# eTop Technology — Full Site Content > Managed IT services, cybersecurity, and compliance solutions for established businesses across Southern California, anchored in the Inland Empire. Based in Redlands, serving law firms, manufacturers, engineering firms, construction companies, and nonprofits. 611 W Redlands Blvd # G, Redlands, CA 92373 | (951) 398-0021 | info@etoptechnology.com Index version: https://etoptechnology.com/llms.txt --- # Managed IT Services for Growing Inland Empire Businesses URL: https://etoptechnology.com/managed-it-services/ Type: Service ## What Managed IT Services Include When you partner with eTop Technology, you get a complete IT department — without the headcount, hiring challenges, or overhead. Here's what's included: ### Proactive Monitoring & Maintenance We monitor your entire IT environment 24/7 — servers, workstations, network equipment, and cloud services. When something starts to go wrong, we catch it and fix it before it becomes a problem. Patch management, firmware updates, and system maintenance happen on a schedule, not when things break. ### Help Desk & User Support Your team gets direct access to our help desk for day-to-day IT support. Password resets, software issues, email problems, printer nightmares — we handle it all. Every request is triaged and dispatched using a rigorous methodology that prioritizes based on urgency and business impact, so critical issues get immediate attention and nothing falls through the cracks. ### Vendor Management Dealing with your ISP, phone provider, software vendors, and hardware suppliers shouldn't be your job. We manage all your technology vendors, handle escalations, and coordinate projects so you don't have to sit on hold. ### Strategic IT Planning & vCIO Every managed IT client gets quarterly business reviews, a technology roadmap aligned to business goals, and access to virtual CIO-level guidance. We help you plan IT budgets, evaluate new technology, and make strategic decisions about your infrastructure. ### Patch Management & Security Updates Every device in your environment stays current with the latest security patches and updates. We test updates before deploying them to prevent compatibility issues, and we handle the entire process so your team never has to think about it. ### Device Lifecycle Management From procurement to deployment to retirement, we manage the full lifecycle of your devices. We'll recommend the right hardware, configure it to your standards, deploy it to your team, and securely decommission it when it's time. ## How We're Different From Other MSPs Plenty of IT providers measure success by how fast they close tickets. We measure it by how rarely you need to open one. Here's what that looks like in practice: **Security is the foundation, not an add-on.** Every client environment is built with SOC monitoring, endpoint detection, conditional access, and zero-trust principles as standard. You don't pay extra for security — it's how we operate. **We limit our client count intentionally.** We keep our client count manageable so every organization gets a dedicated team that knows their environment, their people, and their business goals — depth over headcount, on purpose. **Strategy is part of the service.** We don't just keep the lights on. We help you make technology decisions that drive business outcomes — from IT budgeting and roadmapping to evaluating new solutions and planning for growth. **Automation makes us faster and more consistent.** We use purpose-built automation to handle routine tasks with speed and precision. That means faster onboarding, more consistent configurations, and an IT operation that scales with your growth. ## Who We Work Best With Our managed IT services are designed for: - Established Inland Empire organizations that depend on technology working - Businesses that have outgrown their single IT person or break-fix provider - Companies handling sensitive data that require security-first IT - Organizations in regulated industries needing compliance support - Growing businesses that need strategic IT guidance, not just a help desk ## Frequently Asked Questions **What are managed IT services?** Managed IT services means an outside IT company takes ongoing responsibility for your technology for a predictable monthly fee. That covers 24/7 monitoring, patching, help desk support, security, vendor management and IT planning. Instead of paying someone after something breaks, you pay a provider to keep it from breaking. eTop Technology provides managed IT services to Inland Empire businesses from our office in Redlands, California. **What is included in managed IT services?** With eTop, managed IT includes 24/7 proactive monitoring and maintenance of servers, workstations, network equipment and cloud services; a help desk for day-to-day user support; patch management and security updates; vendor management, so we deal with your internet, phone and software vendors; device lifecycle management; and strategic IT planning with a virtual CIO. Security is built into the design rather than sold as an add-on. **When should a business hire a managed IT provider?** Usually when IT stops being a side job. Common signs: one person (often the owner or office manager) is fixing computers instead of doing their real work; problems keep coming back; a cyber-insurance questionnaire or client security review asks for controls you can't document; or you're planning growth with no technology plan behind it. The size of the team matters less than how much your business depends on technology working. **What's the difference between managed IT and break-fix?** Break-fix means you call someone when something breaks and pay per incident. Managed IT is a proactive, subscription-based model where we monitor, maintain, and secure your systems continuously — preventing problems before they impact your business. It's the difference between going to the doctor only when you're sick versus having ongoing preventive care. **How quickly do you respond to issues?** Every ticket is triaged immediately and dispatched based on urgency and business impact. Critical issues get immediate attention, and our 24/7 monitoring ensures we catch infrastructure problems around the clock. We don't publish generic SLA numbers — we prioritize based on what actually matters to your business. **Do we lose control of our IT if we outsource to you?** No — you gain control. We provide full transparency through regular reporting, quarterly business reviews, and a dedicated team you can reach directly. You make the strategic decisions; we execute and advise. **What size company is this for?** Our sweet spot is established teams — typically anywhere from about 15 users up through several hundred. Below that, fully managed IT may be more than you need; above that, our ZenTop managed automation offering may be a better fit. Either way, ask us. The size of your team matters less than how much your business depends on technology working. --- # Cybersecurity Services for Inland Empire Businesses URL: https://etoptechnology.com/cybersecurity-services-inland-empire/ Type: Service ## What's at Stake [IBM's 2025 Cost of a Data Breach report](https://www.ibm.com/reports/data-breach) puts the global average at $4.44 million — and over $10 million for breaches in the United States. Those averages skew toward large enterprises, but don't let that comfort you: scale the numbers down to a mid-size business and the proportions hold, once you stack regulatory fines, client lawsuits, and the reputational damage that nobody puts on a spreadsheet but everyone feels. Most SMBs that take a real hit never fully recover. Some hold on, but they spend the next two years explaining what happened instead of growing the business. We've helped businesses claw back from this and we'd much rather help you avoid it in the first place. The question isn't whether your business is on someone's target list. It's whether you've made yourself an expensive target instead of a cheap one. ## Our Cybersecurity Stack There is no one product called "security." Anyone selling you that is selling you a sticker. What actually works is a layered defense — multiple tools, configured to back each other up, watched by people who know what "normal" looks like for your environment. Here's what we put in place: ### SOC/SIEM Monitoring A 24/7 security operations center watching your network, endpoints, and cloud services in real time. When something weird happens at 2 AM — and it always seems to happen at 2 AM — the SOC is already triaging it before your phone rings. ### Endpoint Detection & Response (EDR) EDR (Endpoint Detection and Response) replaces traditional antivirus, which has been losing the arms race for about a decade. Instead of comparing files against a known-bad list, EDR watches behavior. If a process starts encrypting files in a weird order, or phoning home to an address it shouldn't know about, EDR catches it and contains it before the encryption finishes. That's the part that matters. ### Vulnerability Management We scan your network, applications, and endpoints regularly, prioritize what's actually exploitable, and remediate it. The deliverable is a fixed problem, not a 90-page PDF you'll never read. ### Email Security & Phishing Protection Advanced email filtering, link sandboxing, attachment analysis, and Microsoft 365 security hardening. Email is still the #1 attack vector — about two-thirds of incidents start there — so this is where your defense needs to be loudest. ### Security Awareness Training Your employees are either your first line of defense or your biggest hole. We run continuous training plus simulated phishing — monthly, not the once-a-year compliance video everyone clicks through during lunch. The goal isn't to shame people who fail a test. It's to build the muscle memory to pause and verify. ### Conditional Access & Zero Trust Microsoft Intune device management, conditional access policies, and MFA (multi-factor authentication) enforced everywhere it can be enforced. The model is simple: the right person, on a known device, in an expected location, gets in. Anything that doesn't match has to prove itself. We lean into this hard because identity is where most modern attacks actually win or lose. ## Who This Is For Our cybersecurity services are designed for: - Established businesses handling sensitive data - Organizations in regulated industries (legal, healthcare, financial) - Companies that have lived through a breach or near-miss and don't want a sequel - Businesses that want security treated as a baseline, not a paid add-on - Organizations applying for cyber insurance and trying to meet the new control requirements without panicking ## Frequently Asked Questions **How is this different from just having antivirus software?** Antivirus is one layer of protection — and an increasingly ineffective one on its own. Modern threats use techniques that bypass traditional antivirus entirely. Our approach combines multiple layers: SOC monitoring watches for threats across your entire environment 24/7, EDR uses behavioral analysis to catch what antivirus misses, and conditional access policies prevent unauthorized access even if credentials are compromised. It's the difference between a deadbolt and a full security system with cameras, monitoring, and armed response. **We're a small business — are we really a target?** Yes. [Verizon's 2025 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) found ransomware involved in 88% of breaches at small and mid-size businesses — versus 39% at large enterprises — precisely because smaller organizations tend to have weaker defenses. Attackers use automated tools that scan for vulnerabilities indiscriminately; they don't check your revenue before launching an attack. **What happens when a threat is detected?** Our SOC team follows a defined incident response process: detect, contain, eradicate, and recover. For critical threats, containment happens automatically within seconds. You'll be notified with clear communication about what happened, what was done, and what (if anything) you need to do. **Do we need this if we already have cyber insurance?** Cyber insurance and cybersecurity work together — insurance doesn't prevent breaches, and increasingly, insurers require specific security controls (like MFA, EDR, and SOC monitoring) as conditions of coverage. We help you meet those requirements so your policy actually pays out when you need it. **How much does this cost?** Cybersecurity services are typically bundled into our managed IT agreements, priced per user per month. The exact cost depends on your environment size and complexity. We're happy to provide a quote after a brief assessment — contact us to get started. --- # Compliance & Regulatory IT Services URL: https://etoptechnology.com/compliance-it-services/ Type: Service eTop Technology helps businesses in the Inland Empire build IT environments that meet regulatory requirements from day one, so you can focus on passing audits, not panicking before them. ## Compliance Frameworks We Support ### CIS Critical Security Controls (v8.1) The CIS Controls are a prioritized, framework-agnostic set of 18 safeguards published by the Center for Internet Security — the de facto security baseline that maps cleanly onto most regulations and cyber-insurance questionnaires. We assess your environment against the Implementation Group (IG1–IG3) that fits your size and risk profile, close the gaps, and keep the evidence audit-ready. ### FTC Safeguards Rule Updated in 2023, the FTC Safeguards Rule now requires a broad range of non-banking "financial institutions" to implement comprehensive information security programs. We help you meet every requirement. ### WISP (Written Information Security Program) Many states and industries require a documented information security program. We don't just help you write the document — we build the infrastructure and processes that make it real. ### Other frameworks We also support industry- and sector-specific requirements — including HIPAA for organizations that handle protected health information, along with state privacy laws and contractual security obligations — mapped back to the same CIS-aligned baseline. ## How We Approach Compliance ### 1. Assess We start with a thorough risk assessment of your current IT environment against the specific compliance framework(s) you need to meet. You get a clear, prioritized gap analysis. ### 2. Remediate We build or modify your IT infrastructure to close the gaps: access controls, encryption, audit logging, backup procedures, device management, and security policies. ### 3. Document We help develop the policies, procedures, and documentation that auditors and regulators need to see. This includes your security program documentation, incident response plans, and evidence of ongoing compliance. ### 4. Maintain Compliance isn't a one-time project. We provide ongoing monitoring, regular assessments, and continuous improvement to keep you compliant as regulations evolve. ## Frequently Asked Questions **No single regulation applies to us — do we still need this?** Almost certainly. The CIS Critical Security Controls are a framework-agnostic baseline that maps to nearly every regulation and cyber-insurance questionnaire, so meeting them puts you ahead regardless of which rules apply. On top of that, the FTC Safeguards Rule now covers a broad range of businesses, many state privacy laws are expanding, and your clients and partners increasingly require security documentation as a condition of doing business. **Can our current IT provider handle compliance?** Possibly — and the way to find out is to ask. Compliance requires specific technical controls, documentation practices, and ongoing monitoring that go beyond standard IT support. A fair question for any provider: which technical safeguards are implemented in our environment today, and where's the documentation? If the answer is clear and specific, you're in good hands. If it isn't, that's the gap we fill. **How long does it take to become compliant?** It depends on your starting point and the framework. A business with a reasonably modern IT environment might reach CIS Controls IG1 in 60–90 days. An organization starting from scratch with legacy systems could take 6+ months. The risk assessment gives us a realistic timeline. **What happens if we fail an audit?** The consequences vary by framework. FTC Safeguards violations can result in enforcement actions and consent orders. Beyond regulators, a security failure — or an unanswered insurance questionnaire — can cost you clients, contracts, coverage, and reputation. Prevention is always cheaper than remediation. --- # Microsoft 365 Business Premium — Deployed and Managed Right URL: https://etoptechnology.com/microsoft-365-management/ Type: Service ## What Most Businesses Get Wrong About Microsoft 365 We see it constantly: a business is paying for Microsoft 365 Business Premium but only using email and Word. Meanwhile: - Intune device management is not configured - Conditional access policies don't exist - MFA is optional or not enforced - Data loss prevention (DLP) rules aren't set - SharePoint has grown organically with no governance — nobody's sure who can see what - Email security is running on default settings - No backup exists for Microsoft 365 data (Microsoft doesn't back up your data for you — this surprises most people) This isn't a Microsoft problem. It's a configuration and management problem. And it's exactly what we fix. ## What Proper Microsoft 365 Management Looks Like ### Intune Device Management Every device that touches your data is enrolled, managed, and secured. We configure compliance policies, app protection, and remote wipe capabilities so a lost laptop doesn't become a data breach. ### Conditional Access Smart policies that control who can access what, from where, and on which devices. Logging in from an unmanaged device at a coffee shop? Access is limited. Logging in from your managed laptop at the office? Full access. Automatically. ### Email Security Hardening Advanced anti-phishing policies, safe links, safe attachments, DMARC/DKIM/SPF configuration, and impersonation protection. Email is your biggest attack surface — we lock it down. ### SharePoint & OneDrive Governance Proper structure, permissions, and sharing policies so your team can collaborate without accidentally exposing sensitive files to the world. ### Microsoft 365 Backup Third-party backup of your Exchange, SharePoint, OneDrive, and Teams data. Because Microsoft's retention policies are not a backup — and if data is deleted or encrypted by ransomware, Microsoft won't recover it for you. ## Frequently Asked Questions **We already have Office 365 — isn't that enough?** Having Office 365 and properly managing it are very different things. Business Premium includes device management, conditional access, and advanced threat protection — and in most environments we review, those features are sitting unconfigured while the business pays for them every month. **Does Microsoft back up our data?** No. Microsoft provides infrastructure uptime, not data backup. Their shared responsibility model clearly states that data protection is the customer's responsibility. If an employee deletes files, ransomware encrypts your SharePoint, or a departing employee wipes their account, Microsoft won't recover it. **What's the difference between Business Basic, Standard, and Premium?** Premium includes Intune device management, advanced threat protection, and Azure AD P1 features that are essential for security. We strongly recommend Premium for any organization serious about security. The cost difference is small compared to the risk reduction. --- # Business Continuity & Disaster Recovery URL: https://etoptechnology.com/business-continuity-disaster-recovery/ Type: Service ## What Would Happen to Your Business? Think about it seriously for a moment. If ransomware encrypted every file in your organization tomorrow morning: - How long before you could resume operations? - How much data would you lose? - Could you serve your clients? - Could you make payroll? - Would your business survive? If you can't answer those questions with confidence, you don't have a business continuity plan — you have a hope. ## Our BCDR Approach ### Backup Strategy We implement a multi-layered backup strategy that protects your data at every level: - **Local backups** for fast recovery of individual files and systems - **Cloud backups** for geographic redundancy and disaster protection - **Microsoft 365 backup** because Microsoft doesn't protect your cloud data - **Immutable backups** that can't be encrypted or deleted by ransomware ### Regular Testing A backup that hasn't been tested is a backup that might not work. We perform regular recovery tests to verify that your backups are complete, functional, and recoverable within your target timeframes. ### Recovery Procedures When disaster strikes, you don't want to be figuring out the plan. We document detailed recovery procedures, assign responsibilities, and ensure your team knows exactly what to do. Our goal is to minimize confusion and maximize speed during the most stressful moments. ### Documentation Every BCDR plan includes comprehensive documentation: recovery time objectives (RTO), recovery point objectives (RPO), contact lists, vendor information, step-by-step procedures, and communication templates. This documentation is reviewed and updated regularly. ## Who Needs Business Continuity Planning? Every business needs some level of BCDR planning, but it's especially critical for: - Organizations where downtime directly impacts revenue (manufacturing, professional services) - Businesses handling client data with contractual obligations (legal, financial, healthcare) - Companies with compliance requirements that mandate backup and recovery procedures - Any organization that relies on technology for daily operations — which today means everyone ## Frequently Asked Questions **How is this different from just having backups?** Backups are one component. Business continuity planning includes defining your recovery time objectives (RTO) and recovery point objectives (RPO), testing failover procedures, documenting response plans, and ensuring your team knows what to do when disaster strikes. A backup you've never tested is a hope, not a plan. **What's our risk of ransomware?** If you have employees who use email, your risk is significant. The [Verizon 2025 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) found ransomware involved in 88% of breaches at small and mid-size businesses — more than double the rate at large organizations. A strong BCDR plan is your last line of defense if an attack gets through your security layers. **How quickly can you restore our systems?** It depends on your BCDR plan configuration. For most of our managed IT clients, we can restore critical systems within hours, not days. We test recovery procedures regularly so there are no surprises when you need it most. --- # Co-Managed IT: Strategic Support for Your Internal IT Team URL: https://etoptechnology.com/co-managed-it-services/ Type: Service ## Why Co-Managed IT Makes Sense You've invested in a good internal IT person. They know your systems, your team, and your business. But the reality is that modern IT demands are too broad for any single person to handle alone: - **Cybersecurity** requires 24/7 SOC monitoring, threat detection, and incident response — that's a full-time job by itself - **Compliance** demands specialized knowledge of regulatory frameworks, documentation practices, and ongoing auditing - **Cloud infrastructure** like Microsoft 365 requires deep expertise to properly configure and manage - **Strategic planning** needs time for research, roadmapping, and vendor evaluation — time your IT person doesn't have when they're also the help desk Co-managed IT doesn't replace your internal team — it hands them the tooling, backup, and time to do the job they were actually hired for. ## What We Handle vs. What Your Team Handles ### eTop Handles: - 24/7 SOC security monitoring and threat response - Compliance management and documentation - Microsoft 365 configuration, security, and optimization - Complex infrastructure projects and migrations - Strategic IT planning, roadmapping, and vCIO guidance - Escalation support for issues beyond your team's expertise - Backup monitoring and disaster recovery testing - Vendor management for specialized technology ### Your IT Team Handles: - Day-to-day user support and help desk - Internal project management and coordination - Business-specific application support - Hardware management and onsite tasks - First-line troubleshooting - Relationship management with internal stakeholders ### We Share: - Documentation and knowledge management - Change management and communication - Technology evaluation and recommendations - Budget planning and forecasting ## How It Works **Step 1: Assessment.** We evaluate your current IT environment, understand your internal team's strengths and workload, and identify the gaps where we can add the most value. **Step 2: Design.** We build a co-managed agreement tailored to your specific needs — not a one-size-fits-all package. Some clients need primarily security monitoring; others need compliance support; others need strategic guidance. We design around your priorities. **Step 3: Onboard.** We integrate with your internal team, establishing communication channels, escalation paths, shared documentation, and regular check-in cadences. **Step 4: Operate.** We work alongside your team as an extension of their capabilities. Regular communication ensures alignment, and quarterly reviews keep the partnership evolving with your needs. ## Frequently Asked Questions **What is co-managed IT and how does it work?** Co-managed IT is a partnership in which your in-house IT person or team keeps running day-to-day support, and a managed service provider adds the specialized capacity they don't have: 24/7 security monitoring, compliance, complex infrastructure and escalation help. Responsibilities and escalation paths are agreed in writing up front, so both teams know who owns what. **What is the difference between co-managed IT and fully outsourced IT?** With fully outsourced (fully managed) IT, the provider is your entire IT department. With co-managed IT, you keep your internal IT staff and the provider fills specific gaps around them. Co-managed suits organizations that already have IT people but need depth in security, compliance or projects. Many of our fully managed clients started as co-managed. **How much does co-managed IT cost?