The short answer
A business of 10 to 20 staff needs five things from its IT:
- A help desk staffed by people who know your setup
- Microsoft 365 set up with sensible permissions
- Security basics, starting with multi-factor authentication
- Backups kept separately, with restores tested
- Laptops and phones managed the same way
Most businesses this size skip an on-site server, a full-time IT hire and enterprise security tools. Managed IT is usually the simplest way to get the five covered, because one team is accountable for all of them.
Key statistics
| Figure | What it measures | Source |
|---|---|---|
| $56,600 | Average self-reported cost of a cybercrime report for an Australian small business in 2024-25, up 14% | ASD Annual Cyber Threat Report 2024-25 |
| 84,700 | Cybercrime reports made to ASD in 2024-25, about one every six minutes | ASD Annual Cyber Threat Report 2024-25 |
| 99.2% | Drop in the risk of account compromise once multi-factor authentication is switched on | Microsoft Research |
| 88% | Share of breaches at small and medium businesses where ransomware was present, against 39% at larger organisations | Verizon 2025 Data Breach Investigations Report |
When does a small business need proper IT support?
Usually somewhere between 10 and 20 staff, when there are too many accounts, devices and licences for one person to manage on top of their real job.
You will know the point has arrived when:
- Problems start costing hours every week
- Nobody is sure whether the backups would restore
- Clients, insurers or tenders start asking security questions
- New starters wait days for a laptop and accounts
What IT does a 10 to 20 person business need?
Five things: a help desk, a well set up Microsoft 365, security basics, tested backups and consistent device management.
| What you need | What it covers | Why it matters |
|---|---|---|
| Help desk | Phone and email support from someone who knows your setup | Staff get back to work faster |
| Microsoft 365 | Email, Teams, SharePoint and OneDrive with sensible permissions | Files are shared safely and licences are not wasted |
| Security basics | MFA, patching, endpoint protection and email filtering | Closes the most common ways attackers get in |
| Tested backups | Microsoft 365 and key files backed up separately, with restores tested | You recover from deletion, failure or ransomware |
| Device management | Laptops and phones set up the same way and kept up to date | New starters are ready on day one and leavers are locked out |
How much cyber risk does a small business face?
More than most owners expect. Small businesses get hit by the same automated attacks as large firms, with fewer people watching for them.
- ASD received 84,700 cybercrime reports in 2024-25, about one every six minutes (ASD).
- The average self-reported cost was $56,600 per report for a small business, up from $49,600 the year before, and $97,200 for a medium one (ASD).
- Ransomware was present in 88% of breaches at small and medium businesses in the Verizon 2025 report, against 39% at larger organisations (Verizon DBIR).
- Legal, accounting and management services firms notified 81 data breaches to the OAIC in 2025 (OAIC).
What cyber security does a small business need first?
Start with six steps. Multi-factor authentication alone cuts the risk of account compromise by 99.2%, according to Microsoft Research.
- Turn on multi-factor authentication for every Microsoft 365 account, admins included. It still cuts risk by 98.56% when a password has already leaked, and the same study found an authenticator app protects better than SMS codes.
- Patch automatically, so laptops, Windows and apps update without anyone having to remember.
- Protect every device with endpoint protection someone is watching.
- Filter email to stop most phishing and invoice fraud before staff see it.
- Back up Microsoft 365 and key files separately from the systems they protect, and test a restore.
- Limit admin rights, so day-to-day accounts cannot install software or change settings.
These steps map to the Essential Eight, the Australian Signals Directorate's baseline, and they are what insurers and clients usually ask about first.
How should a small business set up and remove staff accounts?
Use the same checklist every time someone starts or leaves. Nothing gets missed, and former staff lose access the day they go.
- Before day one: create the Microsoft 365 account with multi-factor authentication, and assign only the licences and access the role needs.
- Prepare the laptop: enrol it in device management so security settings, updates and apps apply automatically.
- On day one: walk the new starter through how to get IT help and how to spot a phishing email.
- When someone leaves: block sign-in the same day, transfer their files and email, wipe or recover the device, and remove the licence.
What IT can a small business skip?
Most 10 to 20 person businesses skip an on-site server, a full-time IT hire and enterprise security tools without losing anything.
- An on-premises server, unless specific software needs one. Most businesses this size run well on Microsoft 365 and cloud apps.
- A full-time internal IT hire. There is rarely enough work, and one person cannot cover security, networks and the help desk alone.
- Enterprise security tools built for large organisations. The basics, done consistently, matter more.
- Replacing hardware on a fixed timetable. Replace it when it is slowing people down.
Managed IT, break-fix or doing it yourself: which suits 10 to 20 staff?
