Intraworks I.T. Management

Think back to when your company was half its current size.

You probably had fewer computers, fewer Microsoft 365 accounts, fewer software tools and a much simpler answer to the question, "Who needs access to this?"

Then the business grew.

People joined the team. Roles changed. Someone started working remotely. New software was added. Files moved into SharePoint. More devices connected to the network. Employees gained access to things for projects and kept that access after the project ended.

None of those changes are unusual. They're part of growing a business.

But your technology needs to grow with you.

Every so often, it's worth looking at the setup you have today and asking whether it still makes sense for the business you've become, rather than the business you were when everything was first set up.

If someone who normally signs in from Nanaimo suddenly has Microsoft 365 activity showing up from another country, that doesn’t automatically mean the account has been compromised, especially if your employees travel or work from different locations.

It does mean your security setup should be able to recognize that the sign-in looks different and decide what to do with it based on the rules you have in place.

Conditional Access can help with that by looking at things like location, device and sign-in behaviour, but those rules only make sense when they align with how your organization actually works.

A company with employees travelling internationally is going to need a very different setup from one where most people work from Vancouver Island every day.

Getting that balance wrong can either create unnecessary frustration for employees or leave gaps you did not intend to have.

This is why we talk so much about how Microsoft 365 is configured, not just whether certain security features have been turned on.

The right setup depends on understanding how your team works and what normal access actually looks like for your business.

Copilot is getting more attention for what it can help employees find, summarize and work with inside Microsoft 365. That also brings up a question businesses may not have looked at closely in a while: who can already access what?

Permissions can get messy over time. Someone gets access to a SharePoint site for a project, an employee changes roles and keeps permissions from their old position, or a folder ends up shared with more people than anyone originally intended.

None of that may seem like a big problem at the time, but a few years later that access can still be sitting there even if nobody remembers why.

Copilot doesn’t create those permission issues. What changes is how easily people can find and work with information they already have access to, which is why I’d review the Microsoft 365 environment before rolling it out.

Who can see sensitive information right now?

Do they still need access to it?

Are SharePoint and OneDrive permissions still right for the way people work today?

Are there old sharing decisions that should have been cleaned up a long time ago?

Businesses should be asking all of these questions anyway. Copilot just gives you a pretty good reason to stop putting them off.

I’d clean up the environment first and introduce Copilot second.

Before you focus on what Copilot can do, make sure you know what information is already there and who can get to it.

A computer going down in an office is frustrating.

Technology going down in a care facility can affect an entire team and the people they're responsible for.

Staff may rely on technology to access resident information, communicate with each other, manage schedules and complete essential parts of their work. If a critical system becomes unavailable, the impact can move through the organization quickly.

That's why IT planning for care organizations needs to start with a different question:

What does your team need to keep working when something goes wrong?

That means understanding which systems are most important, keeping technology maintained, planning for recovery and making sure there is a clear path forward if something becomes unavailable.

Our team has worked with care and non-profit organizations for many years, so we understand the budget realities these organizations operate within as well as the responsibility they carry.

Technology decisions have to account for both.

When a business pays a monthly fee for managed IT, what should that fee include?

It's a fair question, especially when the most visible part of IT is usually what happens when someone needs help.

Troubleshooting is part of the job, but managed IT goes much further than that. There's security to manage, Microsoft 365 to maintain, vendors to coordinate with, systems to monitor, technology decisions to work through, and future needs to plan for.

It also means having someone who understands how all of those pieces fit together. If your internet provider makes a change, Microsoft 365 needs attention, or you're considering new software, you have someone who understands your environment and can help you look at the bigger picture.

Managed IT isn't only about what happens when something goes wrong. A lot of its value is in the work that helps keep things running in the first place.

If you're evaluating an IT provider, that's important to ask.

We see a lot of businesses that don’t find the gaps in their Microsoft 365 security until an attacker gets in.

Some businesses come to us with an IT provider already in place. Others don’t have one at all. Either way, we’re often having this conversation after something has already happened.

Microsoft 365 comes with security tools, but how they’re set up can vary a lot from one business to another.

There isn’t one setting that fixes everything. Some businesses need Conditional Access, location restrictions, tighter permissions, or a mix of all three.

It really depends on how the business works. A team logging in remotely from different locations may need a different setup than one that usually works from the same office

You want to know where the weak spots are before an attacker finds them first.

If you use Microsoft 365, when was the last time someone reviewed how it is actually configured?

We see business owners and managers choose a new software tool that promises to solve an operational headache, but six months after buying it, the team is struggling with workarounds and unexpected costs.