** It depends on the number of users, which services your internal team hands off, and the complexity of the environment, so we scope and quote each arrangement individually. For most organizations it costs well below one more full-time hire once salary, benefits and overhead are counted. **Will you replace our IT person?** No. Co-managed IT is designed to augment your internal team, not replace them. We handle the specialized work (security monitoring, compliance, complex projects) so your IT person can focus on what they do best — supporting your team and understanding your business. **What if we eventually want to go fully managed?** Many of our fully managed clients started as co-managed. The transition is seamless because we already know your environment. There's no pressure — we'll support whatever model works best for your organization. **How does the handoff between our IT person and your team work?** We establish clear escalation paths and responsibilities upfront. Your IT person handles day-to-day support and internal projects. We handle security monitoring, compliance, complex infrastructure, and serve as their escalation point for issues beyond their expertise. --- # AI Consulting for Small and Mid-Sized Businesses URL: https://etoptechnology.com/ai-consulting-inland-empire/ Type: Service Most businesses we talk to are in one of two positions on AI, and often both at once. The first: nobody has approved anything, but the work is already happening. Someone in accounting is pasting figures into a chatbot to clean up a summary. Someone in sales is drafting proposals in a free tool that keeps a copy. It's not malicious and it's not stupid — it's people trying to get their work done faster, using tools that are genuinely good at it. But there's no policy, no visibility, and no decision on record about what's allowed to leave the building. The second: a license got purchased — often Microsoft 365 Copilot — and it's sitting there. Adoption is near zero. Nobody can point to a task it made materially better, and the invoice arrives every month regardless. Neither of those is an AI problem. Both are governance and configuration problems, which is ordinary IT work that happens to have AI attached to it. ## What We Do ### 1. AI Readiness and Governance Before anything gets deployed, you need an honest picture of the present. We identify which AI tools are actually in use across your environment, what categories of data are moving into them, and where your current configuration would let something sensitive walk out the door. From there we help you make the decisions that a policy is supposed to encode: which tools are approved, what data is off-limits, where human review is mandatory, and how new tools get evaluated instead of just appearing. Then we implement the technical side — tenant controls, data loss prevention rules, sensitivity labels, and logging that lets you see usage rather than assume it. ### 2. Copilot — or Whichever Agent Your Team Will Actually Use Copilot, Claude, ChatGPT, Gemini. We're not religious about which one you land on, and we'll help you deploy any of them. We use all of them ourselves, which is the honest reason we don't have a favorite to sell you. They are genuinely different tools. Copilot is the lowest-friction starting point if you're already on Microsoft 365 — your data lives there, the security model is one you already own, and it's strongest at "help me do what I'm already doing, faster." The general-purpose assistants tend to be better for research, long-form drafting, and thinking through a problem outside of Office. Most businesses that get real value end up with two sanctioned tools rather than one, and that's fine — what matters is that the choice was made deliberately and everyone knows what it is. Whichever you pick, the same unglamorous work comes first. Copilot inherits your existing permissions exactly — it doesn't grant new access, it makes existing over-permissioning obvious, fast. A SharePoint environment that grew organically over eight years, where "everyone" has quietly ended up with read access to a folder containing salary information, becomes a very uncomfortable demo on day one. The external assistants raise the mirror-image question: which business data is allowed to go in, under what account, on what plan, and with what retention. Both need answering before rollout, not after. So we audit and clean up sharing, get the tenant and the accounts configured properly, put the enterprise-tier agreements in place so your data isn't training anyone's model, and then deploy. Then comes the step most rollouts skip: sitting with your team and working through the specific tasks in their actual jobs where the tool earns its license. Adoption comes from a person seeing their own work get easier, not from a training video. ### 3. Custom AI Automation Some problems aren't solved by a product you can buy. Document-heavy intake, repetitive data entry between systems that don't talk, reporting that a person assembles by hand every month, correspondence that follows a predictable pattern — these are automation problems, and AI has made a lot of them tractable that weren't a few years ago. We scope these as normal projects: define the workflow, agree on what success looks like, build it, and hand over something documented that your team can operate. We'll also tell you when a build isn't warranted, which is often. A meaningful share of "we need AI for this" turns out to be a feature you're already licensed for, or a process that should be fixed before it's automated — you can't automate a process you don't have. ## Start With the Assessment Every engagement starts the same way, because advice without evidence is just opinion. The **AI Readiness Assessment** is a fixed-fee review that covers: - **What's in use now.** The AI tools your team has adopted, visible through Microsoft 365 audit data and your existing endpoint and network telemetry — not a survey asking people to self-report. - **Where data is exposed.** Which sensitive categories could move into an external model today, and which controls would stop it. - **Rollout readiness.** The state of your SharePoint and OneDrive permissions, what would need cleanup before turning Copilot on safely, and which agent — Copilot, Claude, ChatGPT — actually fits the way your team works. - **Policy and people.** What your acceptable-use position should be, and where training is genuinely needed versus where a technical control does the job better. - **Where it would actually pay.** The specific workflows in your business where automation is worth the effort — and, just as usefully, the ones where it isn't. You get a written findings document, a prioritized roadmap, a draft AI acceptable-use policy, and a readout call. Typically two to three weeks from kickoff to readout. The deliverables are yours regardless of what you decide to do next. ## Why Us We are not an AI consultancy that hands you a strategy and leaves before implementation. We're the IT provider that would have to implement it anyway — the same people managing your identity, your Microsoft 365 tenant, your endpoints, and your backups. That matters because nearly every real obstacle in an AI rollout is one of those things. Permissions that were never cleaned up. MFA that's enforced almost everywhere. Data with no classification. Licensing nobody has reconciled. Those get solved with administrative access and a change window, not a workshop. We also run these tools inside our own business every day — Copilot, Claude, ChatGPT, and self-hosted open models — for automation, documentation, and analysis. That's deliberate. It means our recommendations come from operating experience rather than a vendor deck, and it means we're not steering you toward the one platform we happen to resell. ## Frequently Asked Questions **Our people are already using ChatGPT. Is that a problem?** It's a normal situation, and it's fixable. The risk isn't the tool — it's that the free consumer tiers of most AI products can use what gets submitted to improve their models, and nobody in your business has decided what's allowed to go in. The first thing we do is find out what's actually in use and what kind of data is moving, because you can't write a sensible policy against a guess. **We're paying for Microsoft 365 Copilot but nobody uses it. Why?** Usually one of three reasons: it was never turned on properly, staff were never shown a task worth using it for, or it was switched on and immediately surfaced files people weren't supposed to see, so trust evaporated. That third one is the common failure. Copilot respects your existing SharePoint and OneDrive permissions exactly as they are — so if permissions have grown loose over the years, Copilot will faithfully show people that looseness. **Which AI tool should we standardize on?** It depends on what your team actually does, and for a lot of businesses the answer is two rather than one. Copilot is the natural fit if you're already on Microsoft 365 and the work is mostly inside Office — it's strongest at speeding up what people already do. A general-purpose assistant like Claude or ChatGPT tends to be better for research, drafting, and working through a problem. They're complementary more often than they're competing. We deploy and support all of them and use all of them internally, so we don't have a horse in the race — we'd rather help you pick correctly than sell you a preference. **Do we need an AI policy, or is that overkill for our size?** You need one, and it can be short. A workable AI acceptable-use policy fits on a page or two: which tools are approved, what categories of data must never be pasted into them, what has to stay reviewed by a human, and who to ask when it's unclear. The value isn't the document — it's that the decisions behind it have been made once, deliberately, instead of case by case by whoever is in a hurry. **Can you build something custom, or do you just configure vendor tools?** Both. Plenty of problems are solved by turning on capability you already pay for, and we'll tell you when that's the case rather than sell you a build. When the work genuinely calls for something custom — document processing, intake handling, pulling data out of a line-of-business system that has no reporting to speak of — we scope and build it. We run this kind of automation inside our own business, which is the main reason we're comfortable advising on it. **Isn't this what an AI consultancy does? Why an IT provider?** Because most of what makes an AI rollout succeed or fail is IT work. Identity and access, data classification, permission cleanup, tenant configuration, logging, licensing, endpoint controls. A strategy deck doesn't touch any of that. We're already the people who would have to implement it — starting there removes a handoff where a lot of AI projects quietly die. **What does the AI Readiness Assessment actually produce?** A written findings document covering what AI is in use today and where data is exposed, a prioritized roadmap of what to fix and in what order, a draft AI acceptable-use policy you can adapt, and a readout call to walk through all of it. It's a fixed fee, quoted up front, and you own the deliverables whether or not you engage us for the work that follows. --- # IT Services Built for Construction Companies URL: https://etoptechnology.com/it-services-construction-inland-empire/ Type: Industry The Inland Empire is one of the most active construction corridors in Southern California. From the massive warehouse developments along the I-10 and I-15 to residential builds pushing east through Beaumont and Banning, construction companies here are running complex, multi-site operations every single day. And the technology demands keep growing. Here's what makes construction IT different: your business doesn't sit in one building. You've got an office, maybe a warehouse, and then a rotating list of active jobsites that all need connectivity, security, and access to your systems. That's a fundamentally different IT challenge than supporting an accounting firm with 30 people in one suite. We get it. eTop Technology has been serving businesses across the Inland Empire for over 12 years, and we've built our approach around the reality that construction companies operate differently. ## The Real IT Problems Construction Companies Face ### Your Data Is Everywhere Project plans in Procore. Financials in Sage or QuickBooks. Contracts in email. Photos on someone's personal phone. Timesheets in yet another app. The average construction company has critical business data scattered across more systems than they realize. And when that data isn't connected, protected, and backed up properly, you're one ransomware attack or one stolen laptop away from a very bad day. We help construction firms get their arms around all of it. That means proper cloud strategy, backup that actually covers everything (not just whatever's on the server in the office), and security that extends to every device touching your data. ### Jobsite Connectivity Is Not Optional Anymore Ten years ago, the jobsite trailer had a fax machine and maybe a shared laptop. Today your superintendents are running project management software, reviewing BIM models (that's Building Information Modeling, basically 3D digital blueprints), pulling up specs on tablets, and video calling with architects. All of that requires reliable internet at locations that often don't have it. We deploy purpose-built connectivity solutions for construction sites. Cellular-based internet with failover, fixed wireless where it makes sense, and proper Wi-Fi coverage for the trailer and staging areas. When the site wraps up, we move the gear to the next one. ### Field Crew Devices Need Management Your project managers, superintendents, and foremen are carrying company phones and tablets that have access to project data, email, and sometimes financial systems. If one of those devices gets lost on a jobsite (and let's be honest, it happens), you need the ability to remotely wipe it before someone walks off with your bid numbers and client information. We use Microsoft Intune (Microsoft's device management platform) to manage and secure every device in your fleet. Phones, tablets, laptops. We can enforce security policies, push apps, and yes, remote wipe a lost device in minutes. Your team doesn't even notice the management layer is there until they need it. ## Multi-Location IT That Actually Works Running two offices, a yard, and six active jobsites means your IT provider needs to think like a network architect, not a break-fix shop. We design networks that connect your locations securely, give your people access to the systems they need from wherever they are, and maintain consistent security across the board. That warehouse in Fontana gets the same security monitoring as your headquarters in Upland. The superintendent in Hemet gets the same support experience as your office manager. Same Huntress EDR (endpoint detection and response, think of it as a 24/7 digital security guard) on every machine. Same 24/7 SOC (Security Operations Center) watching for threats. No gaps. ## Protecting What Matters Most Construction companies are increasingly targeted by cybercriminals. Wire fraud in particular has hit the construction industry hard. Attackers compromise email accounts and send fake wire transfer instructions that look like they're coming from a subcontractor or title company. Across the industry, a single fraudulent wire can run six figures. We implement email security controls specifically designed to catch these attacks. Advanced anti-phishing, domain authentication, and employee training that teaches your team to spot the red flags before they click. Because the best cybersecurity in the world doesn't matter if someone in accounting sends $200,000 to the wrong bank account. ## Bonding and Insurance Compliance Here's something a lot of construction firms don't realize until renewal time: your bonding company and your insurance carrier are starting to ask hard questions about your cybersecurity. Do you have multi-factor authentication? Do you have endpoint protection? Do you have documented backup procedures? If you can't answer yes to those questions, you're looking at higher premiums or potentially losing bonding capacity. We help construction companies build and document the security controls that satisfy these requirements. Not because we love paperwork, but because your bonding capacity directly affects your ability to bid on projects. ## Why Construction Companies Choose eTop We're based in Redlands, right in the heart of the IE construction corridor. We understand the pace, the complexity, and the no-nonsense attitude that construction professionals bring to everything they do. You don't want a 45-minute explanation of our security stack. You want your stuff to work, your data to be safe, and someone to pick up the phone when it doesn't. That's exactly what we deliver. Proactive IT management, serious cybersecurity, and real human support from a team that's been doing this for over a decade. ## Frequently Asked Questions **How do you keep jobsites connected when there's no permanent internet?** We deploy cellular failover solutions and fixed wireless options for temporary jobsites. For longer-term sites, we set up dedicated connections with redundancy so your project management tools, cameras, and communications stay online. This approach covers sites where traditional internet simply isn't available on day one — a common situation across the IE corridor. **Do you support construction project management software like Procore or Buildertrend?** Yes. We support and manage the major construction PM platforms including Procore, Buildertrend, PlanGrid, and others. We handle integration with your accounting systems, user management, and making sure your field crews can actually access what they need from a tablet on the jobsite. **What about compliance for bonding and insurance requirements?** Many bonding companies and insurance carriers now require documented cybersecurity controls. We help construction firms implement and document the security measures that satisfy these requirements, including data backup verification, access controls, and incident response plans. This protects your bonding capacity and keeps your insurance premiums from spiking. **How do you handle IT across multiple office locations and jobsites?** We build a unified management layer across all your locations. Same security policies, same monitoring, same support experience whether it's your main office in Rancho Cucamonga, your warehouse in Fontana, or a temporary jobsite in Riverside. One phone call gets you help anywhere. --- # IT Services for Engineering and Aerospace Companies URL: https://etoptechnology.com/it-services-engineering-inland-empire/ Type: Industry The Inland Empire has a significant and often overlooked engineering and aerospace presence. From defense contractors near March Air Reserve Base to precision engineering firms in Redlands, Ontario, and throughout the San Bernardino corridor, there are companies here doing serious technical work that demands serious IT infrastructure. If you're designing aircraft components, manufacturing defense systems, or engineering critical infrastructure, your IT can't be an afterthought. eTop Technology has been providing managed IT and cybersecurity in the Inland Empire for over 12 years. We work with companies where the stakes go beyond "my email is down." We're talking about the security requirements that come with defense-adjacent work and intellectual property that represents millions of dollars in R&D investment. This is IT where getting it wrong has consequences that go well beyond lost productivity. ## High-Performance Computing and Large File Workflows Engineering firms have IT demands that most businesses simply don't. Running SolidWorks, AutoCAD, CATIA, or Siemens NX on complex assemblies requires workstations with serious compute power and graphics capability. FEA simulations (Finite Element Analysis, the software that tests whether your design will actually hold up under stress) can peg a high-end workstation for hours. Then there's the file problem. A single complex assembly in SolidWorks can be hundreds of megabytes. Your team opens and saves these files dozens of times a day. If your network and storage infrastructure isn't designed for this workload, your engineers spend their $80-per-hour time watching progress bars. That's money you're lighting on fire. We design infrastructure specifically for engineering workflows: - **High-speed internal networks** that can handle the sustained throughput engineering files demand - **Storage architecture** optimized for large file access patterns, not the small-file workloads that typical office storage is designed for - **Workstation management** ensuring your engineering machines have the right specs, drivers, and configurations for your software stack - **GPU-accelerated rendering** support for firms that need visualization and rendering capabilities - **Backup systems** that can handle terabytes of project data without impacting performance during business hours ## Protecting Your Intellectual Property Your designs, processes, and engineering data represent years of work and millions of dollars in investment. Protecting that IP requires more than a firewall and antivirus. We implement comprehensive IP protection that addresses both external threats and insider risk: **Data Loss Prevention (DLP)** policies that prevent engineering files from being emailed to personal accounts, uploaded to unauthorized cloud services, or copied to USB drives without authorization. If an engineer tries to email a CAD file to their personal Gmail, the system blocks it and alerts us. **Huntress EDR** (Endpoint Detection and Response) on every workstation and server, monitored 24/7 by a Security Operations Center. If an attacker gets a foothold on one of your design engineer's machines, we detect it and respond before they can exfiltrate your data. **Network segmentation** that isolates your engineering data from general office systems. Your marketing team's compromised laptop shouldn't be a pathway to your controlled file shares. **Access reviews** on a regular cadence to make sure that former employees, former contractors, and people who've changed roles don't still have access to data they shouldn't. ## Why IE Engineering Firms Choose eTop We're based in Redlands, right in the middle of the IE's engineering and aerospace corridor. We understand that your IT partner needs to speak the language of compliance frameworks, handle the demands of high-performance computing, and treat your intellectual property with the same seriousness you do. Engineering IT is a specialty: walking into a firm, identifying the security gaps in its infrastructure, securing file sharing and intellectual property, and building a remediation plan that doesn't disrupt active projects. That's what we do. We've been doing it for over 12 years, and we'd welcome the chance to show you what that looks like for your firm. ## Frequently Asked Questions **How do you handle large CAD and engineering files without killing our network?** Engineering files are massive. A complex SolidWorks assembly or AutoCAD drawing can be hundreds of megabytes, and your team is opening and saving these all day. We design network and storage architectures specifically for high-throughput file workflows: local caching for frequently accessed assemblies, high-speed internal networks, and proper storage infrastructure that doesn't bottleneck when five engineers are all pulling large files at the same time. **How do you protect our intellectual property from theft?** IP protection is multi-layered: strict access controls so only the right people can access specific project data, DLP (Data Loss Prevention) policies that prevent files from being emailed or uploaded to unauthorized locations, endpoint security that detects and blocks exfiltration attempts, and monitoring that alerts us to unusual data access patterns. We also address insider threat with proper offboarding procedures and access reviews. --- # IT Services Built for Law Firms URL: https://etoptechnology.com/it-services-law-firms-inland-empire/ Type: Industry An attorney who bills $400 an hour and can't open case files is losing money by the minute — about $6.67 of it, every minute, per attorney. Run that across a ten-attorney firm during a half-day outage and the math gets uncomfortable fast. That's the real frame for law firm IT: it's not a back-office expense, it's the thing standing between your billable hours and a very quiet office. eTop Technology provides managed IT and cybersecurity for law firms in the Inland Empire. This isn't a vertical we added to a list: we support several firms today, in Redlands, Riverside, and Rancho Cucamonga, and much of what's on this page comes from their tickets, their outages, and their audits. ## Why Law Firms Need Specialized IT Law firms aren't like other businesses when it comes to IT. You deal with: **Ethical obligations** around client data protection that go beyond what most industries face. State bar associations increasingly require attorneys to understand and implement reasonable security measures for client data. **Document-intensive workflows** that demand reliable storage, version control, and secure collaboration — often with outside counsel, expert witnesses, and clients. **High-value targets** for cybercriminals. Law firms hold sensitive financial data, intellectual property, M&A details, and personal information that commands premium prices on the dark web. **Compliance requirements** that vary by practice area — healthcare law firms handling PHI (protected health information — medical records and anything tied to them) need HIPAA compliance, firms handling financial data need FTC Safeguards awareness, and all firms need to meet state bar technology competence requirements. ## How We Serve Law Firms - Secure email with advanced anti-phishing and encryption - Document management system support and secure file sharing - Mobile device management for attorneys working remotely or in court - Compliant backup and disaster recovery for client files - Security awareness training tailored to legal scenarios - Technology competence support for bar association requirements - Vendor management for legal-specific software (MerusCase, Clio, PracticePanther, NetDocuments, etc.) - Practice management integration support, including the Word and Outlook add-ins where most practice management tickets actually start - Microsoft 365 optimization for legal workflows ## Protecting Attorney-Client Privilege in the Digital Age Attorney-client privilege is only as strong as the systems protecting client communications. If your email can be intercepted, your file sharing is unsecured, or a stolen laptop can access your entire case management system, privilege is at risk. We build law firm IT environments with privilege protection as a core design principle — encryption in transit and at rest, conditional access policies, device management, and data loss prevention controls that ensure client information stays protected. ## What We've Actually Done for Law Firms A few examples, all from real engagements: - **A week-long power outage, and a firm that decided "never again."