Small business IT checklist for Hawaii: accounts, backups, devices and offboarding

Who this checklist is for

This is for small Hawaii teams where IT is handled by the owner, an office manager or whoever is “good with computers”. It assumes you use Microsoft 365 or Google Workspace and a handful of cloud apps for accounting, bookings or customer records.

If your people work on more than one island, every item matters a little more. You cannot walk over to someone’s desk in Hilo or Līhuʻe, so accounts, devices and offboarding have to work remotely from the start.

1. Know your accounts and who controls them

Start with a list. CISA’s Cyber Essentials asks small organizations to keep current inventories of their hardware and software, and NIST’s small business quick-start guide begins the same way, with an inventory of hardware, software, systems and services. A shared spreadsheet is enough.

2. Separate everyday and admin accounts

Admin rights let someone create users, reset passwords and change security settings. CISA recommends limiting access and admin rights to what each role actually needs, the principle of least privilege. For a small team, that looks like this:

• Give admin rights to two named, current people, not to everyone “just in case”.
• Use a separate admin sign-in for admin work and an ordinary account for daily email and browsing, so a phished everyday account does not hand over the keys.
• Store recovery codes for the admin accounts somewhere secure and offline.
• Review the admin list whenever someone joins, leaves or changes role.

3. Turn on multi-factor sign-in, in the right order

NIST’s quick-start guide calls multi-factor authentication one of the fastest, cheapest ways to protect your data, and the FTC advises requiring it for accounts that hold sensitive information. CISA’s view is that any multi-factor sign-in is better than none, that phishing-resistant methods based on FIDO/WebAuthn (security keys and passkeys) are the strongest, and that number matching helps block push-notification spam if you use app prompts.

Enroll each person during setup, while you can talk them through it, and set a second recovery method. A lost phone on another island should be an inconvenience, not a lockout.

4. Retire shared passwords

A password on a sticky note or in a group chat cannot be taken back from one person: when they leave, everyone has to change it, and usually nobody does. CISA recommends a separate account and password for every user. The FTC suggests passwords of at least 12 characters, never reused, and NIST suggests a password manager and changing default manufacturer passwords.

• Give each person their own sign-in wherever the service allows it.
• Where a shared login is unavoidable, keep it in a business password manager and change it when anyone with access leaves.
• Change the default passwords on routers, printers and cameras.

5. Back up with 3-2-1, then prove it restores

CISA’s guidance for businesses describes the 3-2-1 rule: three copies of important files, on two different types of storage, with one copy off-site. Its example of two media is a hard drive and the cloud. It also advises backups that run automatically, a mix of on-site and remote copies, and the ability to roll data back at least seven days.

Cloud suites count as a place your data lives, not automatically as a backup. Before relying on one as your only copy, check what it can restore and for how long.

6. Keep devices updated and encrypted

NIST and the FTC both recommend turning on automatic updates. CISA adds replacing software and hardware that no longer receives support. NIST’s quick-start guide recommends full-disk encryption on laptops and tablets, and the FTC extends that to phones and removable drives that hold sensitive information.

7. An offboarding runbook for the day someone leaves

CISA asks organizations to have written procedures for changes in user status, such as transfers and departures. NIST puts it as a question worth asking regularly: are we removing access when people no longer need it?

Where to start

If the list feels long, do three things this month: multi-factor sign-in on email, one restore test, and a written offboarding checklist. Then run the free IT Health Check to see which areas still need attention.