Software demos always show you the ideal setup. If you want to protect your budget and keep operations running smoothly, ask these five practical questions before adding new technology to your business:

1. Will it play nice with our existing tools?

If new software can’t connect easily with your current programs, your staff will end up re-keying the data manually. Choose platforms that share information without needing fragile, custom fixes.

2. What will it really cost?

Look past the sticker price per user. Think about setup fees, data migration, staff training time, and any essential security or backup add-ons required to protect your business data.

3. Where does our data live?

Data privacy matters. Storing client records on foreign-owned cloud platforms means foreign laws can still apply, even if servers sit locally. Keeping sensitive records on Canadian infrastructure can make it easier to manage where your data lives and which laws apply to it.

4. How easy will this be for our team to use every day?

If a tool is too complex, your staff will find ways to bypass it or go back to old habits. Technology should make the work easier, not give your team another thing to fight with.

5. Who steps in when something goes wrong?

Putting all your faith in automated help centres or generic support tickets during a system outage is stressful. Make sure you have a dedicated technology partner who already understands your setup and can keep your business moving forward.

New technology should solve a problem, not create three more. A partner who knows your business can help you figure out what’s worth adding and what isn’t.

If your business handles personal information, privacy laws apply to how you collect, use, and protect it. In BC, that usually means P**A, while PIPEDA applies in certain federal and cross-border situations.

PIPEDA stands for the Personal Information Protection and Electronic Documents Act. The law is long, but the responsibility is pretty straightforward: if your organization collects personal information, you’re responsible for protecting it.

When you strip away the legal jargon, complying with PIPEDA comes down to three practical business habits:

1. Transparency and Consent. Be clear about why you are collecting personal information and make sure you have the appropriate consent to collect and use it.
2. Minimal Collection and Retention. Only collect the information you need for the purpose you’ve identified.
3. Enforcing Appropriate Safeguards. This is where technology directly impacts compliance. The law explicitly mandates that personal data must be protected by security safeguards appropriate to its sensitivity.

A privacy policy posted on your website isn’t enough on its own. To meet standard privacy requirements, your business also needs operational controls in place:

- Enforced access controls: Ensuring only authorized staff can view sensitive records.
- Multi-Factor Authentication (MFA): Preventing unauthorized logins across workplace accounts.
- Tested off-site backups: Keeping records secure and recoverable in case of system failure.
- Data Sovereignty: Knowing where client data is stored and which jurisdiction applies to it. Hosting data on Canadian infrastructure, like our Nanaimo data centre, gives local clients greater control over where their information resides.

Privacy compliance also shows clients that you take their information seriously and handle it with care.

If you’re not sure whether your current safeguards are enough, we can review your setup and show you where the gaps are.

Having a cyber insurance policy is no longer the safety net many business leaders assume it to be.

Insurance carriers across Canada are tightening their requirements. When a security incident occurs, insurers don’t just ask what happened, they also verify whether the security controls agreed upon during your policy application were active.

When those controls are missing, a business can find out too late that its claim isn’t covered:

- The City of Hamilton, Ontario: Faced a denied claim of roughly $5 million following a ransomware attack because multi-factor authentication (MFA) was not fully implemented as expected.

- A BC Law Firm: Faced a ransomware demand exceeding US$150,000 after failing to resolve network vulnerabilities identified during an earlier insurance assessment. Because the firm did not have cyber coverage in place, it had to handle the attack on its own.

The trouble starts when what a business says it has in place on an insurance questionnaire doesn’t match what’s actually running in its environment. That gap can be enough to put a claim at risk.

Data privacy is another part of the risk conversation. Your data may be sitting on a server in Canada, but if your cloud provider is subject to U.S. jurisdiction, that data could also be subject to U.S. legal access requirements.

Keeping data on Canadian soil under Canadian law is why we operate our own data centre right here in Nanaimo.

Before your next policy renewal, make sure you can answer these questions:

- Backups: Do we have off-site backups, and when were they last tested?
- Recovery: Exactly how long would it take to restore our workstations and operations if an attack occurred?
- Authentication: Is multi-factor authentication enforced on every critical system without exception?
- Incident Response: Who does our team call immediately if suspicious activity is spotted on a weekday morning?
- Location: Where does our sensitive client data live, both physically and legally?

If you’re not sure how to answer any of these answers, sort them out before your next renewal or before an incident makes the decision for you.

Read our article and law firm case study here:

🔗 https://intraworks.ca/law-firm-ransomware-attack-mbc-law/