** When grid outages kept shutting down a Southern California firm's on-premises servers, we kept them running on a generator that week, then moved files, applications, and identity to Microsoft Azure in phases, without billing ever stopping. The full story is on our [case studies](/case-studies/) page. - **An AI tool built for a law firm, safely.** We built a records summarizer for a firm that needed to get through medical records faster, under five rules that kept client data where it belonged. [How we built it](/blog/ai-tools-we-build-for-clients-medical-records-summarizer/). - **MerusCase and Word that stopped fighting.** Across the firms we support, the most common practice management tickets are the same seam between cloud case management and desktop Word and Outlook. [Why it happens and how we fix it](/blog/meruscase-word-outlook-integration/). - **Remote access attorneys actually use.** Case files from court, home, or a client's office, without a VPN that breaks every other week. [Remote access for law firms](/blog/law-firm-remote-access-that-works/). ## Your Obligations, in Plain English California attorneys have a duty of technology competence: the comment to California Rule of Professional Conduct 1.1 says competence includes understanding the benefits and risks of the technology you use. The ABA has gone further in its formal opinions, including Opinion 477R on securing client communications and Opinion 483 on what firms owe clients after a data breach. What that means in practice for an Inland Empire firm: - **Reasonable security, documented.** MFA, encryption, managed devices, monitored email, and a written record that you did it. - **Knowing where client data lives.** Including the AI tools your staff may already be pasting client material into. - **A plan for when something goes wrong.** Who you call, what you tell clients, and how you get back to billing. Our [Cybersecurity & Compliance Guide for Inland Empire Law Firms](/blog/cybersecurity-compliance-guide-law-firms/) goes through each requirement, and there's a [PDF version](/downloads/cybersecurity-compliance-guide-law-firms.pdf) to share with your partners. ## When Things Go Wrong The problems we see most at law firms aren't exotic. They're the ones that stop billing: - [When your billing system goes down, you stop billing](/blog/when-your-billing-system-goes-down/) - [When an attorney leaves, what happens to the client files?](/blog/when-an-attorney-leaves-client-files/) - [Never click "Update" in your practice management software](/blog/never-click-update-practice-management/) - [How to protect your law firm from ransomware](/blog/law-firm-ransomware-protection/) ## AI in Your Firm Your staff are probably already using AI tools. The question is whether client material is going somewhere it shouldn't. We help firms find out what's actually in use, set a one-page policy, and give people a sanctioned tool inside the firm's own Microsoft environment. Read [Will AI replace lawyers?](/blog/will-ai-replace-lawyers/) for the practical version, or see our [AI consulting](/ai-consulting-inland-empire/) work. ## Frequently Asked Questions **How much does IT support cost for a law firm?** It depends on the size of the firm, how many offices and systems you run, and how much security and compliance work the firm needs. We quote each firm after a short assessment rather than publishing a rate card. The honest comparison isn't against doing nothing. It's against the cost of a breach, lost billable hours during downtime, and a malpractice or bar complaint over unprotected client data. **What should a law firm look for in a managed IT service agreement?** Look for plain answers to five things: exactly what the monthly fee covers and what is billed extra; how requests are prioritized and how fast critical issues are handled; who owns your data, passwords and documentation if you leave; which security controls are included (MFA, endpoint detection, backup with tested restores, email security); and whether the provider has worked with your practice management and document management systems. **Do you work with legal-specific software like Clio or PracticePanther?** Yes. We support and manage a range of legal practice management software including Clio, PracticePanther, NetDocuments, and others. We handle integration, optimization, and vendor coordination. **Can you help us meet state bar technology competence requirements?** Absolutely. State bars increasingly require attorneys to understand and implement reasonable security measures. We help law firms meet these obligations with documented policies, training, and properly secured infrastructure. **What happens if our firm experiences a data breach?** We have a defined incident response process: detect, contain, eradicate, and recover. For law firms, we also understand the ethical reporting obligations and can help you navigate the notification requirements specific to legal practices. **How do you handle document security and sharing?** We implement encrypted file sharing, proper SharePoint/OneDrive governance, DLP (data loss prevention — controls that stop sensitive files from being emailed or uploaded somewhere they shouldn't go), and secure external collaboration tools that protect client data while enabling the collaboration your practice requires. --- # IT Services for Manufacturing & Engineering Companies URL: https://etoptechnology.com/it-services-manufacturing-inland-empire/ Type: Industry The Inland Empire is full of manufacturing operations most people drive past without noticing — precision machining shops in Ontario and Rancho Cucamonga, food processors, packaging plants, and defense-adjacent suppliers feeding primes near March Air Reserve Base. Different products, same underlying truth: when the technology stops, production stops, and production stopping is measured in dollars per hour, not inconvenience. eTop Technology has been providing managed IT and cybersecurity in the Inland Empire for over 12 years, and manufacturing is one of the environments we know best. Your priorities aren't the same as a law office's. Uptime comes first, the production schedule is sacred, and everything we do — patching, monitoring, projects, security — is built around that order of operations. ## What an Hour of Downtime Actually Costs You don't need an industry statistic for this — you need your own number, and it takes about two minutes to calculate. Say you've got 15 people on the floor at a $35-per-hour loaded cost. That's $525 an hour in labor producing nothing, before you count the units that didn't ship, the margin on those units, the expedited freight to make the date anyway, and the conversation with your biggest customer about why the order is late. Run that math for your own operation: loaded labor cost times floor headcount, plus margin on lost throughput, plus whatever a missed delivery actually costs you in penalties and trust. That number — not the monthly IT invoice — is what you're really managing. Owners who run it once tend to stop thinking about IT as overhead. ## Your Building Has Two Networks (Whether You Planned It or Not) Every manufacturer runs two distinct technology environments. There's the office network — email, accounting, file shares, the front-office computers. And there's the operational technology, or OT — the machines themselves: PLCs (programmable logic controllers, the small industrial computers that run your equipment), SCADA systems (supervisory control and data acquisition — the screens your operators use to monitor and control the line), sensors, and very often a PC bolted to a machine running an operating system that went out of support years ago, because the equipment vendor never released anything newer. Those production systems usually can't be patched or rebooted the way office computers can. That's fine — as long as they're properly walled off. The job of OT/IT segmentation is simple to state: a phishing click in the front office should never be able to reach the factory floor. We design networks where the office side and the production side are separated, traffic between them is controlled and monitored, and the aging-but-essential machine controllers are protected by the network around them instead of depending on patches they're never going to get. If you've never seen a network diagram of your own building, that's worth asking your provider for. The two-networks problem is much easier to fix before an incident than during one. ## The Software That Runs the Business The floor is half the picture. The other half is the software stack that keeps orders, inventory, and money moving: your ERP (enterprise resource planning — the system tracking orders, purchasing, inventory, and financials), possibly an MES (manufacturing execution system — the software tracking what's actually happening on the floor in real time), quality management, and EDI (electronic data interchange — the automated order-and-invoice pipeline your larger customers require you to use, whether you like it or not). When any of those goes down, production may keep running for a while, but shipping, receiving, and invoicing don't. We manage these systems as production-critical: properly backed up (with restores actually tested, not assumed), integrated so data isn't being rekeyed between systems, and supported by people who will get on the phone with your ERP vendor instead of pointing at them. ## Security Built Around Production Reality Manufacturers are heavily targeted by ransomware for a straightforward reason: attackers know downtime forces fast decisions. Ransomware shows up in [88% of breaches at small and mid-sized organizations](https://www.verizon.com/business/resources/reports/dbir/), per Verizon's 2025 Data Breach Investigations Report — and a manufacturer with a stopped line is exactly the victim an attacker hopes for. Our security stack is built for environments where you can't just reboot everything: EDR (endpoint detection and response — the modern replacement for antivirus, which watches behavior instead of just known bad files) on every machine that can run it, a 24/7 SOC (security operations center — humans monitoring for threats around the clock, which matters when your second shift runs past midnight), email security to catch the phishing and fake-invoice attacks that start most incidents, and employee training for the office staff who are the actual front line. Every change is scheduled around production, tested first, and rolled out in increments. ## Where to Start Three questions worth asking this week, of yourself or your current provider: 1. **Can a phishing click in the front office reach the floor?** If nobody can show you the segmentation, assume the answer is yes. 2. **When did anyone last actually restore the ERP from backup?** A backup that's never been test-restored is a hope, not a plan. 3. **What happens at 2am on second shift when something breaks?** "Open a ticket and wait for morning" is a real answer — just make sure it's one you've accepted on purpose. If you'd rather have those answers in writing, qualifying businesses receive our IT Risk Assessment complimentary. We'll walk the floor, map both networks, and hand you a prioritized list — whether or not you ever work with us. ## Frequently Asked Questions **Do you understand the difference between OT and IT environments?** Yes — and it's the first thing we map on a walkthrough. Operational technology (the controllers, sensors, and PC-based systems that actually run your machines) plays by different rules than office IT: equipment often can't be patched or rebooted on demand, vendor support agreements limit what you're allowed to touch, and uptime beats everything. We segment the OT side from the office network so an email-borne attack can't reach the floor, and we plan changes around your production schedule rather than ours. **Can you support multi-shift operations?** Yes. Security monitoring runs 24/7 through a SOC (security operations center — actual humans watching for threats around the clock, not just software), and our escalation process covers critical issues whenever they happen. If second shift hits a problem at 11pm, there's a defined escalation path to a human that night. **How do you minimize disruption during IT changes?** We plan maintenance windows around your production schedule — including second and third shift — test changes before they touch anything production-facing, and roll them out incrementally. A patch that's routine for an office laptop waits for a planned window when the machine it touches is controlling a live line. Our process knows the difference. --- # Enterprise-Grade IT for Nonprofits URL: https://etoptechnology.com/it-services-nonprofits/ Type: Industry eTop Technology works with nonprofits across the Inland Empire. The constraint is always the same: every dollar spent on technology is a dollar that didn't go to the mission, so those dollars have to count. Our job is making sure they do — and finding the ones you shouldn't be spending at all. ## Why Nonprofits Need Professional IT Management Nonprofits face a unique combination of IT challenges: **Sensitive data, limited resources.** You handle donor information, client records, financial data, and program information — all of which need to be protected. But your budget doesn't allow for a full IT department. **Grant compliance requirements.** Many federal, state, and foundation grants come with specific data handling, security, and reporting requirements. Non-compliance can mean losing funding. **High accountability.** Donors, boards, and regulators expect responsible stewardship of resources — including technology resources. A data breach or prolonged outage doesn't just cost money; it costs trust. **Volunteer and hybrid workforces.** Many nonprofits rely on a mix of staff, volunteers, and remote workers who all need secure access to systems and data. ## How We Help Nonprofits ### Microsoft 365 Nonprofit Optimization Microsoft offers granted and deeply discounted licensing for qualifying nonprofits through [microsoft.com/nonprofits](https://www.microsoft.com/nonprofits) — and the program changed significantly in mid-2025, so what you knew two years ago may no longer be accurate. As of the current program: Microsoft 365 Business Basic is granted free for up to 300 users, and Microsoft 365 Business Premium — the tier with the security features a nonprofit handling donor data actually needs — is available at a 75% discount, which works out to roughly $5.50 per user per month at current pricing. The old fully-free Business Premium grant was retired in July 2025, and plenty of organizations are still paying for licenses they could be getting cheaper, or running grants that quietly converted to paid. We help you verify eligibility, apply, configure the licensing correctly, and actually use what Business Premium includes — many nonprofits pay for it and use a third of it. ### Budget-Sensitive Security Serious security doesn't have to come with a big-company price tag. We design security architectures that maximize protection within nonprofit budget constraints — prioritizing the controls that matter most for your risk profile. ### Grant Compliance Support We understand the IT requirements embedded in federal and state grants. We help you implement the data handling procedures, security controls, and documentation that keep you in compliance and eligible for continued funding. ### Strategic Technology Planning We help nonprofit leaders make smart technology decisions — where to invest, where to save, and how to build IT infrastructure that scales with your mission without breaking your budget. ### Reliable Day-to-Day Support Your team shouldn't be troubleshooting IT problems when they could be serving your community. We provide responsive, professional support that keeps your technology running so your team can focus on what matters. ## Frequently Asked Questions **Can nonprofits really afford managed IT services?** Many nonprofits find that managed IT actually costs less than their current approach when you factor in reduced downtime, fewer emergency repair bills, and optimized licensing. We also help nonprofits leverage programs like Microsoft 365 Nonprofit to significantly reduce software costs. **Do you offer nonprofit pricing?** We work with nonprofits to find service configurations that fit their budgets while meeting their security and operational needs. We understand nonprofit constraints and design solutions accordingly. **We handle donor data — what security do we need?** Donor data deserves the same protection as any sensitive personal information. We implement encryption, access controls, secure payment processing support, and data loss prevention controls to protect your donors and your reputation. **Can you help with grant compliance IT requirements?** Yes. Many grants require specific data handling procedures, security controls, and documentation. We help ensure your IT environment meets grant requirements so you can focus on fulfilling your mission. --- # Managed IT Services in Loma Linda, California URL: https://etoptechnology.com/managed-it-services-loma-linda/ Type: Service Area Distance from Redlands HQ: 5 minutes Loma Linda is synonymous with healthcare — home to Loma Linda University Health, one of the nation's top medical centers, and a dense cluster of health-adjacent organizations that support it: billing and claims companies, labs, research groups, consultancies, and professional services firms. That concentration creates a specific IT demand most cities don't have: even businesses that never treat a patient end up handling regulated health information. eTop Technology is just 5 minutes from Loma Linda, making us one of the closest managed IT providers with deep HIPAA compliance expertise. We serve healthcare-adjacent businesses and other Loma Linda organizations that need IT infrastructure built to meet regulatory requirements from day one. ## Why Loma Linda Businesses Need Specialized IT **HIPAA compliance isn't optional.** Any organization handling protected health information must meet HIPAA's technical safeguard requirements — specific controls around access, encryption, audit logging, backup, and device management. **Healthcare data is a premium target.** Medical records sell for significantly more than credit card numbers on the dark web. **Business associates share the liability.** Even if you're not a healthcare provider, if you handle data on behalf of one, you're a business associate under HIPAA and face the same obligations. ## Frequently Asked Questions **How close are you to Loma Linda?** We're approximately 5 minutes away. Our Redlands office is just east of Loma Linda along Redlands Boulevard. We can be onsite in minutes. **We're not a healthcare provider, but we work with one — does HIPAA apply to us?** Very likely, yes. If you handle protected health information on behalf of a provider — billing, transcription, claims processing, IT, consulting, even some legal and accounting work — you're a business associate under HIPAA (the federal health-information privacy law), and you carry many of the same obligations. That's exactly the kind of organization we build environments for. **Can you help us prepare for a HIPAA audit?** Yes — that's a core capability. We implement technical safeguards, help develop documentation, conduct risk assessments, and ensure your IT environment is audit-ready. --- # Managed IT Services in San Bernardino, California URL: https://etoptechnology.com/managed-it-services-san-bernardino/ Type: Service Area Distance from Redlands HQ: 10 minutes San Bernardino is evolving. New investment, expanding logistics operations, and a growing professional services sector are reshaping the city's business landscape. But with growth comes complexity — and the businesses driving San Bernardino's economy forward need IT infrastructure that keeps pace. eTop Technology is based right next door in Redlands, making us one of the closest managed IT providers to San Bernardino's business district. We understand the Inland Empire market because we've been part of it for over 12 years — and we've helped businesses like yours build IT that drives the business forward. ## IT Challenges San Bernardino Businesses Face - Logistics and warehousing operations requiring reliable network infrastructure across large facilities - Growing professional services firms needing compliance-ready IT (HIPAA, FTC Safeguards) - Nonprofit organizations serving the community on tight budgets but requiring serious security ## Why Local Matters We're 10 minutes away. When you have an onsite need, we're there fast. More importantly, we understand San Bernardino's business environment — the industries, the challenges, and the opportunities. We're your neighbors — invested in the same community where we live and work. ## Who We Already Support in San Bernardino We support San Bernardino organizations today, including tax and accounting practices, a metal products manufacturer, and a regional nonprofit collaborative. They get the same 10-minute proximity this page promises. ## Business IT Support for San Bernardino Companies What a managed IT plan with eTop covers, in plain terms: - **Help desk for your staff.** People call, email, or submit a ticket, and a technician who knows your environment picks it up. - **Proactive monitoring and patching.** Servers, workstations, and network gear are watched and updated before problems reach your staff. - **24/7 security monitoring.** A security operations center, endpoint detection and response, email filtering, and MFA are included, not add-ons. See [cybersecurity services](/cybersecurity-services-inland-empire/). - **Backup and disaster recovery.** Tested backups and a plan for getting back up after ransomware, hardware failure, or a fire. See [backup and disaster recovery](/business-continuity-disaster-recovery/). - **Vendor management.** We deal with your internet provider, phone vendor, and line-of-business software support so you don't have to. - **Planning.** Quarterly business reviews and a technology roadmap, so replacements and upgrades are budgeted instead of surprises. ## For Manufacturers and Warehouses San Bernardino's manufacturing and logistics businesses have a specific problem: shop-floor and warehouse equipment that can't be patched like an office PC, sitting on the same network as email. We separate those networks, monitor them, and plan around production schedules. See [IT for manufacturers](/it-services-manufacturing-inland-empire/). ## For Tax, Accounting, and Financial Offices If you prepare taxes or handle client financial data, the FTC Safeguards Rule requires a written information security program, MFA, encryption, and a qualified person overseeing it. We help small practices meet those requirements without an in-house security team. See [compliance IT services](/compliance-it-services/). ## Frequently Asked Questions **How close are you to San Bernardino?** We're based in Redlands, about 10 minutes from downtown San Bernardino. We're one of the closest managed IT providers to the San Bernardino business district. **What industries do you serve in San Bernardino?** We work with established organizations across manufacturing, logistics, professional services, nonprofits, and healthcare-adjacent businesses in the San Bernardino area. --- # Managed IT Services in Rialto, California URL: https://etoptechnology.com/managed-it-services-rialto/ Type: Service Area Distance from Redlands HQ: 15 minutes Rialto is a city on the move. With over 104,000 residents and a rapidly expanding commercial and industrial base — particularly in logistics, distribution, and manufacturing along the I-10 and I-210 corridors — Rialto businesses need IT infrastructure that supports operational demands and protects against growing cybersecurity threats. eTop Technology serves Rialto from our Redlands office, just 15 minutes to the east. We provide managed IT services, cybersecurity, and compliance for established Rialto businesses. ## IT Challenges Rialto Businesses Face **Logistics and distribution operations relying on technology.** Massive warehouse and distribution operations depend on interconnected systems for inventory, shipping, and workforce management. **Growing businesses needing IT that scales.** IT that was "good enough" at 30 employees starts breaking at 60. Getting ahead of that growth curve makes the difference. **Cybersecurity awareness gaps.** Many businesses haven't invested in the cybersecurity foundations that modern business demands: SOC monitoring, endpoint detection, email security, and employee training. ## Frequently Asked Questions **How close is eTop to Rialto?** About 15 minutes. Our Redlands office is just east of Rialto via I-10, making us one of the closest managed IT providers to Rialto's business and industrial areas. **We're a distribution company — do you support warehouse and logistics environments?** Yes. We work with organizations in warehouse and distribution environments, understanding multi-shift operations, IoT devices, WMS platforms, and supply chain security requirements. **What does getting started look like?