Your IT Person Is Great. What Happens the Week They Are Not There?
Your IT person may be excellent. They may know every device, vendor, workaround, and recurring problem in your business.
That is valuable. It can also create a serious business risk.
If one employee or solo IT provider is the only person who knows your passwords, network layout, backup process, vendor contacts, and recovery procedures, your business may have a single point of failure.
The problem usually does not appear when everything is working. It appears when that person is on vacation, becomes seriously ill, leaves the company, or simply cannot answer the phone during an outage.
Then a routine technology problem can become a business interruption.
The hidden cost of one-person IT knowledge
For many small businesses, the “IT department” is one capable person who handles technology in addition to other responsibilities. For others, it is a single outside technician or solo provider.
This arrangement can work for day-to-day support. The risk comes from everything that remains undocumented or accessible only through that individual.
Consider what may happen if your primary IT person is unavailable on the day:
- The accounting system stops connecting to the network.
- A key employee’s email account is compromised.
- The internet goes down during a deadline.
- A server fails or a cloud application becomes inaccessible.
- A departing employee’s access needs to be removed immediately.
- Your backups report an error, but no one knows whether recent data can be restored.
The business does not just lose technical support. It loses context.
Someone else now has to determine:
- What systems does the company actually use?
- Who owns each account?
- Where are the administrative credentials?
- Which vendors should be contacted?
- How does the network fit together?
- Where do the backups run?
- When was the last successful restore?
- Who has authority to approve emergency changes?
That discovery process consumes time when time matters most.
As CISA explains in its guidance for managed service customers, businesses need to retain control and awareness of their systems, vendor access, and recovery processes. That principle applies whether your IT support comes from an employee, a contractor, or a managed services provider.
Five warning signs that your business depends too heavily on one person
1. The network exists in someone’s head
You may have a diagram somewhere, but is it current? Does it show the firewall, switches, wireless access points, servers, cloud services, important integrations, and dependencies?
If the answer is no, troubleshooting becomes guesswork.
A documented environment should identify what each system does, where it is located, who supports it, and what other systems depend on it. Documentation is not paperwork for its own sake. It reduces the time required to make safe decisions.
2. Critical passwords are shared or personally controlled
A shared administrator password creates two problems.
First, it makes access difficult when the person who knows the password is unavailable. Second, it makes accountability difficult because nobody can clearly determine who made a change.
Administrative access should use named accounts wherever possible. Emergency credentials should be stored in a business-controlled password vault with appropriate access for at least one backup person. Multifactor authentication should not depend on one employee’s personal phone or email account.
The business, not one individual, should control access to its technology.
3. Vendor accounts are tied to one person’s email
Domain registration, website hosting, internet service, phone systems, software subscriptions, cloud platforms, and backup services often have separate accounts.
If all of them use one person’s email address, the company may not be able to reset a password, approve a support request, or change billing information without that person.
Create a vendor and system register that includes:
- The service and what it supports
- The business owner of the account
- The technical administrator
- A backup administrator
- Recovery email and phone information
- Billing contact
- Contract and renewal dates
- Support and escalation details
- Multifactor authentication method
This register should be reviewed whenever a system or vendor changes.
4. No one else knows how the backups work
A backup job reporting “successful” does not prove that your business can recover.
Someone should know:
- Which systems and data are backed up
- Where the backup copies are stored
- How long they are retained
- Whether backups are isolated from the production network
- How the backup console is accessed
- Where encryption keys or recovery codes are stored
- Which vendor to contact when a job fails
- How to restore a file, application, or complete system
The restore process should be tested, not assumed.
CISA’s backup guidance for small and medium-sized businesses recommends maintaining protected copies and testing recovery. A backup that cannot be accessed or restored when needed is not a reliable recovery plan.
5. There is no response path during an outage
When the primary IT person is unavailable, who takes the first call?
Who can authorize emergency work? Who communicates with employees? Who contacts the internet provider, software vendor, cyber insurance carrier, or outside technical support?
Without a defined escalation path, people may spend the first several hours calling the wrong contacts, waiting for an answer, or making changes that complicate recovery.