For most businesses of 10 to 20 staff, managed IT works out simplest. One team is accountable and the security basics stay in place.
| Managed IT | Break-fix | Doing it yourself | |
|---|---|---|---|
| How it works | Ongoing support and monitoring for a monthly fee | Pay per job when something breaks | A staff member handles IT on top of their role |
| Security | Managed as part of the service | Usually only when asked | Depends on what that person knows |
| Cost pattern | Predictable monthly cost | Unpredictable, spikes when things fail | Hidden in lost staff time |
| Best for | Businesses relying on IT every day | Very small, simple setups | Teams of a handful of people |
Read more in our guide to what a managed service provider is.
What are the signs you have outgrown your IT setup?
If two or more of these sound familiar, your IT needs someone accountable for it.
- The same problems keep coming back
- Nobody is sure whether the backups would restore
- One person holds every password and is the only one who knows how things work
- New starters wait days for a laptop and accounts
- A client, insurer or tender asked a security question you had no answer for
- Staff lose time to IT every week
How do you get started with managed IT?
List what you have, check the basics, get an assessment, then compare providers on the same questions.
- List what you have: staff, devices, Microsoft 365 licences and the software the business depends on.
- Check the basics: is multi-factor authentication on for everyone, and when was a backup last restored?
- Get an assessment: a provider reviews your setup and tells you what needs attention.
- Compare providers on the same questions: our guide on how to choose an MSP in Sydney has a 12-question checklist.
How does Elscomm support smaller teams?
Teams from around ten staff are welcome. One small team runs your help desk, Microsoft 365, devices and security, so you deal with people who know your setup. If a managed arrangement is more than you need, we will say so.
Our free assessment includes a Microsoft 365 security check showing the gaps worth fixing first. See our small business IT support page for more.
- Since 2006: supporting Sydney businesses from North Sydney.
- 5.0 from 89 Google reviews: every review public and verifiable.
- Live satisfaction score: every support ticket is scored by the person who raised it, and the result is published on our reviews page.
- Help desk: Monday to Friday, 8am to 5pm, with security monitored 24/7.
- 90-day promise: three measurable improvements in your first 90 days, or we keep working free until you see them.
Frequently asked questions
Does a 10 person business need IT support?
Usually, yes. At 10 staff you already have enough accounts, devices and licences for things to slip, and the same automated attacks reach you as reach large firms. What you need is someone accountable for the basics, even if the arrangement stays small.
Should a small business hire an IT person or use a managed provider?
For 10 to 20 staff, a managed provider usually fits better. There is rarely enough work for a full-time hire, and one person cannot cover security, networks and the help desk alone.
Does a small business need a server?
Most do not. A business of 10 to 20 staff runs well on Microsoft 365 and cloud apps. Keep an on-premises server only if specific software requires one.
What cyber security does a small business need?
Six things first: multi-factor authentication on every account, automatic patching, monitored endpoint protection, email filtering, separate backups with tested restores, and limited admin rights. All six map to the Essential Eight.
How effective is multi-factor authentication?
Microsoft Research found it cuts the risk of account compromise by 99.22% overall, and by 98.56% when the password has already leaked. Authenticator apps performed better than SMS codes in the same study.
What is the Essential Eight for a small business?
It is the Australian Signals Directorate's baseline of eight controls: patching applications, patching operating systems, multi-factor authentication, restricting admin privileges, application control, restricting Microsoft Office macros, user application hardening and regular backups. Insurers and clients often ask about it by name.
How much does cybercrime cost a small business in Australia?
The average self-reported cost was $56,600 per report in 2024-25, up 14% on the year before, according to ASD. For a medium business it was $97,200.
How do I know if my Microsoft 365 is secure?
Start with two checks. Is multi-factor authentication on for every account, admins included? Is Microsoft 365 backed up separately, and has a restore been tested? Our free assessment includes a Microsoft 365 security check showing the gaps worth fixing first.
When should a small business switch to managed IT?
When two or more of the warning signs apply: recurring problems, untested backups, one person holding every password, slow onboarding, a security question you had no answer for, or staff losing time to IT every week.
Does Elscomm support businesses with around 10 staff?
Yes. Teams from around ten staff are welcome, and if a managed arrangement is more than you need, we will say so.
Sources
- ASD Annual Cyber Threat Report 2024-25: report volume, cost per report by business size, year-on-year change, the Essential Eight
- OAIC, data breach notifications 2025: 81 notifications from legal, accounting and management services
- Verizon 2025 Data Breach Investigations Report: ransomware in 88% of small and medium business breaches, 39% at larger organisations
- Microsoft Research, How effective is multifactor authentication at deterring cyberattacks?: 99.22% and 98.56% risk reduction, authenticator apps against SMS
Published 10 November 2026. Last edited 10 November 2026.