You didn’t start your company to think about servers. But if you own the business, you own the risk — and technology is now where a lot of that risk lives. The good news: you don’t need to become technical. You need to know which questions to ask, how to recognize honest answers, and what to delegate without guilt.

Here’s the owner’s version of IT literacy. It fits on a page.

The five questions every owner should be able to answer

Not configure. Not troubleshoot. Just answer — because whoever handles your IT should have made the answers easy.

1. If we got hit with ransomware tonight, how long until we’re working again? Not “do we have backups” — everyone says yes to that. How long, in hours or days, and when was a restore last actually tested? If the answer is a shrug, that’s your top priority. (Here’s what a real answer involves.)

2. What happens when an employee leaves? Who shuts off their accounts, how fast, and who checks? A departed employee with live email access is one of the most common — and most preventable — small-business exposures.

3. Where does our money-movement process live? If your bookkeeper got an email from “you” asking to change a vendor’s bank details, what would stop the payment? A phone call to a known number should be a written rule, not a habit. Executive impersonation is the scam that takes the most money from businesses your size.

4. What are we spending on technology, all in? Support, licenses, internet, phones, hardware over its life. Most owners only see the pieces. One number, reviewed yearly, turns IT from a junk drawer of expenses into a line you can manage. (How to build that budget.)

5. Would our cyber insurance actually pay? The application you signed made promises — MFA everywhere, tested backups, security tooling. If reality drifted from the paperwork, the policy can fail exactly when you need it. (What carriers check.)

The risks worth an owner’s attention

You can safely delegate almost everything technical. Three things deserve your personal attention, because they’re business decisions wearing IT costumes:

Email fraud. The biggest losses we see don’t come from hacking — they come from someone being talked out of money. The defense is process: verification rules for payments, and a culture where double-checking the boss’s “urgent” email is praised, not punished.

Downtime tolerance. Only you can say what a day of downtime costs — in payroll, missed orders, and clients quietly deciding you’re flaky. That number determines how much backup and redundancy is rational to buy. Decide it once, on a calm day. (How to calculate it.)

Key-person risk. If one employee, or one outside tech, holds all the passwords and all the knowledge, you have a single point of failure with a personality. Insist on documentation the business owns — accounts, licenses, how things are set up. This is also the first thing to check with any IT provider: if you left them, would you leave with your own keys?

What good delegation looks like

Whether it’s an internal person or a provider like us, the arrangement should give you:

  • A flat, predictable cost — surprises in IT billing usually mean prevention isn’t happening
  • Reports you can actually read — what broke, what was prevented, what’s aging out, in plain English
  • A regular strategy conversation — quarterly is plenty — about where the business is going, not just what broke
  • Named accountability — a person whose job it is to know your business, so every call doesn’t start from zero

If you’re getting invoices instead of information, you’ve hired a repair service, not a partner. (What separates the two.)

The bottom line

Owning the technology risk doesn’t mean carrying it alone. Know your five answers, keep the three owner-level risks on your desk, and delegate the rest to someone who reports in plain English. That’s the whole job — and it’s a few hours a year, not a new career.