That response gap is often more damaging than the original technical issue.
What proper IT coverage looks like
Coverage does not necessarily mean hiring another full-time IT employee. It means building a structure where one person’s absence does not stop the business from operating or recovering.
A resilient IT environment includes the following.
A current, business-owned documentation set
Your provider or internal IT lead should maintain documentation for:
- Network layout and device inventory
- Critical applications and integrations
- User and administrator accounts
- Cloud tenants and domain ownership
- Vendor contacts and contracts
- Backup configuration and restore procedures
- Hardware warranties and license renewals
- Known dependencies and recurring issues
- Emergency contacts and escalation instructions
The documentation should be readable by someone who did not build the environment.
Secure credential vaulting
Credentials should be stored in a secure password manager controlled by the business. Access should be assigned to named individuals, protected by multifactor authentication, and reviewed regularly.
Do not rely on a spreadsheet saved to one person’s computer. Do not make one employee’s personal email the only recovery method for a critical account.
Access should also be removed promptly when an employee or provider no longer needs it.
Monitored alerts and proactive support
A coverage plan should not depend entirely on someone noticing a problem after employees report it.
Monitoring can identify:
- Backup failures
- Disconnected devices
- Storage capacity problems
- Security alerts
- Expiring certificates or licenses
- Unusual login activity
- Patch and update issues
- Network or server performance problems
Monitoring is not a substitute for skilled support, but it shortens the time between a problem occurring and someone responding to it.
Tested backup restoration
At least one person besides the primary IT contact should participate in a restore test.
That person should be able to locate the backup console, retrieve emergency credentials, identify the correct recovery point, contact the vendor, and follow the documented procedure.
A practical test might begin with restoring a single file or mailbox. It should also include broader recovery scenarios for the systems your business cannot operate without.
Record what happened:
- How long did recovery take?
- Was the expected data available?
- Were permissions preserved?
- Were any credentials or encryption keys missing?
- Did the instructions make sense?
- What needs to be corrected before the next test?
A clear escalation path
Your team should know what to do when the primary IT person does not answer.
The plan should identify:
- Who receives the initial report
- How critical issues are classified
- Who can approve emergency changes
- Which provider or vendor is contacted
- How employees and customers are updated
- When leadership is notified
- How the incident is documented afterward
For a suspected cyber incident, the plan should also address account isolation, evidence preservation, legal and insurance contacts, and safe recovery.
The goal is not to create a complicated manual. The goal is to make the first few decisions clear.
A simple test for your current setup
Ask a trusted manager who is not your primary IT person to complete these tasks without coaching:
- Locate the company’s critical system inventory.
- Retrieve the emergency credentials.
- Identify the internet, phone, accounting, and cloud vendors.
- Find the backup console.
- Explain how to restore a priority file.
- Identify who should be called during an outage.
- Find the latest network diagram and backup report.
Pay attention to where the process stops.
Every unanswered question is a business continuity gap. Every outdated document is a future delay. Every credential known by only one person is a single point of failure.
Managed IT should create coverage, not dependency
A managed IT provider should make your business less dependent on any one individual, including the provider itself.
That means the provider maintains current documentation, uses secure access practices, monitors your environment, tests recovery, and gives your business a defined response process. It also means your company retains ownership and access to its systems, accounts, data, and vendor relationships.
At B&R Computers, our managed IT process includes documentation, credential transfer, vendor management, proactive monitoring, backup and disaster recovery, and a deliberate transition plan. The objective is straightforward: give your business reliable support and a predictable response when something goes wrong.
Learn more about managed IT services for businesses in Berks County and the Lehigh Valley, or review the practical tools in our business owner resource library.
Your IT person may be great. The question is whether your business remains capable, informed, and protected when that person is not available.
Find out where your coverage has gaps
A Business Risk Review can identify whether your documentation, credentials, backups, vendor access, and response procedures are strong enough to support the business without one person in the middle of everything.
Start a Strategy Session with B&R Computers and build an IT support plan that protects your operations, your people, and your ability to recover.