** It starts with an intro call. We evaluate your current environment and give you a clear picture of where you stand — no obligation, no hard sell. --- # Managed IT Services in Riverside, California URL: https://etoptechnology.com/managed-it-services-riverside/ Type: Service Area Distance from Redlands HQ: 15 minutes Riverside is the economic hub of the Inland Empire — home to everything from growing manufacturing operations along the I-215 corridor to established law firms downtown and thriving nonprofits serving one of California's most diverse communities. As these organizations grow, their IT needs become more complex, more security-sensitive, and harder to manage with a single in-house IT person or a break-fix provider. eTop Technology serves Riverside businesses from our office in nearby Redlands — just 15 minutes away. That means responsive local support without the overhead of a Riverside office lease being passed on to you. When you need onsite help, we're there quickly. When remote support can solve the problem faster, our team is already on it. ## IT Challenges Riverside Businesses Face Riverside's business landscape is diverse, but the IT challenges are consistent: - Growing organizations that have outgrown their original IT setup but aren't large enough for a full internal IT department - Compliance requirements (HIPAA for healthcare-adjacent organizations near the medical corridor, FTC Safeguards for financial services) - Cybersecurity threats that target mid-size businesses — particularly ransomware attacks against professional services firms and manufacturers - Multi-location connectivity for businesses with offices, warehouses, or job sites spread across the Inland Empire ## Why Local Matters When your server goes down or you're dealing with a security incident, proximity matters. eTop's Redlands location means that when hands-on help is needed, we're 15 minutes away, not a half-day dispatch — onsite visits are triaged by urgency and business impact, while our remote support team resolves most issues in minutes. We also know the Inland Empire business landscape firsthand. We know the local compliance environment, the common challenges Riverside businesses face, and we're invested in this community. ## Who We Already Support in Riverside County eTop isn't new to Riverside. We support businesses in Riverside today, including a law firm and a vehicle dealership. They get the same team, the same security stack, and the same quarterly business reviews as our Redlands clients down the road. ## IT Outsourcing vs. Hiring In-House Most Riverside businesses that call us are deciding between hiring their first (or second) IT person and outsourcing. An honest comparison: - **One in-house hire** knows your office well but covers one skill set, takes vacations, and leaves with everything in their head. Security monitoring around the clock isn't realistic for one person. - **Managed IT** gives you a team: help desk technicians, engineers, a security operations center watching 24/7, and someone planning your technology budget with you. The trade-off is that they aren't sitting in your office every day. - **Co-managed IT** splits the difference. If you already have an IT person, we back them up with tools, security monitoring, and escalation. See [co-managed IT](/co-managed-it-services/). ## Managed Cybersecurity for Riverside Businesses Security is included in every plan, not sold separately: 24/7 SOC monitoring, endpoint detection and response (EDR), email filtering, MFA and conditional access, and monthly phishing training for your staff. For law firms and anyone handling client financial data, that stack is also the evidence behind cyber insurance applications and compliance questionnaires. The details are on our [cybersecurity services](/cybersecurity-services-inland-empire/) page. ## Microsoft 365, Done Properly Most businesses we onboard are already on Microsoft 365, and most aren't using the security features they already pay for. We set up device management, conditional access, email hardening, and backup for Microsoft 365. See [Microsoft 365 management](/microsoft-365-management/). ## Planning, Not Just Fixing Every managed IT client gets quarterly business reviews and a technology roadmap: what needs replacing and when, what it will cost, and which risks are worth fixing first. That's the IT governance a growing Riverside business usually has no one in-house to do. ## Frequently Asked Questions **How do I find a good local IT company in Riverside, CA?** Look for a provider close enough to be onsite the same day, that works with businesses your size, and that can show you, in writing, which security controls it puts in place and how it prioritizes requests. Ask for references from Riverside-area clients. eTop Technology is based in Redlands, about 15 minutes from downtown Riverside, and serves businesses throughout Riverside and the surrounding communities. **How quickly can you get onsite to our Riverside office?** Our Redlands office is approximately 15 minutes from downtown Riverside. Onsite requests are triaged and dispatched by urgency and business impact. That said, most issues are resolved remotely, often within minutes — onsite visits are for hardware, infrastructure, and projects. **Do you serve all of Riverside or just certain areas?** We serve businesses throughout the city of Riverside and the greater Riverside area, including Jurupa Valley, Moreno Valley, and surrounding communities. **What types of Riverside businesses do you typically work with?** We work with established organizations that value proactive, security-focused IT. In the Riverside area, that includes manufacturing firms, law offices, construction companies, nonprofits, and healthcare-adjacent organizations across a wide range of sizes. --- # Managed IT Services in Fontana, California URL: https://etoptechnology.com/managed-it-services-fontana/ Type: Service Area Distance from Redlands HQ: 20 minutes Fontana has evolved from its steel-town roots into one of the Inland Empire's most active industrial and commercial centers. With a population exceeding 214,000 and a massive concentration of manufacturing, logistics, and distribution operations along the I-10 and I-15 corridors, Fontana is a city where businesses depend on technology to keep operations moving — and where downtime has immediate, measurable consequences. eTop Technology serves Fontana businesses from our Redlands office, approximately 20 minutes to the east. We specialize in managed IT for established organizations — the kind of businesses that power Fontana's economy and need IT infrastructure that's reliable, secure, and strategically managed. ## IT Challenges Fontana Businesses Face **Industrial and manufacturing operations that can't afford downtime.** When your production line, warehouse management system, or logistics platform goes down, every minute costs money. Fontana businesses need IT with redundancy, monitoring, and rapid response. **Workforce technology for large teams.** With many Fontana businesses employing 50 to 200+ people, managing endpoint security, user access, and collaboration tools at scale requires more than basic IT support. **Security threats targeting industrial businesses.** Manufacturing and logistics companies are increasingly targeted by ransomware attackers who know that operational disruption creates urgency to pay. ## Frequently Asked Questions **Do you have experience with manufacturing IT environments?** Manufacturing is one of our core specializations. We understand OT/IT integration, uptime requirements of production environments, and compliance needs for government contracts and supply chain partnerships. **How fast can you get to our Fontana location?** Fontana is approximately 20 minutes from our Redlands office. Onsite requests are triaged and dispatched by urgency and business impact. Most issues are resolved remotely through proactive monitoring. **We run two shifts — can you support after-hours operations?** Yes. Our SOC monitoring operates 24/7/365. For after-hours IT support, our escalation process ensures critical issues get addressed promptly regardless of the time. **What industries do you typically serve in Fontana?** In the Fontana area, we serve manufacturing and engineering firms, logistics and distribution companies, construction businesses, and established professional services organizations. --- # Managed IT Services in Moreno Valley, California URL: https://etoptechnology.com/managed-it-services-moreno-valley/ Type: Service Area Distance from Redlands HQ: 25 minutes Moreno Valley is one of Riverside County's largest and fastest-growing cities, with a population exceeding 212,000 and a business community expanding alongside massive logistics and distribution operations. The World Logistics Center development and continued growth of warehouse and distribution facilities along the I-215 corridor are bringing new businesses and new IT demands to the area. Beyond logistics, Moreno Valley is home to a growing base of professional services firms, construction companies, and established local businesses. These organizations all share a common need: reliable, secure technology managed by a team that understands the Inland Empire. eTop Technology serves Moreno Valley from our Redlands office, approximately 25 minutes north. We provide managed IT, cybersecurity, and compliance services for established organizations across the area. ## IT Challenges Moreno Valley Businesses Face **Rapid business growth outpacing IT.** New businesses need IT built right from the start. Growing businesses need IT that scales without constant reinvention. **Compliance obligations arriving with growth.** Cyber-insurance questionnaires, customer security requirements, and regulations like the FTC Safeguards Rule all carry technical requirements that growing businesses haven't staffed for. **Logistics technology demands.** Warehouse and distribution operations rely on interconnected systems — warehouse management software, connected scanners and sensors, fleet management tools, and real-time inventory tracking. ## Frequently Asked Questions **Is Moreno Valley within your service area?** Yes. Moreno Valley is approximately 25 minutes from our Redlands office, well within our primary service radius. **We run a logistics operation in Moreno Valley — can you support warehouse technology?** Yes. Distribution environments depend on more than office PCs — warehouse management systems, scanners, label printers, wireless coverage across large floor plans, and the network that ties it all together. We design and manage that infrastructure so the dock keeps moving. **We just moved to Moreno Valley and need to set up IT from scratch — can you help?** Absolutely. New environment buildouts are where we do some of our best work. We'll design your IT infrastructure from day one with security, compliance, and scalability built in. --- # Managed IT Services in Ontario, California URL: https://etoptechnology.com/managed-it-services-ontario-ca/ Type: Service Area Distance from Redlands HQ: 25 minutes Ontario is one of the Inland Empire's most dynamic business cities. Anchored by Ontario International Airport, a massive logistics and distribution infrastructure, and a growing commercial corridor along the I-10 and I-15, Ontario is where a significant number of the IE's mid-market businesses operate. From manufacturing and distribution companies near the airport to professional services firms in the Ontario Center area and along Haven Avenue, this is a city built on commerce. eTop Technology serves Ontario businesses from our Redlands office, approximately 25 minutes east. We provide managed IT services, cybersecurity, and compliance support specifically designed for the kinds of organizations that drive Ontario's economy — established businesses that depend on technology working, and need it reliable, secure, and strategically managed. ## IT Challenges Ontario Businesses Face **Manufacturing and distribution complexity.** Ontario's proximity to the airport and major freight corridors means a high concentration of manufacturing, warehousing, and logistics businesses. These operations rely on technology for inventory management, supply chain coordination, and operational continuity — and downtime directly translates to lost revenue. **Multi-location management.** Many Ontario businesses operate multiple facilities — an office, a warehouse, satellite locations. Keeping these environments consistently secured, updated, and connected is a challenge that most small IT teams can't handle alone. **Growing compliance demands.** Whether it's HIPAA for healthcare organizations, FTC Safeguards for financial services, or state privacy laws, Ontario businesses increasingly face regulatory requirements that demand specific IT controls. **Competition for IT talent.** Ontario businesses compete with larger LA-area employers for qualified IT staff. Managed IT services give you access to an entire team of specialists for less than the cost of a single senior hire. ## Frequently Asked Questions **Can you support our Ontario manufacturing facility's IT needs?** Yes — manufacturing is one of our core verticals. We understand the unique IT challenges of manufacturing environments: OT/IT integration, uptime requirements, multi-shift operations, and compliance needs. **We're near Ontario International Airport — do you serve businesses in that area?** We serve businesses throughout Ontario, including the airport industrial corridor, the Ontario Mills area, the Inland Empire Business Center, Haven Avenue, and all surrounding commercial districts. **How do you handle after-hours emergencies?** Our SOC monitoring operates 24/7/365 — security threats are detected and responded to in real time, day or night. For critical IT emergencies outside business hours, our escalation process ensures rapid response. **What's the difference between eTop and the big national IT companies?** With eTop, you get a dedicated local team that knows your environment, your people, and your business goals. We intentionally keep our client count manageable so that every organization gets that level of attention. --- # Managed IT Services in Rancho Cucamonga, California URL: https://etoptechnology.com/managed-it-services-rancho-cucamonga/ Type: Service Area Distance from Redlands HQ: 25 minutes Rancho Cucamonga consistently ranks among the best places to do business in the Inland Empire — and for good reason. With its concentration of corporate offices, medical facilities, professional services firms, and growing tech sector, Rancho Cucamonga is home to a significant number of mid-market organizations that need IT capabilities beyond what a single tech person or a basic break-fix provider can deliver. eTop Technology serves Rancho Cucamonga businesses from our Redlands base, providing the kind of managed IT, cybersecurity, and compliance services that match the sophistication of the businesses operating here. If you're an established organization ready for IT that's proactive rather than reactive, we should talk. ## IT Challenges Rancho Cucamonga Businesses Face **Professional services firms outgrowing their IT.** Rancho Cucamonga has a high density of law firms, accounting firms, financial advisors, and consulting companies — all handling sensitive client data. These firms often started with consumer-grade IT and now face real security and compliance risks. **Compliance requirements with real teeth.** Between HIPAA for healthcare-adjacent businesses, FTC Safeguards for firms touching consumer financial data, and tightening cyber-insurance requirements, many organizations discover their IT environment has significant gaps only when facing an audit, a renewal, or a breach. **Remote and hybrid workforce challenges.** Many Rancho Cucamonga businesses have embraced hybrid work, but their IT infrastructure hasn't caught up. Secure remote access, device management, and data protection for a distributed workforce require intentional architecture. ## Frequently Asked Questions **Do you serve businesses along the Foothill Boulevard and Haven Avenue corridors?** Yes — we serve businesses throughout Rancho Cucamonga, including the Foothill Boulevard commercial corridor, Haven Avenue, the Terra Vista area, Victoria Gardens district, and all surrounding business parks. **We're a professional services firm — what does eTop add beyond day-to-day support?** We bring a team and a plan. Beyond fixing what breaks, we architect your security posture, keep compliance documentation audit-ready, manage your Microsoft 365 environment, and give you a technology roadmap that matches where the firm is headed. **Can you help us transition from our current IT provider?** Yes — provider transitions are a structured, well-practiced process for us. We handle documentation, credential handoff, system evaluation, and any remediation needed, with a plan built around keeping your operations running through the change. **How do you price your services?** We use a transparent per-user-per-month model that covers everything in our Premium Managed Services plan — support, security, monitoring, management. See our pricing page for the current range and what's included. --- # Managed IT Services in Upland, California URL: https://etoptechnology.com/managed-it-services-upland-ca/ Type: Service Area Distance from Redlands HQ: 25 minutes Upland is a foothill community with a thriving professional services economy. Along Foothill Boulevard and surrounding business districts, you'll find law firms, accounting practices, insurance agencies, and other professional organizations — many handling highly sensitive client data and facing growing compliance requirements. With approximately 79,000 residents and a reputation as one of the Inland Empire's most desirable business communities, Upland attracts organizations that demand quality in everything — including their IT. eTop Technology provides managed IT from our Redlands office, approximately 25 minutes east. ## IT Challenges Upland Businesses Face **Professional services firms with data protection obligations.** Upland's concentration of law firms, CPA offices, and financial advisors means businesses handling data that demands serious protection. **Compliance requirements arriving faster than IT budgets.** FTC Safeguards, California privacy law, and cyber-insurance questionnaires all carry technical requirements that most growing firms haven't staffed for. **Growing businesses needing strategic IT guidance.** Expanding businesses need an IT partner who helps plan and execute technology decisions, not just fix what breaks. ## Frequently Asked Questions **We're a law firm in Upland — do you specialize in legal IT?** Law firms are one of our key verticals. We understand attorney-client privilege demands, bar association technology competence requirements, and document-intensive workflows. **We handle sensitive client data — can you help with compliance requirements?** Yes. Frameworks like the FTC Safeguards Rule (which covers many firms that touch consumer financial data) and California's privacy laws come with specific technical requirements — encryption, multi-factor authentication, access controls, monitoring, and a written security plan. We build environments to meet them and keep the documentation audit-ready. **We're currently with a provider who's fine but not strategic — is it worth a conversation?** Worth a conversation, at least. Day-to-day support is half the job; the other half is planning — security posture, compliance readiness, budgeting, and a technology roadmap that matches where your business is headed. If you're not getting that today, an intro call costs you nothing and you'll walk away with an honest read either way. --- # Cybersecurity & Managed IT Services in Chino Hills, California URL: https://etoptechnology.com/managed-it-services-chino-hills/ Type: Service Area Distance from Redlands HQ: 30 minutes Chino Hills is one of the Inland Empire's most affluent and fastest-growing communities, with a business landscape that reflects its demographic — professional services firms, medical practices, financial advisors, and corporate satellite offices. Positioned where San Bernardino County meets Orange County and LA County, Chino Hills businesses often operate at the intersection of multiple markets. eTop Technology provides managed IT services for Chino Hills organizations from our Redlands office, approximately 30 minutes to the east. We serve established businesses that need security-first IT, compliance expertise, and strategic IT management. ## IT Challenges Chino Hills Businesses Face **High-value businesses handling high-value data.** Professional services firms handle sensitive client data that's a prime target for cybercriminals. **Satellite offices needing consistent IT.** Many offices are branches of larger organizations needing consistent, secure IT connected to main operations. **Expectations of quality and responsiveness.** Chino Hills businesses and their clients expect a high standard of service — your IT provider should meet that same standard. ## Cybersecurity for Chino Hills Businesses Most of the cybersecurity questions we get from Chino Hills firms come down to one thing: a client, an insurer, or a regulator has started asking what you actually do to protect their data, and "we have antivirus" is no longer an answer. Security is built into every eTop managed IT plan rather than sold as an add-on, and it is layered: - **24/7 SOC monitoring.** A security operations center watches your endpoints, network, and Microsoft 365 around the clock, so a problem at 2 AM is being triaged before anyone's phone rings. - **Endpoint detection and response (EDR).** Behavior-based protection that catches ransomware by what it does, not by whether it's on a known-bad list, and contains it before the encryption finishes. - **Email security and phishing protection.** Filtering, link and attachment analysis, and Microsoft 365 hardening, because email is still where most incidents start. - **Security awareness training.** Monthly training and simulated phishing for your staff, not a once-a-year video. - **MFA and conditional access.** The right person, on a known device, gets in. Anything else has to prove itself. - **Vulnerability management.** Regular scanning, with the exploitable problems actually fixed. For financial advisors and other regulated firms, that stack is also the evidence behind FTC Safeguards Rule compliance and cyber insurance applications. See our full [cybersecurity services](/cybersecurity-services-inland-empire/) for how each layer works. ## Frequently Asked Questions **Do you serve businesses in both Chino Hills and Chino?** Yes, we serve businesses in both cities as well as surrounding areas including Diamond Bar, Pomona, and Ontario. **We're a financial advisory firm — what compliance support can you provide?** We help financial services firms meet FTC Safeguards Rule requirements, implement data loss prevention controls, and build IT environments that satisfy regulatory demands. **What makes eTop different from other IT providers serving Chino Hills?** Scale and attention. We intentionally limit our client count so every organization gets dedicated, personalized service — you get a team that knows your name and your environment. --- # Managed IT Services in Claremont, California URL: https://etoptechnology.com/managed-it-services-claremont/ Type: Service Area Distance from Redlands HQ: 30 minutes Claremont is built around the Claremont Colleges consortium and the Village district, and its business community reflects that: professional services firms, educational organizations, and an unusually deep bench of nonprofits — organizations that handle sensitive data and can't afford technology that gets in the way of the work. eTop Technology provides managed IT services for Claremont businesses and organizations from our Redlands office, approximately 30 minutes east. ## IT Challenges Claremont Businesses Face **Educational and institutional organizations with complex needs.** Claremont's academic ecosystem creates organizations with complex IT requirements including data protection, multi-system integration, and compliance. **Professional services firms handling sensitive data.** Attorneys, consultants, and financial advisors handle data demanding rigorous security and regulatory compliance. **Nonprofits needing enterprise standards on lean budgets.** Claremont's active nonprofit community struggles to achieve IT security and reliability within budget constraints. ## Frequently Asked Questions **Do you work with educational institutions and nonprofits?** Nonprofits are one of our target verticals. We understand nonprofit budgets, leverage Microsoft 365 Nonprofit licensing, and deliver enterprise-grade security at an appropriate price point. **How do you serve Claremont from Redlands?** Our remote-first service model means proactive monitoring, remote support, and 24/7 SOC security operate regardless of distance. For onsite needs, we provide scheduled and urgent visits. **We're a professional firm — how do we know if we're the right fit for eTop?** The size of the team matters less than how much your business depends on technology working. If downtime is expensive, your data is sensitive, or compliance is on the table, it's worth a conversation — we'll give you an honest read either way. --- # Managed IT Services in Corona, California URL: https://etoptechnology.com/managed-it-services-corona-ca/ Type: Service Area Distance from Redlands HQ: 30 minutes Corona sits at the western gateway of the Inland Empire, strategically positioned where Riverside County meets the economic corridors of Orange County and the greater LA market. This positioning makes Corona home to a thriving business community — from construction and engineering firms that serve projects across Southern California to professional services companies, healthcare providers, and manufacturing operations. eTop Technology provides managed IT services to Corona businesses from our Redlands office, approximately 30 minutes east. For established organizations, we deliver the security, reliability, and strategic IT guidance that growing businesses in Corona demand. ## IT Challenges Corona Businesses Face **Gateway businesses with broader reach.** Many Corona companies serve clients across Southern California, which means their IT needs to support remote connectivity, mobile workforces, and multi-site operations. **Construction and engineering firms managing field technology.** Corona is home to numerous construction and engineering companies with unique IT challenges: managing devices across job sites, securing project files, and meeting compliance requirements. **The "too big for one IT person, too small for a department" gap.