IT Documentation for a Small Business: What to Write Down

Why a small business needs IT documentation

In most small businesses, the knowledge of how IT is set up lives in one person's head: the founder, an office manager, or a freelancer who set things up years ago. That works until the person is on leave, leaves the company, or the freelancer stops replying. Then simple jobs become emergencies:

• Nobody knows who the domain is registered with, and it is about to expire.
• The only Microsoft 365 or Google Workspace admin has left.
• The website host sends a renewal invoice and nobody knows if the site is still on it.
• A laptop is stolen and nobody can say what was on it or whether it was encrypted.
• A new IT provider spends paid hours rediscovering what you already have.

Documentation also helps with formal requirements. CSA's Cyber Essentials mark asks organisations to keep an up-to-date inventory of hardware and software, including cloud services, and a network diagram. If you ever apply for the mark, most of the groundwork is the document below.

The one-page system map

Start here. One table, one row per system. If you only write one thing, write this.

The business owner is the person who decides whether you still need the system and approves spending. The admin is who can change settings. They are often different people, and both should be written down. Our guide to admin account best practice explains why every important system should have two admins.

Vendors, contracts and renewal dates

For each vendor, record enough to contact them and cancel or renew without hunting through old emails.

Put renewal dates in a shared calendar as well, with a reminder a month before. Domains and SSL certificates that lapse cause outages, and some services delete data shortly after an unpaid renewal.

Admin accounts: record where they are, not the passwords

For each important system, record:

• who the admins are, by name and role, with at least two per system;
• whether the admin account is a named person's account or a shared admin address;
• how multi-factor login is set up, and where backup or recovery codes are stored;
• any emergency (break-glass) admin account and where its credentials are sealed;
• what to do when an admin leaves: which accounts to remove and which to hand over.

This is the section that makes leaver days and IT provider changes painless. If shared logins are currently passed around on WhatsApp or in a spreadsheet, moving them into a password manager first makes the document much shorter.

Devices and network: what to record

Cyber Essentials lists the details an asset inventory should contain where available. For a small office, a simplified version is enough.

Add a simple network diagram: internet line to router, router to switch and Wi-Fi, which devices are wired. A hand-drawn sketch photographed into the document is better than nothing.

Backup and restore steps someone else can follow

Writing down that backups exist is not enough. Write how to get data back, in steps another person could follow during a bad day.

1. 1

   List what is backed up and where

   For example: Microsoft 365 mailboxes and OneDrive to a third-party backup service; accounting data in the cloud provider; website files and database to off-site storage.

2. 2

   Record frequency and retention

   How often each backup runs (daily, weekly) and how long copies are kept.

3. 3

   Write the restore steps

   Which console to log in to, which vault holds the login, and the clicks to restore one file, one mailbox and the whole website.

4. 4

   Name who can do it

   At least two people, or your IT provider, with their contact details.

5. 5

   Test and log it

   Restore a file and a mailbox as a test, and note the date and result. Cyber Essentials gives at least twice a year as good practice for testing backups.

Our guide to backing up Microsoft 365 and Google Workspace explains why the built-in recycle bins are not a backup.

Incident contacts, storage and who updates it

Finish with a one-page incident sheet: who to call if email is hacked, the website is down or a laptop is stolen, plus your IT provider, bank fraud line, ISP fault line and the SingCERT address. Keep it short enough to read under pressure.

Store the documentation where the right people can reach it even if your main systems are down: for example, in the password manager's secure notes plus a printed copy in the office safe. A copy that lives only in the Microsoft 365 account you cannot get into is no help.

The Cyber Essentials (2025) certification document gives the review intervals as good practice: hardware and software inventories at least twice a year, business-critical data inventories and the incident response plan at least annually.

Do it yourself or get help?

Any organised person can write the first version in an afternoon using the headings above. The hardest part is usually tracking down admin logins and accounts held in former staff or agency names. Our IT support cost guide explains what to expect if you hand ongoing IT to a provider.

If shared logins are scattered, our Password Manager Rollout (S$290) sets up Bitwarden or 1Password in your name with shared vaults by team, moves old passwords in and adds a leaver checklist, which gives the documentation a safe home. For a one-off tidy-up, such as confirming who holds your domain or adding a second admin, a Quick Fix (1 hour) (S$119) covers a small, well-defined task.