a schedule.

The failure modes are boring and brutal. The backup software has been "succeeding" for two years while backing up a folder that moved in the office reorganization. The cloud replication completes nightly into an account nobody can log into anymore. The restore plan exists in the IT person's head, and the IT person left in 2023. Ransomware statistics are full of businesses with 100% backup success rates and no working restore path.

During the Sanity Check, backups get handled the careful way — we ask, we don't touch. Does a backup exist? What does it cover? When is the last time anyone performed a real restore, and did it work? If the honest answer is "the job says it ran," that's a finding — one that deserves a proper fix. And when you're ready to actually prove the restore path works, that's a full engagement: a supervised test restore, done methodically, where "it works" or "it doesn't" is the deliverable and nothing gets gambled in the process. A few-hour check establishes the facts; a full engagement proves them.

Check two: the access that never left

People leave jobs. Their access doesn't always leave with them. This is the quietest exposure in small business because it feels like bookkeeping, not security.

The pattern repeats everywhere: the ex-employee whose email account is still active "because we might need their old messages." The shared password that's been through four staff changes since anyone last rotated it. The QuickBooks login saved in a browser on a laptop that went home and never came back. The marketing contractor from two agencies ago who still has the domain registrar login — because moving registrars is annoying, and nobody's touched it since.

Each one is a door that no longer has an owner. None of them show up on a firewall report. The Sanity Check does a simple, uncomfortable inventory: every account with access to anything that matters, matched against the person who should hold it. The list is usually shorter than the owner fears and worse than they'd guess. Stale access doesn't announce itself — it just waits.

Check three: the AI tools already in the building

This is the new one, and it moves fastest. Somewhere between the company's official AI policy (which may not exist) and reality sits a stack of free personal chatbot accounts handling real work — client notes pasted into summaries, contracts pasted for plain-English versions, payroll tables pasted to fix formatting.

None of it is malicious. All of it is a data path nobody approved, to systems nobody vetted, under terms nobody read. We covered the mechanics of this in detail in Nobody Meant To Leak It — the tool rewards the paste, the paste doesn't feel like data, and the rules were never written. In a Sanity Check, we inventory what's actually in use, match it against what your client contracts require, and hand you a policy short enough that your team will actually follow it — plus a sanctioned tool so the compliant path is also the convenient one.

What you walk away with

The Sanity Check is deliberately small: a few hours, one flat fee. You get a plain-English report — no jargon, no fear-selling, no 80 pages — with the three fixes that matter most ranked by what they actually protect. Sometimes the answer is "your backups are fine, but your ex-contractor has the keys to the building." Sometimes it's "your team already leaks data daily and nobody knows." The point is you stop guessing.

Not every finding needs a consultant to fix. Most of the report is stuff a careful owner can fix in an afternoon — turn off the stale account, rotate the shared password, write the two-paragraph AI policy. The check exists because you can't fix what you can't see, and nobody ever showed you the picture.

The five-minute self-check

1. When did anyone last restore an actual file from your backup — and did it work? (Not "the job says it ran." A real restore, ever.)
2. Can you list every current account with access to your email, accounting, and client files — and would every name on it still work there?
3. Do you know which AI tools your staff uses at work — and would you be comfortable if a client found out?
4. Do you know, without looking, what your client contracts say about data handling?
5. If the office flooded tonight, how many hours until you're taking client calls again — and has anyone ever actually rehearsed that?

Five for five: you're in better shape than most, and a Sanity Check will still find something. Three or fewer: that email from the client's legal team isn't hypothetical — it's a matter of time. Either way, the gap between "probably fine" and "proven fine" is a few hours, and it's the cheapest few hours in security you'll ever spend.