** Corona's mid-market companies have outgrown one-person IT but can't justify a full internal department. Managed IT bridges that gap perfectly. ## Frequently Asked Questions **Is Corona within your service area?** Absolutely. Corona is approximately 30 minutes from our Redlands office and well within our primary service area. We serve businesses throughout Corona, including the business parks along the 91 and the Dos Lagos area. **We're a construction company — do you understand our industry's IT needs?** Construction is one of our target verticals. We understand field workforce connectivity, securing project data across job sites, managing mobile devices, and meeting compliance requirements from GCs and government contracts. **How do you handle support for a team that's mostly in the field?** We manage mobile devices through Microsoft Intune, provide secure remote access solutions, and offer remote support that reaches your team wherever they're working. **Do you support businesses that are in both the IE and Orange County?** Yes. Many of our clients operate across the Inland Empire and into Orange County. Our services are designed to support distributed teams and multi-location businesses. --- # Managed IT Services in Pomona, California URL: https://etoptechnology.com/managed-it-services-pomona-ca/ Type: Service Area Distance from Redlands HQ: 30 minutes Pomona sits at the western edge of the Inland Empire, where San Bernardino County meets Los Angeles County — a strategic position that makes it a hub for businesses serving both markets. From industrial and manufacturing operations along the 10 and 71 freeways to professional services firms in the downtown corridor, Pomona's business community spans both markets. With over 151,000 residents and a robust commercial sector, Pomona businesses need IT that's reliable, secure, and ready to support growth. eTop Technology provides managed IT services from our Redlands office, approximately 30 minutes east. ## IT Challenges Pomona Businesses Face **Straddling two markets.** Many Pomona businesses serve clients in both the Inland Empire and LA County, and need IT that lets their teams work securely from either side of the county line. **Manufacturing and industrial IT.** Pomona's significant manufacturing base means businesses relying on technology for production, quality control, and supply chain management. **Aging infrastructure.** Some established businesses have been running on the same IT infrastructure for years. Legacy systems and outdated security create compounding risk. ## Frequently Asked Questions **How far is eTop from Pomona?** Our Redlands office is approximately 30 minutes from Pomona via the I-10. We provide rapid remote support for day-to-day issues and onsite support when needed. **We work with clients in both the IE and LA County — does that complicate things?** Not at all. Cloud-based infrastructure and proper Microsoft 365 configuration mean your team can work securely from anywhere. **We're a manufacturing company near the Fairplex — do you work with manufacturers?** Manufacturing is one of our specialty verticals. We understand production environments, uptime requirements, OT/IT integration, and compliance standards. --- # Managed IT Services in Temecula, California URL: https://etoptechnology.com/managed-it-services-temecula/ Type: Service Area Distance from Redlands HQ: 40 minutes Temecula is one of Southwest Riverside County's busiest business hubs. Beyond wine country, the city has a growing professional services sector and an expanding base of manufacturing, biotech, and technology companies — mid-market organizations that need serious IT infrastructure. eTop Technology serves Temecula businesses from our Inland Empire base in Redlands. While approximately 40 minutes south, Temecula falls within our service area and benefits from the same proactive remote monitoring, 24/7 SOC security, and strategic IT management we provide to all our clients. ## IT Challenges Temecula Businesses Face **Growing businesses in a growing city.** Temecula's expansion means more businesses scaling up — and their IT needs to scale with them. **Tourism and hospitality businesses with technology demands.** Wineries, hotels, and event venues increasingly rely on technology for reservations, point-of-sale, and customer data management. **Professional services firms serving the Southwest Riverside market.** Law firms, medical practices, and financial advisors handle sensitive data and face compliance requirements. ## How We Support Temecula Businesses From Redlands We'll be straight about the distance: Temecula is about 40 minutes from our office. Here is how that works in practice. - **Most issues are fixed remotely, fast.** Password resets, software problems, email issues, and most network troubleshooting are handled by our help desk without anyone needing to drive anywhere. - **Monitoring doesn't care about distance.** Our 24/7 security operations center and system monitoring watch your environment the same way whether you're in Temecula or next door to us. - **On-site work is scheduled, not skipped.** New equipment, network installs, cabling, office moves, and hardware failures that can't be fixed remotely get a technician on site. We plan those visits ahead, and treat urgent hardware problems by business impact. - **Your network is built to be managed remotely.** We set up remote-manageable firewalls, switches, and wireless so that most of what used to need a truck roll doesn't anymore. ## Remote Managed IT Services for Temecula If you're searching specifically for remote managed IT, the plan covers: - Help desk support for your staff by phone, email, or ticket - Proactive monitoring, patching, and maintenance of every workstation and server - 24/7 SOC monitoring, EDR, email security, and MFA ([cybersecurity services](/cybersecurity-services-inland-empire/)) - Microsoft 365 management and backup ([Microsoft 365 management](/microsoft-365-management/)) - Quarterly business reviews and a technology roadmap ## Is a Redlands-Based Provider Right for You? It's a fair question. If you need someone walking your office every day, a provider based in Temecula might suit you better. If you want a security-first team with 24/7 monitoring and a real plan for your technology, and you're fine with most support happening remotely and on-site visits being scheduled, we're a strong fit, and the drive is ours to make, not yours. ## Frequently Asked Questions **Temecula is farther from Redlands — can you still provide good service?** Absolutely. Our service model is built around proactive remote monitoring — we resolve most issues remotely before they impact your team. Our 24/7 SOC monitoring doesn't depend on geography. **Do you serve other Southwest Riverside County cities?** Yes — we also serve businesses in Murrieta, Lake Elsinore, and Menifee. **We're a winery/hospitality business — do you work with our industry?** Our sweet spot is professional services, manufacturing, construction, and similar established businesses. Many wine-country businesses fit that mold on the office side — accounting, HR, email, compliance, and back-office infrastructure. Tasting-room point-of-sale systems aren't our specialty, and we'll tell you that up front. If your operation runs on an office and back-office stack, we're a strong fit. --- # Managed IT Services in Redlands, California URL: https://etoptechnology.com/managed-it-services-redlands/ Type: Service Area Distance from Redlands HQ: Home base This is home. eTop Technology has been headquartered in Redlands for over 12 years, and we've watched this city grow from a quiet foothill community into a thriving business center — anchored by Esri, the University of Redlands, and a diverse base of professional services firms, nonprofits, and growing companies. We're not just a managed IT provider that serves Redlands — we're part of the Redlands business community. When you work with us, you're working with neighbors who are genuinely invested in the success of local organizations. For established Redlands businesses, we provide managed IT, cybersecurity, compliance, and strategic technology services that bring serious capabilities to organizations that value quality and relationships. ## Why Redlands Businesses Choose the Hometown IT Provider **We're already here.** Our office is at 611 W Redlands Blvd # G. When you need onsite support, we're minutes away. **We know the Redlands business landscape.** We understand the industries, compliance requirements, and technology challenges of businesses in our community. **We're invested in this community.** When we help a Redlands business strengthen their IT and security posture, we're strengthening the local economy. ## Frequently Asked Questions **What types of Redlands businesses do you work with?** We serve established professional services firms, nonprofits, healthcare-adjacent businesses, engineering companies, and educational organizations across the area. **We've been with a national IT provider — what would we gain by going local?** Speed, relationships, and accountability. We give you a dedicated team that knows your systems and your goals. When something is urgent, you can call us directly at 951-398-0021. **We're a nonprofit in Redlands — can we afford managed IT?** Nonprofits are one of our target verticals. We help organizations maximize Microsoft 365 Nonprofit licensing and find that managed IT often reduces total IT costs compared to break-fix. --- # IT Support for Construction Companies in Corona, California URL: https://etoptechnology.com/construction-it-support-corona/ Type: Industry by City Industry: Construction Companies City: Corona A construction company does not lose money slowly when its systems go down. If your project managers cannot pull up drawings, your estimators cannot finish a bid due Friday, or your accounting team cannot cut checks to keep subs on the job, the cost shows up the same day. That is the real frame for construction IT in Corona: it is not a back-office expense, it is what keeps your crews working and your bids going out on time. eTop Technology has served Inland Empire businesses for over 12 years, and construction is one of the industries we know best. We already support plumbing and site subcontractors in this corridor, so we understand how work actually happens here. ## Why Corona Contractors Work With a Local IT Partner **Corona is a gateway, and so are your jobs.** Corona sits at the western edge of the Inland Empire where Riverside County meets Orange County and the greater Los Angeles market. Your crews chase civil, commercial, and logistics build-out on both sides of that line. That means your IT has to follow the work, not stay chained to the office. We build environments where a foreman on a site off the 91 or in the Dos Lagos area has the same secure access as someone sitting at your desk. **The jobsite trailer has to be online on day one.** Superintendents run project management software, pull up plans on tablets, and video call with architects and inspectors from sites that often have no permanent internet yet. We deploy cellular internet with failover and fixed wireless where it fits, then move the gear to the next site when the job wraps. **Your field devices are walking around with your business on them.** Phones and tablets on a Corona jobsite carry project data, email, and sometimes bid numbers. When one gets lost, and on an active site it happens, we remote wipe it in minutes before it becomes a problem. ## What We Handle for Corona Construction Firms - Jobsite connectivity with cellular failover for temporary sites - Device management for field crews through Microsoft Intune - Support for Procore, Sage 300 Construction and Real Estate, Foundation, and Bluebeam - Email security that stops wire-fraud and fake-invoice attacks - Backup and disaster recovery that covers plans, contracts, and financials - Security controls documented for prime-contractor and insurance requirements ## Right Down the Freeway We are not a national provider that lists Corona on a map. We are 30 minutes east in Redlands, we already support subcontractors in this corridor, and we can be onsite the same day when it matters. If your firm is ready for IT that keeps the field connected and the bids protected, we should talk. ## Frequently Asked Questions **Our crews split time between Corona and Orange County jobsites. Can you support a workforce that moves across county lines?** Yes, and it is one of the most common situations we handle for Corona contractors. Corona sits right on the Riverside and Orange County line, so your superintendents and foremen are constantly moving between sites. We manage every company phone, tablet, and laptop through Microsoft Intune, which is Microsoft's device management platform, so your team gets the same secure access to plans, email, and project software whether they are at a site off the 91 or across the county line in Anaheim. **How fast can you actually get someone to our Corona office or yard?** Corona is about 30 minutes from our Redlands office, well inside our primary service area, so we offer same-day onsite when something needs hands on it. Most issues we resolve remotely within minutes, but when a server, a network switch, or the office internet is down, we are not dispatching a technician from another county. **Do you support Procore, Sage 300 Construction and Real Estate, and Bluebeam?** Yes. We support and manage the platforms Corona contractors actually run, including Procore for project management, Sage 300 Construction and Real Estate for job costing and accounting, Foundation, and Bluebeam Revu for takeoffs and plan markup. We handle the Microsoft 365 environment underneath them, the integrations between them, and the vendor coordination so you are not the one on hold with support. **A general contractor is asking us to fill out a cybersecurity questionnaire before we can bid. Can you help?** Yes. Prime contractors are increasingly pushing security requirements down to their subcontractors, and a questionnaire you cannot answer can cost you the bid. We put the controls in place that let you answer honestly, multi-factor authentication, endpoint protection, documented backups, and written policies, and we help you complete the paperwork so it does not sit on your desk for a week. --- # IT Support for Construction Companies in Fontana, California URL: https://etoptechnology.com/construction-it-support-fontana/ Type: Industry by City Industry: Construction Companies City: Fontana On a Fontana industrial build, a technology failure does not just slow one person down, it stalls a schedule that a developer is watching closely and that a lease may be riding on. If your virtual design team cannot sync a model, your superintendent cannot pull the coordinated drawings, or accounting cannot process a pay application, the delay shows up on a job where every day carries real money. That is the frame for construction IT in Fontana: it keeps a fast, high-stakes build moving. eTop Technology has served the Inland Empire for over 12 years, and construction is one of our core industries. Fontana has grown from its steel-town roots into one of the region's busiest industrial and commercial construction centers, and we serve it from our Redlands office, roughly 20 to 25 minutes east. ## Why Fontana Builders Work With a Local IT Partner **The jobs are enormous, and so are the connectivity gaps.** Fontana's warehouse and distribution boom along the I-10 and I-15 means tilt-up shells that stretch a quarter mile with no permanent power or internet for months. Getting reliable connectivity across that footprint is not something a consumer hotspot solves. We engineer cellular failover, fixed wireless, and real Wi-Fi coverage for the trailer, staging, and work areas. **Model coordination is bandwidth and storage that has to hold up.** Building information modeling, or BIM, generates large files and constant coordination between trades. When those files do not sync reliably between office and field, clashes get missed and rework eats the schedule. We build the network and storage strategy that keeps virtual design and construction moving. **Big teams mean a bigger attack surface.** Many Fontana builders run 50 to 200 or more people across offices, a yard, and multiple active sites. Every phone, tablet, and laptop is a door. We manage them all through Microsoft Intune, Microsoft's device management platform, with the same security policy everywhere and remote wipe on anything lost. ## What We Handle for Fontana Construction Firms - Jobsite connectivity engineered for large industrial sites - Support for BIM and virtual design tools, Autodesk, Trimble, Procore, and Bluebeam - Device management across large field and office teams - Email security that stops wire-fraud and fake-invoice attacks - Backup and disaster recovery for models, plans, and financials - Endpoint detection watched by a 24/7 security operations center ## Close Enough to Show Up We are not a national provider that also lists Fontana on a map. We are 20 to 25 minutes east in Redlands, we understand the pace of an industrial build, and we can be onsite the same day when infrastructure goes down. If your firm is ready for IT that keeps a big, fast job connected and secure, we should talk. ## Frequently Asked Questions **We build large tilt-up warehouses. How do you get reliable internet across a jobsite that big with no power yet?** This is the exact challenge Fontana's industrial builders bring us. A quarter-mile-long distribution center shell has no permanent power or internet for months. We deploy cellular internet with failover and fixed wireless, then engineer Wi-Fi coverage for the trailer, staging areas, and the parts of the slab where your team actually works. When the job wraps, we move the gear to your next site. **Our teams run building information modeling and coordinate models between trades. Does your support cover that?** Yes. Building information modeling, or BIM, means large 3D model files and constant clash-detection coordination between trades, and those files are demanding on both network and storage. We support the tools your virtual design and construction team runs, including Autodesk, Trimble, Procore, and Bluebeam, and we make sure the model files sync reliably between the office and the field instead of living on someone's laptop. **How fast can you get to our Fontana office or jobsite?** Fontana is about 20 to 25 minutes from our Redlands office, so we offer same-day onsite when something needs hands on it. We resolve most issues remotely through proactive monitoring, but when infrastructure is down we are close enough to send someone the same day rather than the next. **We run two shifts on our builds. Can you support after-hours operations?** Yes. Our security operations center monitors your environment 24/7/365, so threats are caught overnight, not discovered in the morning. For after-hours IT emergencies, our escalation process makes sure critical issues get addressed promptly regardless of the shift. --- # IT Support for Construction Companies in Ontario, California URL: https://etoptechnology.com/construction-it-support-ontario/ Type: Industry by City Industry: Construction Companies City: Ontario For an Ontario construction firm building distribution centers, technology failure is not a nuisance, it is a threat to a delivery date that an owner and their future tenants are counting on. If your estimators cannot finish a bid, your project managers cannot push submittals, or your accounting team cannot process pay applications, the delay lands on a schedule that may carry liquidated damages. That is the frame for construction IT in Ontario: it protects the bid that wins the work and the schedule that keeps you profitable on it. eTop Technology has served the Inland Empire for over 12 years, and construction is one of our core industries. Ontario is one of the region's most dynamic commercial cities, anchored by Ontario International Airport and a massive logistics and distribution build-out, and we serve it from our Redlands office, about 25 minutes east. ## Why Ontario Contractors Work With a Local IT Partner **The bids are big, which makes them targets.** A large logistics or distribution-center estimate is the most valuable document your firm produces, and criminals know it. Business email compromise, where an attacker takes over an account and intercepts or redirects bid and payment communications, has hit construction hard. We protect that data with access controls, encryption, and email security built to stop these exact attacks. **Tight schedules leave no room for downtime.** Distribution centers get built against aggressive delivery dates because an owner has leases and tenants waiting. A ransomware event that freezes your project files and accounting does not just cost IT time, it feeds straight into liquidated-damages exposure. We keep systems monitored around the clock and back them up so an incident is a restore, not a shutdown. **A distribution site is huge, and your field team still needs the office.** Superintendents work across sprawling sites near the airport corridor, pulling plans on tablets and filing daily reports. We deploy cellular connectivity with failover and manage every device through Microsoft Intune, Microsoft's device management platform, so a lost tablet is a quick remote wipe rather than a data exposure. ## What We Handle for Ontario Construction Firms - Bid and estimate protection with encryption and strict access controls - Email security that stops business email compromise and wire fraud - Jobsite connectivity for large distribution and logistics sites - Support for Procore, estimating software, and Microsoft 365 - Device management for field crews through Microsoft Intune - Backup and disaster recovery tested against a real ransomware scenario ## Twenty-Five Minutes East We are not a national provider that also lists Ontario on a map. We are 25 minutes east in Redlands, we understand the schedule pressure and the dollars riding on a distribution build, and we can be onsite the same day when it counts. If your firm is ready for IT that protects the bid and the delivery date behind it, we should talk. ## Frequently Asked Questions **We bid large logistics and distribution projects. How do you protect our estimates and bid numbers?** On a major distribution-center bid, your estimate is the most valuable file in the company, and a competitor or a compromised email account seeing it can cost you the job. We protect it with encryption, strict access controls, multi-factor authentication, and email security that stops the account-takeover attacks used to intercept bid communications. Your estimating data stays where it belongs, in your hands until you submit. **Our delivery schedules carry liquidated damages. What does downtime actually cost us?** That is exactly the right question. When an owner has tenants and lease commitments waiting on a distribution center, your contract likely has liquidated damages for late delivery. IT downtime that stalls coordination, submittals, or pay applications feeds directly into that risk. We keep systems up with proactive monitoring and defend against ransomware that could freeze a schedule, because a restore is cheaper than a penalty. **How fast can you get to our Ontario office or a jobsite near the airport?** Ontario is about 25 minutes from our Redlands office, so we offer same-day onsite when something needs hands on it. We serve businesses throughout Ontario, including the airport industrial corridor and the commercial districts along Haven Avenue, and we resolve most issues remotely within minutes. **Do you support Procore and our estimating software across the office and the field?** Yes. We support the project management and estimating platforms Ontario builders run, including Procore, along with the Microsoft 365 environment underneath them. We make sure your project managers in the office and your superintendents on a sprawling distribution site are working from the same current data, not emailing versions back and forth. --- # IT Support for Construction Companies in Riverside, California URL: https://etoptechnology.com/construction-it-support-riverside/ Type: Industry by City Industry: Construction Companies City: Riverside For a Riverside construction firm, downtime is not an inconvenience, it is a schedule slip on a job that may carry penalties. If your team cannot reach project files, submit a pay application, or run certified payroll on deadline, the cost lands immediately, and on a public works contract it can land in the form of liquidated damages. That is the real frame for construction IT here: it protects your schedule, your compliance, and your standing with the agencies you want to keep bidding with. eTop Technology has served the Inland Empire for over 12 years, and construction is one of our core industries. Riverside is the economic hub of the region, and we serve it from our office in nearby Redlands, just 15 minutes away. ## Why Riverside Contractors Work With a Local IT Partner **Public and municipal work carries obligations private jobs do not.** Riverside is where county and city government sit, and a lot of local construction revenue runs through public works. Those jobs come with certified payroll, records retention, and cybersecurity language in the contract. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption the week an audit or a claim shows up. **Prime-contractor security requirements flow down to you.** On larger and federally funded work, the general contractor's security obligations become your obligations. When a prime sends a subcontractor a questionnaire demanding multi-factor authentication and documented backups, a contractor who cannot answer loses the bid. We make sure you can. **Your field crews need the office in their pocket.