Owners ask us some version of this question constantly. How much of this am I supposed to understand? There is a quiet worry underneath it, usually that admitting confusion in a meeting will cost them leverage, or that they should have learned all this years ago and the window has closed.
The honest answer is that you need to understand far less than you fear, and you need to understand it far better than you probably do. You do not need to configure a firewall any more than you need to rebuild the transmission on the delivery van. You do need to know where the van is, who has the keys, what happens if it does not start Monday, and what you are paying every month to keep it running. That is not technical skill. That is business literacy, and it happens to be about technology.
Literacy, Not Skill
The distinction matters because it tells you where to stop. Skill is knowing how to do the work. Literacy is knowing what the work is for, whether it is being done, and what it costs if it is not. Every owner already has this instinct about money. You do not post journal entries, and you would still notice if your bookkeeper could not tell you what is in the bank.
CISA’s Cyber Essentials puts leaders at the center of what it calls a culture of cyber readiness, with an entire section devoted to the leader’s own role: driving strategy, driving investment, and asking the questions that make the rest of it happen. Nowhere does it ask the owner to touch a server. It asks the owner to know enough to notice when something is missing.
The Ten Things Worth Knowing Cold
If you can answer these ten from memory, you are ahead of most owners we meet. If you cannot answer four of them, that is the agenda for your next provider meeting.
- Where your data actually lives. Not “the cloud.” Which services hold your customer records, your financials, your files, and your email, and whether any of it also sits on a machine in your building.
- Who has access, and who can grant it. The second half is the one people miss. Somebody in your organization can create accounts and hand out permissions. You should be able to name that person.
- How you would recover, and how long it takes. Not whether backups exist. How long until you are invoicing again, and when somebody last proved it by doing a test restore.
- What you actually pay for. A line item list of every technology subscription, what each one does, and who uses it. Nearly every business we review is paying for at least one thing nobody has opened in a year.
- Who owns your domain and your core accounts. If your domain name is registered under a former employee’s personal email, you have a business continuity problem wearing a very small costume.
- How money moves, and who can move it. Which people can initiate a payment, change bank details on a vendor record, or approve a wire, and what second step exists before that happens.
- What your insurance actually requires. Cyber and crime policies often carry conditions about multi-factor authentication, backups, and how fast you report an incident. Read the conditions, not the summary page.
- How your team reports a problem. If the answer is “they text whoever they think can help,” you do not have a process, you have a rumor mill. And the reports you most need are the embarrassing ones.
- What your provider does each month. Whether that is us or somebody else, you should be able to describe the recurring work in a sentence a stranger would understand.
- Your single biggest point of failure. One person, one machine, one application, one internet connection. Every business has one. Knowing which is yours is more valuable than a dozen small improvements elsewhere.
Notice what is not on that list. Nothing about protocols, brands, or configuration. Every item is a business question that happens to have a technical answer.
What You Are Allowed to Ignore
This part is just as important, because owners waste real energy on things that are genuinely not theirs. You are allowed to ignore how the firewall rules are written, which brand of antivirus is running, how the backup software is scheduled, what the server naming convention is, and every acronym that comes up in a vendor pitch. You are allowed to ignore the debate about which platform is better. You are allowed to say “I do not need to know that, I need to know what it means for us.”
The trade is simple. You skip the mechanics, and in exchange you insist on plain answers to the ten questions above. An owner who has read enough articles to argue about products but cannot say how long a recovery would take has bought the wrong knowledge.
How to Get These Answers Without a Fight
Asking these questions can feel like an accusation, especially if the person answering has been loyal for years. It does not have to. Frame it as something you need for the business, because it is.
- Ask for it in writing, once a year. A short document, not a meeting. The act of writing it down surfaces gaps that conversation glosses over.
- Start with the inventory. The National Institute of Standards and Technology’s Small Business Quick-Start Guide, published in February 2024, recommends listing each system and service alongside who administers it and the business impact if access is lost. That single table answers three of the ten questions.
- Ask for a test, not a promise. CISA advises organizations to plan, prepare for, and drill cyberattacks the way they would a fire, and its small business guidance stresses that scheduling backups is not enough without regularly testing restores.
- Say when you do not follow. The most useful sentence an owner can say in these meetings is “explain that again without the acronyms.” A good provider will welcome it. A defensive answer is itself information.
If those conversations keep going badly, the problem may be the fit rather than the questions. We wrote about what a working relationship should look like in our guide to choosing an IT partner.
The Bottom Line
You are not behind. You have been measuring the wrong thing. The owners who handle technology well are almost never the ones who know the most about it. They are the ones who know exactly which ten questions matter, ask them out loud on a schedule, and refuse to accept an answer they cannot repeat to somebody else.
Pick the four on that list you cannot answer today. Write them on a card. Ask them at your next review and take notes. That single hour will tell you more about the health of your technology than any assessment, and it costs nothing but the willingness to ask a plain question and wait for a plain answer.
We work with owners across Denton County who want to understand their technology without becoming technicians. If you would like a straight walk through those ten questions for your own business, with answers you can actually repeat, we are glad to sit down and go through them. Contact us today
Sources:
Comments are closed