** Superintendents pull plans on tablets and submit inspection photos from sites that may not have permanent internet. We deploy cellular connectivity with failover and manage every device through Microsoft Intune, Microsoft's device management platform, so a lost tablet is a remote wipe, not a data breach. ## What We Handle for Riverside Construction Firms - Certified payroll and prevailing-wage system support, including LCPtracker and eMars - Support for Procore, Foundation, Sage, and Bluebeam - Jobsite connectivity for temporary and long-term sites - Email security that stops wire-fraud and fake-invoice schemes - Backup and disaster recovery tested against a real ransomware scenario - Security controls documented for government and prime-contractor requirements ## Fifteen Minutes Away We are not a national vendor that also lists Riverside on a map. We are part of this business community, 15 minutes east in Redlands, and we understand the compliance environment public works contractors here actually operate in. If your firm is ready for IT that protects the schedule and the paperwork behind it, we should talk. ## Frequently Asked Questions **We do public works for the County and City of Riverside. Do government contracts change our IT requirements?** Yes, more than most contractors expect. Public works jobs come with certified payroll obligations, records-retention rules, and increasingly, cybersecurity language written into the contract itself. Prime contractors on federal-adjacent work are also pushing security requirements down to their subs. We put the controls and documentation in place, multi-factor authentication, endpoint protection, tested backups, and written policies, so you can sign those clauses and mean it. **How fast can you get to our Riverside office?** Our Redlands office is about 15 minutes from downtown Riverside, which is closer than most Riverside contractors' own crews get to some of their jobsites. When a server, network, or the office internet needs hands on it, we are there quickly. Most day-to-day issues we resolve remotely within minutes. **Do you support certified payroll systems like LCPtracker along with our project software?** Yes. We support the certified payroll and prevailing-wage reporting tools that public works requires, including LCPtracker and eMars, alongside project management and accounting platforms like Procore, Foundation, and Sage. We keep the Microsoft 365 environment underneath them secure and make sure the data flows between systems without manual re-keying. **What happens to a public works schedule if we get hit with ransomware?** It stops, and on a government job that can mean liquidated damages and a damaged relationship with an agency you want to bid with again. Ransomware that locks your project files and accounting freezes the whole job. We defend against it with endpoint detection watched by a 24/7 security operations center, plus backups we test, so a bad day is a restore instead of a shutdown. --- # IT Support for Engineering Firms in Ontario, California URL: https://etoptechnology.com/engineering-it-support-ontario/ Type: Industry by City Industry: Engineering Firms City: Ontario For a civil or site-engineering firm in Ontario, the pace of the work is set by how fast the region is building. Warehouses, distribution centers, and industrial parks go up on aggressive schedules, and the grading plans, earthwork models, and survey deliverables behind them are due yesterday. When a file server crawls or field data is stuck on a laptop in a truck, the whole project timeline slips, and every hour is billable engineering time. That is the honest frame for engineering IT here. eTop Technology serves Ontario engineering firms from our Redlands office, about 25 minutes east, with same-day onsite when you need hands on a problem. Engineering is a practice we know, with real engineering clients across the Inland Empire, and we build IT around how site and civil work actually run. ## Ontario Is a Development Engine Ontario is one of the Inland Empire's most dynamic business cities, anchored by Ontario International Airport, a massive logistics and distribution base, and constant commercial and industrial development along the I-10 and I-15. That build-out drives a steady demand for civil, site, and land-development engineering: grading and drainage, earthwork balancing, utility design, and the survey work that feeds all of it. These projects generate very large datasets and move between the field and the office constantly, which puts real pressure on storage, connectivity, and data protection. ## What We Handle for Engineering Firms - Workstation builds and management tuned for AutoCAD, Civil 3D, and survey and point-cloud software - High-throughput storage and networks designed for gigabyte-scale grading models, drawings, and LiDAR point clouds - Secure field-to-office access so crews can pull and push project data without email or personal cloud accounts - Backup and versioning so a hard-won survey or a grading model is never one bad drive away from gone - Long-term project retention that survives years past project close, when liability questions surface - Design intellectual property protection: access controls, data-loss-prevention (DLP), and endpoint detection and response (EDR) ## Field Data Is Not Safe Until It Is in the System The riskiest moment for site and survey data is the gap between capture and the project folder. A day of drone flights or total-station survey work sitting on a memory card or a field laptop is not backed up, not secured, and not recoverable if the device is lost or stolen. We build a secure, quick path to get field captures into managed storage where they are protected and versioned, so a firm never has to send a crew back out to reshoot data it already paid to collect. We also handle the license management for expensive engineering seats so you are not paying for capacity you do not use. ## Same-Day Onsite, and We Speak Engineering We are not a national help desk that also lists Ontario on a map. We are about 25 minutes away in Redlands, we offer same-day onsite when it is needed, and engineering is work we support. If your firm wants IT that keeps CAD and survey data fast, field-connected, and protected, we should talk. ## Frequently Asked Questions **Do you serve engineering firms near Ontario International Airport and the industrial corridor?** Yes. We support engineering and design firms throughout Ontario, including the airport industrial corridor, the Inland Empire Business Center, the Ontario Mills area, and the Haven Avenue commercial district. Onsite requests are triaged by business impact, with same-day onsite when hardware needs hands on it. **How do you handle huge survey and grading files from large development sites?** Ontario's warehouse and industrial build-out produces enormous site data. A drone or LiDAR (light detection and ranging) point cloud of a distribution-center site, plus the Civil 3D grading and earthwork model, can run to many gigabytes. We design storage and network throughput so your team is not waiting on files, and we back the data up so a lost drive or a ransomware event does not erase a survey you cannot easily recapture. **Our crews are in the field a lot. Can they reach project files securely?** Yes. Site and civil work lives half in the field and half in the office, and dragging large files around on email or personal cloud accounts is both slow and a security risk. We set up secure remote access so field staff can reach the data they need and get survey and photo captures back into the project folder quickly and safely. **Can you be onsite quickly if something fails on a deadline?** Our Redlands office is about 25 minutes away, so we offer same-day onsite when something needs hands on it, and we resolve most issues remotely and immediately. On a fast-moving development schedule, a dead server or workstation gets a fast response, not a next-week appointment. --- # IT Support for Engineering Firms in Rancho Cucamonga, California URL: https://etoptechnology.com/engineering-it-support-rancho-cucamonga/ Type: Industry by City Industry: Engineering Firms City: Rancho Cucamonga For a structural or mechanical, electrical, and plumbing (MEP) firm in Rancho Cucamonga, the most expensive IT failures are the ones that break coordination. Building information modeling (BIM) is a team sport: your engineers are linking models with architects and other consultants, running clash detection, and pushing updates on a shared schedule. When the central model goes slow or a sync corrupts, it is not one engineer who stalls, it is every discipline waiting on the model, all billing time. That is the honest frame for engineering IT here. eTop Technology serves Rancho Cucamonga engineering firms from our Redlands base, about 25 minutes away, with same-day onsite when you need hands on a problem. Engineering is a practice we know, with real engineering clients across the Inland Empire, and we build IT around how design coordination actually works. ## A Corridor Built on Commercial Development Rancho Cucamonga is one of the best places to do business in the Inland Empire, with a dense professional-services corridor along Haven Avenue and Foothill Boulevard and a steady stream of commercial, retail, and mixed-use development, including the Victoria Gardens district. That development pipeline keeps structural, civil, and MEP firms busy designing for real buildings on real schedules, often in coordination with multiple outside consultants. Foothill sites also mean seismic design work, where the structural calculations and models behind a project are not something you can afford to lose or corrupt. ## What We Handle for Engineering Firms - Workstation builds and management tuned for Revit, AutoCAD, Civil 3D, and Navisworks clash detection - High-throughput storage and networks designed for large BIM models and gigabyte-scale drawings - Backup and versioning for central models so a bad sync or a corrupt file does not cost a coordination day - Long-term project retention that survives years past project close, when liability questions surface - Secure sharing and remote access for multi-firm BIM coordination without dragging models through email - Design intellectual property protection: access controls, data-loss-prevention (DLP), and endpoint detection and response (EDR) ## Coordination Only Works If the Model Is Trustworthy The whole value of BIM is that everyone works against one coordinated model. That only holds if the file is fast, backed up, and recoverable. We design storage and network so the central model performs when the whole team is in it, and we keep versioned backups so a corrupt sync or an accidental overwrite is a quick restore, not a redraw. We also handle the license management for expensive Revit and AutoCAD seats so you are paying for seats you actually use. ## Same-Day Onsite, and We Speak Engineering We are not a national help desk that also lists Rancho Cucamonga on a map. We are about 25 minutes away in Redlands, we offer same-day onsite when it is needed, and engineering is work we support. If your firm wants IT that keeps BIM coordination fast and your design IP protected, we should talk. ## Frequently Asked Questions **Do you serve engineering firms along the Haven Avenue and Foothill Boulevard corridors?** Yes. We support engineering and design firms throughout Rancho Cucamonga, including the Haven Avenue professional corridor, the Foothill Boulevard commercial strip, Terra Vista, and the business parks near Victoria Gardens. Onsite requests are triaged by business impact, with same-day onsite when hardware needs hands on it. **How do you keep Revit and BIM coordination running smoothly?** Building information modeling (BIM) work is collaborative, and structural and MEP (mechanical, electrical, plumbing) firms are constantly linking models with architects and other consultants. When the central model is slow or a sync fails, coordination stalls for the whole team. We tune workstations, storage, and network throughput for Revit and Navisworks clash detection, and we keep model files backed up and versioned so a corrupt sync does not cost a day. **Can you be onsite quickly if we have a hardware failure?** Our Redlands office is about 25 minutes away, so we offer same-day onsite when something needs hands on it, and we resolve most issues remotely and immediately. For a firm on a submittal deadline, a dead workstation or a downed server gets a fast response rather than a next-week appointment. **How do you protect our designs and proposals from theft or loss?** Your models, calculations, and fee proposals are the firm's intellectual property and its competitive edge. We put access controls, data-loss-prevention rules, endpoint detection, and tested backups in place so a design cannot be emailed to a personal account or walked out on a USB drive, and so a ransomware event does not take your project archive with it. --- # IT Support for Engineering Firms in Redlands, California URL: https://etoptechnology.com/engineering-it-support-redlands/ Type: Industry by City Industry: Engineering Firms City: Redlands An engineer who cannot open a project file is not just inconvenienced, they are billing a client for time spent watching a spinning cursor. Multiply that across a team of engineers and designers at $80 to $150 an hour and a slow file server or a botched backup stops being an IT annoyance and becomes a direct hit to the firm's margin. For a Redlands engineering firm, that is the honest frame for IT: it is the thing standing between your billable hours and lost project time. eTop Technology has been headquartered in Redlands for over 12 years, a few minutes from most of the firms we serve. Engineering is one of the practices we know well, and we have real engineering clients here in the Inland Empire. We provide managed IT and cybersecurity built specifically for how design work happens. ## Redlands Is a Geospatial Town Redlands is the home of Esri, the company that essentially defined modern geographic information systems (GIS), and that gravity is felt across the local civil, survey, and environmental firms. If your team runs ArcGIS Pro against large geodatabases, works with parcel and terrain data, or ties survey deliverables to mapping, you have workstation and storage demands that a generic office IT shop does not understand. We size machines for the graphics and memory that geospatial and computer-aided design (CAD) work actually need, and we keep the data serving quickly when the whole office is in it at once. ## What We Handle for Engineering Firms - Workstation builds and management tuned for AutoCAD, Civil 3D, Revit, MicroStation, and ArcGIS Pro - High-throughput storage and networks designed for gigabyte-scale drawings, building information modeling (BIM) files, and point clouds - Backup, versioning, and long-term retention for project data that has to survive years past project close - License management so expensive engineering seats are tracked and not wasted - Secure remote access so field staff and principals can reach heavy files without dragging them across email - Design intellectual property protection: access controls, data-loss-prevention (DLP), and endpoint detection and response (EDR) ## The Liability Tail Nobody Budgets For Engineering work carries a long liability tail. California's statute of repose can put a stamped design in question years after the project is finished, which means the drawings, calculations, and correspondence behind it are records you cannot simply let age off a drive. We build retention and backup so a decade-old project file is recoverable, not a gamble, and so an accidental deletion or a ransomware event does not erase the proof of what your engineers actually sealed. ## Right Down the Road We are not a national provider that also lists Redlands on a map. We are part of this business community, a few minutes from your office, and engineering is work we support here. If your firm wants IT that keeps CAD and GIS fast and your design IP protected, we should talk. ## Frequently Asked Questions **Do you support Esri ArcGIS and GIS workstations for Redlands firms?** Yes. Redlands is the home of Esri, and geographic information system (GIS) work is common here for civil, survey, and environmental firms. We size workstations for ArcGIS Pro, keep large geodatabases performing, and make sure your GIS data is backed up and versioned like the project asset it is. We also handle the Microsoft 365 and network layer underneath it. **How fast can you be onsite at our Redlands office?** Our office is at 611 W Redlands Blvd # G, minutes from most of the firms we serve here. When a plotter, a workstation, or a server needs hands on it, we are genuinely down the road, not routing a technician from another county. Most issues we resolve remotely and immediately. **Can you handle the huge CAD and survey files our engineers work with?** Yes. A Civil 3D surface, a Revit model, or a drone-collected point cloud can run into the gigabytes, and your team opens and saves these all day. We design storage and network so five engineers pulling large files at once do not sit watching progress bars. That wasted time is billable time you are giving away. **How do you protect our design work and sealed drawings?** Your stamped drawings, calculations, and proposals are the firm's intellectual property and carry professional-engineer liability. We put access controls, data-loss-prevention rules, endpoint detection, and tested backups in place so designs cannot walk out the door and retained project records are there years later if a claim arises. --- # IT Support for Engineering Firms in Riverside, California URL: https://etoptechnology.com/engineering-it-support-riverside/ Type: Industry by City Industry: Engineering Firms City: Riverside For a Riverside engineering firm, the cost of an IT failure is easiest to see on a bid day. A civil or structural firm that misses a county submission deadline because a portal upload stalled or the file server hung does not lose an hour of productivity, it loses a contract that may have been worth six or seven figures. That is the honest frame for engineering IT here: it protects both the billable hour and the deadline. eTop Technology serves Riverside engineering firms from our office in nearby Redlands, about 15 minutes away. Engineering is a practice we know, with real engineering clients across the Inland Empire, and we build IT specifically for how design and public-works consulting actually run. ## Riverside Runs on Public Infrastructure Work Riverside is the county seat and the economic hub of the Inland Empire, and a great deal of the engineering here is tied to public agencies: roads and interchanges, flood control and water, grading and drainage for civil projects, and structural work for institutional buildings. The University of California, Riverside and the region's steady growth feed a pipeline of infrastructure and development that keeps civil, structural, and survey firms busy. That work comes with public-bid schedules, prevailing-wage record-keeping, and deliverables that go straight into an agency's permanent record, all of which put unusual demands on IT. ## What We Handle for Engineering Firms - Workstation builds and management tuned for AutoCAD, Civil 3D, Revit, MicroStation, and Bentley OpenRoads - High-throughput storage and networks designed for gigabyte-scale drawings, models, and survey point clouds - Reliable connectivity and support coverage built around bid-submission and permit deadlines - Backup, versioning, and long-term retention for project records that agencies and liability both require years later - Secure remote access so field crews and reviewers can reach heavy files without emailing them around - Design intellectual property and infrastructure-data protection: access controls, data-loss-prevention (DLP), and endpoint detection and response (EDR) ## Records That Have to Outlive the Project Public-works and infrastructure projects generate records that matter long after the ribbon is cut. Between agency retention expectations, prevailing-wage documentation, and California's long professional-liability window, the calculations and stamped drawings behind a project are things you have to be able to produce years down the line. We design backup and retention so a closed project is recoverable on demand, not a hope, and so a single ransomware event or accidental deletion cannot wipe out the proof of your firm's work. ## Fifteen Minutes Away, and We Speak Engineering We are not a national help desk that also lists Riverside on a map. We are 15 minutes away in Redlands, we understand the local public-agency environment, and engineering is work we support. If your firm wants IT that keeps CAD fast, hits every deadline, and protects your design data, we should talk. ## Frequently Asked Questions **How quickly can you get onsite to our Riverside office?** Our Redlands office is about 15 minutes from downtown Riverside. When a server, plotter, or workstation needs hands on it, we are there quickly, not dispatching from another county. Most day-to-day issues we resolve remotely and immediately, so a slow workstation does not cost an engineer a billable afternoon. **Can you make sure we do not miss an electronic bid submission because of an IT failure?** Yes. For firms bidding county and municipal public-works projects, a portal that will not upload or an email that bounces at 1:59 on a 2:00 deadline can cost a contract worth far more than a year of IT. We build reliable connectivity, redundancy, and support availability around those deadline windows so the technology is not the reason a bid is late. **How do you handle the large CAD and survey files civil work produces?** A Civil 3D corridor model, a drainage study, or a LiDAR (light detection and ranging) point cloud of a road alignment can be enormous, and your team saves versions of them constantly. We design storage and network throughput so large-file work does not bottleneck, and we back the data up in a way that survives an accidental overwrite or a ransomware event. **Our plans touch public infrastructure. Are there security concerns?** Yes. Drawings for roads, flood control, water, and public facilities are sensitive, and public agencies increasingly expect their consultants to protect them. We put access controls, data-loss-prevention, endpoint detection, and documented backups in place so infrastructure design data stays where it belongs and you can show reasonable safeguards when an agency asks. --- # IT Support for Law Firms in Corona, California URL: https://etoptechnology.com/law-firm-it-support-corona/ Type: Industry by City Industry: Law Firms City: Corona An attorney who cannot open case files is losing money by the minute. At $400 an hour that is about $6.67 every minute, per attorney, and it does not stop until the system is back. For a Corona firm, that is the real frame for IT: it is not a back-office line item, it is the thing standing between your billable hours and a very quiet office. eTop Technology has been headquartered in nearby Redlands for over a decade, and law firms are one of the practices we know best. We provide managed IT and cybersecurity built specifically for how legal work happens at the western edge of the Inland Empire. ## Why Corona Firms Work With a Local Legal-IT Provider **We build for firms that practice across county lines.** Corona sits where Riverside County meets Orange County and the greater Los Angeles market, and a lot of firms here carry that geography into their caseload. Attorneys work matters in more than one courthouse and spend real time out of the office. We architect for that with secure remote access, conditional access, and managed mobile devices, so a laptop at a job-site deposition is as protected as the desktop back at the firm. **We protect privilege as a design principle.** Attorney-client privilege is only as strong as the systems protecting it. If email can be intercepted, file sharing is unsecured, or a stolen laptop opens your whole case-management system, privilege is at risk. We use encryption in transit and at rest, device management, and data-loss-prevention controls that keep client information where it belongs. ## What We Handle for Law Firms - Secure email with advanced anti-phishing and encryption - Document management sized for high-volume litigation productions - Secure external sharing with clients, co-counsel, opposing counsel, and experts - Practice-management support and vendor coordination (Clio, PracticePanther, NetDocuments, and others) - Mobile device management for attorneys working from court, home, or a job site - Compliant backup and disaster recovery for client files - Security-awareness training written around legal scenarios, not generic ones ## The Compliance Picture for a Corona Firm Most firms carry more than one obligation at once. A personal-injury or workers-compensation practice touches HIPAA through medical records. A firm holding client trust and financial data falls under FTC Safeguards awareness. California's privacy law adds another layer, and increasingly a cyber-insurance renewal now depends on security controls written into the fine print. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption the week a claim or an audit shows up. ## Thirty Minutes East, Not a Half-Day Dispatch We are not a national provider that also lists Corona on a map. We are part of this Inland Empire business community, and legal is a practice we have supported here for years. When you need us onsite, we come the same day. When we can fix it remotely, it is already handled. If your firm is ready for IT that protects both the billable hour and the privilege behind it, we should talk. ## Frequently Asked Questions **Our firm practices in both Riverside and Orange County. Can our IT keep up with that?** Yes. Corona sits at the western gateway of the Inland Empire, and many firms here carry matters across county and courthouse lines. We build secure remote access and mobile device management so an attorney can work a file from the office, from home, or from a courthouse in another county without your client data ever leaving a controlled environment. **How fast can you be onsite at our Corona office?** Our office is at 611 W Redlands Blvd # G, about thirty minutes east. When something genuinely needs hands on it, we provide same-day onsite support, and we keep spare paths in place so a single failure does not stop the firm. Most issues we resolve remotely and immediately, before anyone has to wait for a technician. **We do a lot of construction and business litigation. Does that affect our IT?** It does. Construction defect and business litigation generate enormous document sets, plans, photos, expert reports, and productions that have to be stored, versioned, and shared securely with co-counsel and experts. We size your document management and storage for that volume and lock down external sharing so nothing privileged leaks through a convenience tool. **Can you help us meet California State Bar technology competence duties?** Yes. California expects attorneys to apply reasonable security measures to client data, and State Bar opinions have pushed that expectation into encryption, public networks, and e-discovery. We put the documented policies, access controls, training, and tested backups in place so reasonable measures are something you can show, not just claim. --- # IT Support for Law Firms in Ontario, California URL: https://etoptechnology.com/law-firm-it-support-ontario/ Type: Industry by City Industry: Law Firms City: Ontario An attorney who cannot open case files is losing money by the minute. At $400 an hour that is about $6.67 every minute, per attorney, and it does not stop until the system is back. For an Ontario firm, that is the real frame for IT: it is not a back-office line item, it is the thing standing between your billable hours and a very quiet office. eTop Technology has been headquartered in nearby Redlands for over a decade, and law firms are one of the practices we know best. We provide managed IT and cybersecurity built specifically for how legal work happens in one of the Inland Empire's busiest commercial cities. ## Why Ontario Firms Work With a Local Legal-IT Provider **We understand the economy your clients come from.** Ontario is anchored by its international airport and a dense logistics, warehousing, and distribution base. The legal work that grows around it, transportation and regulatory matters, commercial contracts, employment, and business litigation, is document-heavy and deadline-driven. We build storage, document management, and secure sharing that can carry that volume without slowing your attorneys down. **We protect privilege as a design principle.** Attorney-client privilege is only as strong as the systems protecting it. If email can be intercepted, file sharing is unsecured, or a stolen laptop opens your whole case-management system, privilege is at risk. We use encryption in transit and at rest, conditional access, device management, and data-loss-prevention controls that keep client information where it belongs. ## What We Handle for Law Firms - Secure email with advanced anti-phishing and encryption - Document management and secure external sharing with clients, opposing counsel, and experts - Practice-management support and vendor coordination (Clio, PracticePanther, NetDocuments, and others) - Mobile device management for attorneys and staff working across locations - Compliant backup and disaster recovery for client files - Security-awareness training written around legal scenarios, not generic ones - Microsoft 365 optimization for legal workflows ## The Compliance Picture for an Ontario Firm Most firms carry more than one obligation at once. A personal-injury or employment practice touches HIPAA through medical records. A firm holding client trust and financial data falls under FTC Safeguards awareness. California's privacy law adds another layer, and a cyber-insurance renewal now depends on security requirements written into the fine print. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption the week a claim or an audit shows up. ## Same-Day Onsite, Round-the-Clock Watch We are not a national provider that also lists Ontario on a map. We are part of this Inland Empire business community, and legal is a practice we have supported here for years. When you need us onsite, we come the same day. When we can fix it remotely, it is already handled. If your firm is ready for IT that protects both the billable hour and the privilege behind it, we should talk. ## Frequently Asked Questions **Our firm serves logistics and transportation clients. Does that shape our IT?** It does. Firms built around the Ontario airport and freight economy, transportation, warehousing, employment, and commercial work, tend to run high volumes of contracts, driver and employee records, and regulatory documents. We size your document management and storage for that load and lock down external sharing so nothing privileged leaves through an unmanaged tool. **How fast can you be onsite at our Ontario office?** Our office is at 611 W Redlands Blvd # G, about twenty-five minutes east. When something genuinely needs hands on it, we provide same-day onsite support, and we keep backup paths in place so one failure does not stop the firm. Most issues we resolve remotely and immediately, before anyone waits on a technician. **A lot of our staff and clients are distributed. How do you keep that secure?** Ontario firms often work across multiple locations and with clients spread across Southern California. We build secure remote access, conditional access, and managed mobile devices so an attorney or paralegal can work a file from anywhere without client data ever leaving a controlled environment, and without leaning on a consumer file-sharing app that puts privilege at risk. **Can you help us meet California State Bar technology competence duties?** Yes. California expects attorneys to apply reasonable security measures to client data, and State Bar opinions have extended competence into encryption, public networks, and e-discovery. We put the documented policies, access controls, training, and tested backups in place so reasonable measures are something you can show, not just claim. --- # IT Support for Law Firms in Rancho Cucamonga, California URL: https://etoptechnology.com/law-firm-it-support-rancho-cucamonga/ Type: Industry by City Industry: Law Firms City: Rancho Cucamonga An attorney who cannot open case files is losing money by the minute. At $400 an hour that is about $6.67 every minute, per attorney, and it does not stop until the system is back. For a Rancho Cucamonga firm, that is the real frame for IT: it is not a back-office line item, it is the thing standing between your billable hours and a very quiet office. eTop Technology has been headquartered in nearby Redlands for over a decade, and law firms are one of the practices we know best. We provide managed IT and cybersecurity built specifically for how legal work happens in the west valley. ## Why Rancho Cucamonga Firms Work With a Local Legal-IT Provider **We match the sophistication of the firms here.** Rancho Cucamonga has one of the densest concentrations of professional-services firms in the Inland Empire, from litigation and family law to estate planning and business practices, many working near Victoria Gardens, along Haven Avenue, and around the Rancho Cucamonga District courthouse. These are established firms that need more than break-fix. We bring a team, a documented security posture, and a technology roadmap. **We protect privilege as a design principle.** Attorney-client privilege is only as strong as the systems protecting it. If email can be intercepted, file sharing is unsecured, or a stolen laptop opens your whole case-management system, privilege is at risk. We build firm environments with encryption in transit and at rest, conditional access, device management, and data-loss-prevention controls that keep client information where it belongs. ## What We Handle for Law Firms - Secure email with advanced anti-phishing and encryption - Document management and secure external sharing with clients, opposing counsel, and experts - Practice-management support and vendor coordination (Clio, PracticePanther, NetDocuments, and others) - Mobile device management for attorneys working from court or home - Compliant backup and disaster recovery for client files - Security-awareness training written around legal scenarios, not generic ones - Microsoft 365 optimization for legal workflows ## The Compliance Picture for a Rancho Cucamonga Firm Most firms carry more than one obligation at once. An estate-planning or elder-law practice touches HIPAA through medical records. A firm holding client trust and financial data falls under FTC Safeguards awareness. California's privacy law adds another layer, and a cyber-insurance renewal now hinges on security requirements written into the fine print. Many firms here discover the gaps only when facing an audit, a renewal, or a breach. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption when it counts. ## A Roadmap, Not Just a Help Desk We are not a national provider that also lists Rancho Cucamonga on a map. We are part of this Inland Empire business community, twenty-five minutes away, and legal is a practice we have supported here for years. If your firm is ready for IT that protects both the billable hour and the privilege behind it, we should talk. ## Frequently Asked Questions **We practice in the Rancho Cucamonga courthouse and across San Bernardino County. Can our IT support that?** Yes. The Rancho Cucamonga District courthouse serves the west valley, and firms here often carry matters across San Bernardino County. We keep your electronic filing, Microsoft 365, and connectivity stack stable and monitored so a court deadline never turns into an IT problem, and we build secure remote access for attorneys working outside the office. **How fast can you be onsite at our Rancho Cucamonga office?** Our office is at 611 W Redlands Blvd # G, about twenty-five minutes away. When something genuinely needs hands on it, we provide same-day onsite support. Most issues we resolve remotely and immediately, so your attorneys are not sitting idle waiting for a technician to arrive. **We're an established firm. What does eTop add beyond fixing what breaks?** A team and a plan. Beyond day-to-day support, we architect your security posture around privilege protection, keep your compliance documentation audit-ready, manage your Microsoft 365 environment, and give you a technology roadmap that matches where the firm is headed. Many professional-services firms here started on consumer-grade IT and have quietly outgrown it. **Can you help us meet California State Bar technology competence duties?** Yes. California expects attorneys to understand and apply reasonable security measures for client data, and formal opinions have extended competence into encryption, public networks, and e-discovery. We put the documented policies, access controls, training, and tested backups in place that let you demonstrate reasonable measures if you are ever asked. --- # IT Support for Law Firms in Redlands, California URL: https://etoptechnology.com/law-firm-it-support-redlands/ Type: Industry by City Industry: Law Firms City: Redlands An attorney who cannot open case files is losing money by the minute. At $400 an hour that is about $6.67 every minute, per attorney, and it does not stop until the system is back. For a Redlands firm, that is the real frame for IT: it is not a back-office line item, it is the thing standing between your billable hours and a very quiet office. eTop Technology has been headquartered in Redlands for over a decade, and law firms are one of the practices we know best. We provide managed IT and cybersecurity built specifically for how legal work happens here. ## Why Redlands Firms Work With a Local Legal-IT Provider **We are already here.** Our office is on West Redlands Boulevard, minutes from the courthouse and from most of the firms we serve. When you need someone onsite, you are not waiting on a technician dispatched from Orange County. **We understand legal, not just IT.** Attorney-client privilege is only as strong as the systems protecting it. If email can be intercepted, file sharing is unsecured, or a stolen laptop opens your whole case-management system, privilege is at risk. We build firm environments with privilege protection as a design principle: encryption in transit and at rest, conditional access, device management, and data-loss-prevention controls that keep client information where it belongs. **We help you meet California's competence duties.** California expects attorneys to apply reasonable security measures to client data, and State Bar guidance has pushed that expectation into areas like e-discovery. We put the documented policies, access controls, security-awareness training, and tested backups in place so reasonable measures are something you can actually show, not just claim. ## What We Handle for Law Firms - Secure email with advanced anti-phishing and encryption - Document management and secure external sharing with clients, opposing counsel, and experts - Practice-management support and vendor coordination (Clio, PracticePanther, NetDocuments, and others) - Mobile device management for attorneys working from court or home - Compliant backup and disaster recovery for client files - Security-awareness training written around legal scenarios, not generic ones - Microsoft 365 optimization for legal workflows ## The Compliance Picture for a Redlands Firm Most firms carry more than one obligation at once. A firm handling medical records for personal-injury or elder-law work touches HIPAA. A firm holding client financial data falls under FTC Safeguards awareness. Every firm carries State Bar competence duties, and increasingly, a cyber-insurance policy with security requirements written into the fine print that your renewal now depends on. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption the week a claim or an audit shows up. ## Right Down the Road We are not a national provider that also lists Redlands on a map. We are part of this business community, ten minutes from your office, and legal is a practice we have supported here for years. If your firm is ready for IT that protects both the billable hour and the privilege behind it, we should talk. ## Frequently Asked Questions **Do you support Redlands firms on Clio, PracticePanther, or NetDocuments?** Yes. We support and manage the practice-management and document systems law firms actually run, including Clio, PracticePanther, and NetDocuments, plus the Microsoft 365 environment underneath them. We handle integration, backup, and vendor coordination so you are not the one on hold with support. **How fast can you be onsite at our Redlands office?** Our office is at 611 W Redlands Blvd # G. When something is urgent and needs hands on it, we are minutes away, not routing a technician from another county. For most issues we resolve remotely and immediately. **Can you help us meet California State Bar technology competence duties?** Yes. California expects attorneys to understand and apply reasonable security measures for client data, and formal opinions have extended competence to areas like e-discovery. We put the documented policies, access controls, training, and backups in place that let you demonstrate reasonable measures if you are ever asked. **We are a small firm. Is managed IT worth it for us?** For a firm billing at attorney rates, a half-day outage costs more than a month of proper IT. We size the engagement to the firm. Most small and mid-size Redlands firms find that managed IT lowers total technology cost versus break-fix while removing the risk that quietly sits in an unmanaged environment. --- # IT Support for Law Firms in Riverside, California URL: https://etoptechnology.com/law-firm-it-support-riverside/ Type: Industry by City Industry: Law Firms City: Riverside An attorney who cannot open case files is losing money by the minute. At $400 an hour that is about $6.67 every minute, per attorney, and it does not stop until the system is back. In Riverside, where a filing deadline at the courthouse does not move because your internet did, that frame is even sharper: IT is not a back-office line item, it is what stands between your billable hours and a missed deadline. eTop Technology has been headquartered in nearby Redlands for over a decade, and law firms are one of the practices we know best. We provide managed IT and cybersecurity built specifically for how legal work happens in the county seat. ## Why Riverside Firms Work With a Local Legal-IT Provider **We understand the court rhythm here.** Riverside is the legal hub of the Inland Empire. The Riverside Historic Courthouse, the Hall of Justice, the family law court, and the George E. Brown Jr. federal courthouse concentrate an enormous amount of practice into a few downtown blocks. That means real e-filing volume against hard deadlines. We keep the Microsoft 365, connectivity, and document stack behind those filings stable and monitored, with a backup path when a connection drops. **We protect privilege as a design principle.** Attorney-client privilege is only as strong as the systems protecting it. If email can be intercepted, file sharing is unsecured, or a stolen laptop opens your whole case-management system, privilege is at risk. We build firm environments with encryption in transit and at rest, conditional access, device management, and data-loss-prevention controls that keep client information where it belongs. ## What We Handle for Law Firms - Secure email with advanced anti-phishing and encryption - Document management and secure external sharing with clients, opposing counsel, and experts - Practice-management support and vendor coordination (Clio, PracticePanther, NetDocuments, and others) - Mobile device management for attorneys working from court or home - Compliant backup and disaster recovery for client files - Security-awareness training written around legal scenarios, not generic ones - Microsoft 365 optimization for legal workflows ## The Compliance Picture for a Riverside Firm Most firms carry more than one obligation at once. A personal-injury or elder-law practice touches HIPAA through medical records. A firm holding client trust and financial data falls under FTC Safeguards awareness. California's own privacy law adds another layer. And every firm now carries a cyber-insurance policy with security requirements written into the fine print that your renewal depends on. We map those requirements to the specific controls that satisfy them, so nothing is left to assumption the week a claim or an audit shows up. ## Fifteen Minutes Down the 91 We are not a national provider that also lists Riverside on a map. We are part of this business community, a short drive from the courthouse, and legal is a practice we have supported here for years. If your firm is ready for IT that protects both the billable hour and the privilege behind it, we should talk. ## Frequently Asked Questions **Can you keep our firm reliable for Riverside County Superior Court e-filing?** Yes. California requires electronic filing in most civil matters, and a missed or corrupted upload against a court deadline is a real problem, not an inconvenience. We keep the underlying Microsoft 365, browser, PDF, and internet connectivity stack stable and monitored, maintain a backup path when your primary connection fails, and treat anything that threatens a filing window as an urgent issue. **How fast can you be onsite at our downtown Riverside office?** Our office is at 611 W Redlands Blvd # G, about fifteen minutes from the Historic Courthouse and the downtown legal corridor. When something is urgent and needs hands on it, we are close, not routing a technician from Orange County. Most issues we resolve remotely and immediately. **We handle both state and federal matters. Does that change our IT needs?** It can. Firms practicing in the George E. Brown Jr. federal courthouse deal with PACER, CM/ECF, and larger document productions alongside state court work. We make sure your document management, secure external sharing, and storage can handle heavy e-discovery volumes without breaking your workflow or your confidentiality controls. **Can you help us meet California State Bar technology competence duties?** Yes. California expects attorneys to understand and apply reasonable security measures for client data, and formal opinions have extended competence into encryption, public networks, and e-discovery. We put the documented policies, access controls, training, and tested backups in place that let you demonstrate reasonable measures if you are ever asked. --- # IT Support for Manufacturers in Corona, California URL: https://etoptechnology.com/manufacturing-it-support-corona/ Type: Industry by City Industry: Manufacturers City: Corona Corona manufactures at a scale most cities its size never touch. Fender builds its American guitars here. One of the country's largest beverage companies is headquartered here. Around those anchors runs a base of food and beverage producers, consumer-products operations, metal and machining shops, and plastics plants, all positioned where the 91 carries Inland Empire production straight into Orange County and the greater Los Angeles market. The common thread is blunt: when the technology stops, production stops, and production stopping is measured in dollars per hour. eTop Technology has provided managed IT and cybersecurity across the Inland Empire for more than 12 years, and manufacturing is one of the environments we know best. We serve Corona from our Redlands office, about 30 minutes up the freeway, with same-day onsite when something needs hands on the equipment. ## Keep the Office Out of the Production Network A manufacturer's risk does not live where most IT providers look. The office side — email, accounting, file shares — is standard territory. The exposure that actually stops production sits in the operational technology: controllers, operator stations, sensors, and the machine PC that has run the same unsupported operating system since the equipment was installed, because the vendor never shipped anything newer. That equipment usually cannot be patched or rebooted on an office schedule, and it does not need to be exposed because of it. Proper segmentation means the production network and the office network are separate worlds, everything crossing between them is deliberate and monitored, and a compromised front-office PC has no route to the floor. The machines the vendor abandoned get defended by the network around them. ## Uptime Is a Traceability Question Too For Corona's food and beverage producers, the systems that track lots, ingredients, and shipments carry a second job: they are what lets you answer a traceability question fast and keep a recall narrow instead of wide. We treat the ERP (enterprise resource planning) system and its integrations as production-critical — monitored, backed up, restores tested — because the day you need those records is the wrong day to find out the backup had been failing quietly for months. The same discipline applies across the rest of Corona's shop floor mix. Job shops live on quoting, job costing, and delivery dates; consumer-products operations live on orders and freight. Whatever moves your money, we keep it up and keep it recoverable. ## Attackers Do the Same Math You Do Ransomware crews price their leverage off your downtime cost, which is why manufacturing stays at the top of the target lists: a stopped line negotiates badly. Our answer is layered rather than heroic — modern detection and response on everything that can carry it, continuous monitoring behind that, and hardened email, because the incident that ends in encryption usually starts as a convincing fake invoice. And since your customers increasingly push security questionnaires down the supply chain, we keep the controls documented so answering one honestly takes an afternoon, not a scramble that risks the account. ## What We Handle for Corona Manufacturers - OT/IT network segmentation between office and production floor - ERP support, integrations, and tested backup and recovery - Endpoint detection and response with 24/7 security operations - Email security against fake-invoice and wire-fraud attacks - Device management for supervisors and sales working across the county line - Security documentation for customer questionnaires and cyber-insurance renewals ## A Provider on the Right Side of the Freeway Plenty of IT companies will put Corona in a service-area list. We are 30 minutes away and already working this corridor. Start simple: ask us for a floor-to-front-office network assessment. We will map what is actually connected to what, show you where the office and the floor touch, and give you a prioritized punch list you can act on — with us or without us. ## Frequently Asked Questions **How quickly can you get onsite to our Corona plant?** Corona is about 30 minutes from our Redlands office, well inside our primary service area, so we offer same-day onsite when something needs hands on the equipment. Day to day, monitoring lets us resolve most issues remotely before they interrupt a run — but when hardware fails on the floor, you get a person, not a next-week dispatch window from a provider two counties away. **Can you keep our office network from ever touching the production floor?** Yes — that separation is the foundation of manufacturing IT. Your controllers, operator stations, and machine PCs often run software that can never be updated, and they do not have to be exposed because of it. We segment the production network from the office network so nothing crosses by default: the only traffic allowed between them is what you explicitly approve, such as an ERP feed, and we monitor that. Where a line needs no connection at all, we can fully isolate it. **We are a food and beverage producer. Can you support the systems behind traceability and recalls?** Yes. For food-grade producers the ERP and the systems that track lots, ingredients, and shipments are not back-office conveniences, they are what lets you answer a traceability question quickly and keep a recall narrow. We manage those systems as production-critical: monitored, backed up, and with restores actually tested, so the day you need the records is not the day you find out the backup was broken. **We run more than one shift. Who responds after hours?** Coverage does not end at 5pm. Detection and response on your systems runs around the clock through our security operations center, and critical issues follow an escalation path with a human at the end of it — so a problem that hits during second shift gets worked that night, not discovered in the morning queue. --- # IT Support for Manufacturers in Fontana, California URL: https://etoptechnology.com/manufacturing-it-support-fontana/ Type: Industry by City Industry: Manufacturers City: Fontana Fontana grew up around Kaiser Steel, and the heavy-industry DNA never left. The city is dense with metal fabricators, machine shops, steel processors, welding operations, and the kind of heavy manufacturing that runs large equipment around the clock. That heritage shows up in the technology too: a lot of Fontana shops run capital equipment that has been on the floor for a decade or more, controlled by industrial PCs that were current when they were installed and have not been touched since. That is not negligence, it is the reality of machines that cost six figures and are not due for replacement. eTop Technology has provided managed IT and cybersecurity across the Inland Empire for more than 12 years, and manufacturing is one of the environments we know best. We serve Fontana from our Redlands office, about 25 minutes away, with same-day onsite when the work needs hands on the equipment. ## The Two Networks Under Every Fabrication Shop Every manufacturer runs two technology worlds. There is the office network, which handles email, accounting, quoting, and file shares. And there is the operational technology, or OT, which is the equipment itself: the programmable logic controllers running your presses and cutters, the operator screens, the sensors, and the PC-based controllers on your CNC plasma, laser, and machining centers. In Fontana those OT systems are often old, and that is the crux of the problem. They usually cannot be patched or rebooted the way an office laptop can, because the fabrication vendor never released an update and a reboot at the wrong moment scraps a part. That is acceptable as long as they are properly walled off. The whole point of OT and IT segmentation is simple to state: a phishing click in the front office should never be able to reach the floor. We build networks where the office side and the production side are separated, the traffic between them is controlled and monitored, and your aging-but-essential controllers are protected by the network around them. ## Downtime on a Heavy Floor When a fabrication line stops, the meter starts. Idle welders and machinists on a loaded hourly cost, plus the units that did not ship, plus expedited freight to make the date anyway. Run that math once for your own floor and the monthly IT invoice stops looking like the number that matters. We manage the systems that keep orders and material moving, your ERP (enterprise resource planning) and quoting and scheduling, as production-critical: backed up with restores actually tested, and supported by people who will get on the phone with your software vendor rather than point at them. ## Security and Compliance for Suppliers Manufacturers are heavily targeted by ransomware because attackers know a stopped line forces fast decisions. We put endpoint detection and response on every machine that can run it, a 24/7 security operations center that matters when your third shift runs past midnight, and email security to catch the fake-invoice attacks that start most incidents. For shops feeding defense and aerospace primes, we build the CMMC and NIST 800-171 controls into the same environment so security and compliance are one project, not two. If you have never seen a network diagram of your own building, that is where we start. We will walk the floor, map both networks, and hand you a prioritized list, whether or not you ever work with us. ## Frequently Asked Questions **Our CNC and plasma cutters run on old PCs that we cannot update. Is that a problem?** It is common in Fontana, and it is manageable. A lot of heavy fabrication equipment ships with a PC running an operating system that went out of support years ago, and the machine vendor never released anything newer. You cannot patch it without risking the machine, so the answer is not to patch it, it is to wall it off. We segment those aging controllers behind the network so an office phishing click can never reach them, and we protect them with the environment around them instead of updates they will never get. **How fast can you get to our Fontana shop?** Fontana is roughly 25 minutes from our Redlands office, and we offer same-day onsite when the work needs hands on the equipment. Most issues we resolve remotely and immediately through monitoring, but when a controller drops off the network or a switch fails on the floor, a technician is dispatched from the Inland Empire rather than routed in from another county. **We supply parts to defense primes. Do you handle CMMC and NIST 800-171?** Yes. Fontana's metal and machining shops increasingly feed defense and aerospace primes, and those contracts carry CMMC (Cybersecurity Maturity Model Certification) built on NIST 800-171 controls. We map those requirements to the specific controls that satisfy them, get the documented policies and access controls in place, and keep the evidence audit-ready so a customer flow-down requirement does not cost you the contract. **We run two and three shifts. Who answers when something breaks at 2am?** Our security operations center monitors 24/7, and our escalation process covers critical issues whenever they happen. If third shift hits a problem past midnight in the middle of a run, there is a defined path to a human that night, not a ticket that waits for morning. --- # IT Support for Manufacturers in Ontario, California URL: https://etoptechnology.com/manufacturing-it-support-ontario/ Type: Industry by City Industry: Manufacturers City: Ontario Ontario sits at the crossroads of the I-10 and I-15 with Ontario International Airport in the middle of it, and that geography shapes the manufacturers here. Many of them do not just build product, they move enormous volumes of it, feeding big-box retailers, third-party logistics partners, and air cargo on delivery windows measured in hours. For an Ontario manufacturer, the factory floor and the loading dock are really one continuous system, and the technology that connects them cannot be treated as back-office overhead. eTop Technology has provided managed IT and cybersecurity across the Inland Empire for more than 12 years, and manufacturing is one of the environments we know best. We serve Ontario from our Redlands office, about 25 minutes east, with same-day onsite when the work needs hands on the equipment. ## When Production and Shipping Share One Network Every manufacturer runs two technology worlds. There is the office network, which handles email, accounting, and file shares. And there is the operational technology, or OT, which is the machines themselves: the programmable logic controllers running your equipment, the operator screens, the sensors, and very often a PC bolted to a machine running an operating system that went out of support years ago because the vendor never shipped anything newer. In Ontario, a third layer sits on top of both: the warehouse and shipping systems that keep freight moving. A phishing click in the front office should never be able to reach a machine controller or the system releasing your dock schedule. We segment those environments so office, floor, and warehouse are separated, the traffic between them is controlled and monitored, and the aging equipment controllers are protected by the network around them instead of by patches they are never going to get. ## The Systems That Move Both Product and Money For an Ontario manufacturer, downtime is rarely just idle machines. It is idle crews plus held shipments plus EDI chargebacks. Your ERP, your warehouse management system, and the EDI feeds your largest customers require you to run all have to stay healthy at once. We manage them as production-critical: backed up with restores actually tested, integrated so data is not rekeyed between systems, and supported by people who will get on the phone with your ERP or EDI vendor rather than point at them. ## Security That Respects the Ship Schedule Manufacturers are heavily targeted by ransomware because attackers know a stopped line forces fast decisions, and a missed air-cargo cutoff makes that pressure worse. We put endpoint detection and response on every machine that can run it, a 24/7 security operations center watching for threats even during second shift, and email security to catch the fake-invoice and phishing attacks that start most incidents. Every change is scheduled around your shipping windows, tested first, and rolled out in increments. If you have never seen a network diagram of your own building, that is the place to start. We will walk the floor, map all three layers, and hand you a prioritized list, whether or not you ever work with us. ## Frequently Asked Questions **Do you support manufacturers that also run heavy distribution near Ontario International Airport?** Yes, and that combination is exactly what Ontario throws at us. A lot of Ontario manufacturers ship as much as they build, which means your ERP (enterprise resource planning), your warehouse management system, and the EDI (electronic data interchange) links to your big retail and freight customers all have to stay up together. We manage them as one connected production system, not separate silos, so an outage in one does not quietly stall the others. **How fast can you get to our Ontario facility?** Ontario is about 25 minutes from our Redlands office, and we offer same-day onsite for issues that need hands on the equipment. Most problems we resolve remotely and immediately through monitoring, but when a switch fails on the floor or a controller drops off the network, a technician is dispatched from the Inland Empire, not from Orange County or LA. **Our EDI orders from a major retailer keep failing. Can you help?** Yes. Failed or late EDI transactions with retail and 3PL partners can mean chargebacks and shipments held at the dock, which is real money on Ontario's freight-heavy schedule. We manage the EDI environment, the mapping, and the vendor relationship, and we monitor the pipeline so a broken feed is caught before your customer's compliance team catches it for you. **Can you keep our air-cargo just-in-time shipments moving?** That is the core of the job here. With Ontario International Airport driving tight, just-in-time delivery windows, a network or ERP outage during a shipping cutoff turns into missed flights and expedited freight to recover. We build redundancy into the connectivity and systems those cutoffs depend on, and we schedule every change around your ship windows rather than ours. --- # IT Support for Manufacturers in Rancho Cucamonga, California URL: https://etoptechnology.com/manufacturing-it-support-rancho-cucamonga/ Type: Industry by City Industry: Manufacturers City: Rancho Cucamonga Rancho Cucamonga is consistently ranked among the best places to do business in the Inland Empire, and its manufacturing base reflects that. Rather than one dominant heavy industry, the city runs on diversified light and precision manufacturing: contract manufacturers, consumer-goods producers, medical-device and aerospace component shops, and food and beverage operations, many of them in clean, modern business parks along Foothill Boulevard and Haven Avenue. These are often lower-volume, higher-value operations where precision and paperwork matter as much as throughput. eTop Technology has provided managed IT and cybersecurity across the Inland Empire for more than 12 years, and manufacturing is one of the environments we know best. We serve Rancho Cucamonga from our Redlands office, about 25 minutes east, with same-day onsite when the work needs hands on the equipment. ## Your Building Has Two Networks Every manufacturer runs two technology worlds. There is the office network, which handles email, accounting, and file shares. And there is the operational technology, or OT, which is the equipment itself: the programmable logic controllers running your machines, the operator screens, the sensors, and often a PC bolted to a machine running an operating system that went out of support years ago because the equipment vendor never shipped anything newer. Those production systems usually cannot be patched or rebooted the way office computers can, and that is fine as long as they are properly walled off. The job of OT and IT segmentation is simple to state: a phishing click in the front office should never be able to reach the floor. We design networks where the office side and the production side are separated, traffic between them is controlled and monitored, and the aging controllers are protected by the network around them instead of by patches they will never receive. ## When the Records Are as Critical as the Machines For a certified Rancho Cucamonga shop, downtime is not only idle machines. It is idle labor on a loaded hourly cost, plus missed shipments, plus the risk to the quality records your certification depends on. The quality management system, the traceability data, and the ERP (enterprise resource planning) system that ties orders, inventory, and financials together all have to stay healthy. We manage them as production-critical: backed up with restores actually tested, integrated so data is not rekeyed between systems, and supported by people who will get on the phone with your software vendor rather than point at them. A backup that has never been test-restored is a hope, not a plan, especially when an auditor is the one asking for the data. ## Security Built Around Production Reality Manufacturers are heavily targeted by ransomware because attackers know a stopped line forces fast decisions. We put endpoint detection and response on every machine that can run it, a 24/7 security operations center watching for threats around the clock, and email security to catch the fake-invoice and phishing attacks that start most incidents. Every change is scheduled around your production and shipping schedule, tested first, and rolled out in increments. If you have never seen a network diagram of your own building, that is where we start. We will walk the floor, map both networks, and hand you a prioritized list, whether or not you ever work with us. ## Frequently Asked Questions **We hold ISO and AS9100 certification. Can you keep our quality system audit-ready?** Yes. For a certified shop, the quality management system and its records are as production-critical as the machines. If your document control, nonconformance history, or traceability data is lost or corrupted, a surveillance audit becomes a very bad day. We treat those systems as tier-one: backed up with restores actually tested, access controlled, and change history preserved, so an auditor asking for records gets records rather than an apology. **How fast can you get to our Rancho Cucamonga facility?** Rancho Cucamonga is about 25 minutes from our Redlands office, and we offer same-day onsite when the work needs hands on the equipment. Most issues we resolve remotely and immediately through monitoring, but when a machine controller drops off the network or hardware fails on the floor, a technician is dispatched from the Inland Empire, not routed in from LA or Orange County. **We run several different product lines on different systems. Is that harder to support?** It is common in Rancho Cucamonga, where the manufacturing base is diverse rather than one dominant industry. A contract shop might run one ERP (enterprise resource planning) system, a quality system, and a handful of machine-specific applications that do not naturally talk to each other. We manage that mixed environment as one estate, integrate what should be integrated so data is not rekeyed, and support each vendor relationship instead of leaving you to referee between them. **Do you handle FDA or medical-device traceability requirements?** Yes. Some Rancho Cucamonga shops make medical-device or regulated components where lot traceability and record retention are not optional. We build the backup, retention, and access controls those requirements demand into your environment and keep the evidence organized, so a customer audit or regulatory request is answered from records rather than reconstructed from memory. --- # IT Support for Manufacturers in Riverside, California URL: https://etoptechnology.com/manufacturing-it-support-riverside/ Type: Industry by City Industry: Manufacturers City: Riverside Riverside is the economic hub of the Inland Empire, and its manufacturing base is as varied as the city itself. Along the I-215 corridor and across the city you will find metal and machining job shops, food and beverage producers, assembly operations, and a meaningful cluster of defense and aerospace suppliers feeding the primes near March Air Reserve Base and the wider Southern California supply chain. Different products, same underlying truth: when the technology stops, production stops, and production stopping is measured in dollars per hour. eTop Technology has provided managed IT and cybersecurity across the Inland Empire for more than 12 years, and manufacturing is one of the environments we know best. We serve Riverside from our Redlands office, just 15 minutes away, which makes us one of the closest providers to your floor when something needs hands on the equipment. ## Your Building Has Two Networks Every manufacturer runs two technology worlds. There is the office network, which handles email, accounting, and file shares. And there is the operational technology, or OT, which is the equipment itself: the programmable logic controllers running your machines, the operator screens, the sensors, and often a PC bolted to a machine running an operating system that went out of support years ago because the vendor never shipped anything newer. Those production systems usually cannot be patched or rebooted the way office computers can, and that is acceptable as long as they are properly walled off. The job of OT and IT segmentation is simple to state: a phishing click in the front office should never be able to reach the floor. We design networks where the office side and the production side are separated, traffic between them is controlled and monitored, and the aging controllers are protected by the network around them instead of by patches they will never receive. ## Compliance That Comes With the Contract For Riverside's defense and aerospace suppliers, security is not just risk management, it is a term of the contract. CMMC and NIST 800-171 requirements flow down from the primes, and controlled unclassified information has to be handled to a documented standard or the work goes elsewhere. We build those controls into your environment rather than bolting them on, map each requirement to the control that satisfies it, and keep the evidence organized so an assessment is answered from records rather than scrambled together the week it lands. ## Downtime, Data, and the Systems That Move Money When a Riverside line stops, the meter starts: idle crews on a loaded hourly cost, missed shipments, and expedited freight to recover the date. We manage the systems that keep orders and money moving, your ERP (enterprise resource planning) system and its integrations, as production-critical, backed up with restores actually tested. On the security side, manufacturers are heavily targeted by ransomware because attackers know a stopped line forces fast decisions. We put endpoint detection and response on every machine that can run it, a 24/7 security operations center behind it, and email security to catch the fake-invoice attacks that start most incidents. If you have never seen a network diagram of your own building, that is where we start. We will walk the floor, map both networks, and hand you a prioritized list, whether or not you ever work with us. ## Frequently Asked Questions **How quickly can you get onsite to our Riverside plant?** Our Redlands office is about 15 minutes from Riverside, which makes us one of the closest managed IT providers to your floor. When a machine controller drops off the network, a switch fails, or hardware dies mid-run, we are minutes away rather than dispatching from LA or Orange County. Most issues we still resolve remotely and immediately through monitoring, but when something needs hands on the equipment, proximity is the difference between a short interruption and a lost shift. **We supply defense and aerospace primes near March. Do you handle CMMC and NIST 800-171?** Yes. Riverside's location near March Air Reserve Base and the broader Southern California aerospace supply chain means a real share of manufacturers here carry contracts with CMMC (Cybersecurity Maturity Model Certification) and NIST 800-171 requirements flowed down from their primes. We map those controls to your environment, put the documented policies and access controls in place, protect controlled unclassified information properly, and keep the evidence audit-ready so a compliance requirement never costs you the contract. **Our manufacturing base is mixed. Do you only work with one kind of shop?** No. Riverside's manufacturing is diverse, from metal and machining job shops along the I-215 corridor to food producers and assembly operations. We support that range as one practice, because underneath the differences the priorities are the same: keep the line up, protect the systems that move orders and money, and wall the office network off from the floor. **We run more than one shift. Who responds after hours?** Our security operations center monitors 24/7, and our escalation process covers critical issues whenever they happen. If second shift hits a problem in the evening, there is a defined path to a human that night rather than a ticket that sits until morning. --- # Pass1234 Is Not a Password. Here's What to Use Instead. URL: https://etoptechnology.com/blog/pass1234-bad-password/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-09-24 If you searched for "pass1234" or "pass@1234", one of three things is probably true. You were handed it as a default password. You are using it somewhere and wondering whether it's fine. Or you saw it on a list and wanted to know why. It is not fine. Here is how bad it is, with real numbers, and what to do instead. ## How often these passwords show up in breaches Have I Been Pwned keeps a public database of passwords exposed in real data breaches, and you can check any password against it without sending the password itself. We checked these on September 24, 2026: | Password | Times seen in breaches | |---|---| | pass1234 | 854,288 | | Pass1234 | 400,218 | | pass@1234 | 173,267 | | Pass@1234 | 1,569,340 | | Password1 | 3,461,492 | Look at the last two variations. Adding a capital letter and an @ sign did not make the password rarer. Pass@1234 turns up more than pass1234 does, because it is exactly what people type when a system demands "one uppercase letter, one number, one symbol." Attackers know that too. ## Why "complex" passwords like Pass@1234 fail Nobody guesses passwords by hand anymore. Attackers use lists: billions of real passwords from past breaches, plus the predictable ways people modify them. Capitalize the first letter. Swap an "a" for "@". Add "1234" or the current year to the end. Pass@1234 is on those lists. So is every obvious variation of it. A password that is on a list gets tried in the first few seconds, no matter how many symbols it has. The bigger risk is reuse. If the same password protects your email and a shopping site, a breach at the shopping site hands attackers your email login. That's one of the most common ways business accounts get taken over: not by cracking a password, but by trying one that already leaked. ## What NIST actually recommends now NIST's digital identity guidelines (SP 800-63B, revision 4, finalized in 2025) are the standard most security frameworks follow. They reversed a lot of the old advice: - **Length beats complexity.** Passwords used on their own should be at least 15 characters. Systems should allow at least 64. - **No forced composition rules.** No more "must include a symbol." Those rules are what produce Pass@1234. - **No forced periodic changes.** Change a password when there's evidence it was compromised, not every 90 days. - **Block known-bad passwords.** Systems should reject passwords that appear on breach lists, which would stop every password in the table above. ## What to do instead **Use a password manager.** It generates a long, random, unique password for every account and remembers them for you. You remember one strong passphrase to unlock it. This is the single biggest improvement most people can make. **Where you have to remember a password, use a passphrase.** Four or five unrelated words are long, easy to type, and not on anyone's list. A made-up example: *copper lantern gravel autumn* (don't use this one; it's published now). **Turn on multi-factor authentication (MFA).** With MFA, a stolen password on its own isn't enough to get in. For email and anything financial, MFA matters more than any password rule. **Change default passwords immediately.** If a device, a router, or a new account came with pass1234 or something like it, change it before anything else, and check that nobody else was given the same one. ## For businesses: fix it in the system, not the sticky note If your staff are choosing passwords like Pass@1234, the problem is usually the policy that made them. A complexity rule plus a 90-day expiry produces exactly this. The fix is structural. Microsoft 365 can block common and weak passwords and require MFA for everyone, and a company password manager gives staff a way to comply without writing passwords down. MFA enforced everywhere it can be is part of the [cybersecurity baseline](/cybersecurity-services-inland-empire/) we set up for clients, along with phishing training, since a strong password doesn't help if someone types it into a fake login page. See also [how attackers get around MFA with consent phishing](/blog/oauth-consent-phishing-bypasses-mfa/). If you're not sure what your own passwords and MFA look like across the company, that's one of the first things our IT risk assessment checks. --- # Is Power Automate Included in Microsoft 365? URL: https://etoptechnology.com/blog/is-power-automate-included-in-microsoft-365/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-09-14 Short answer: yes, and that is where the confusion starts. Power Automate is included with most Microsoft 365 business and enterprise plans. It is also sold separately, for more money, under a name that sounds nearly identical. So a reasonable person can watch a Microsoft demo, get excited, go looking for the feature, and find a paywall. The feature they saw was real. It just was not the free one. Here is the line, in plain terms. | Microsoft 365 plan | Cloud flows, standard connectors | Premium and custom connectors | On-premises gateway | Unattended desktop automation | |---|---|---|---|---| | Business Basic, Standard, Premium | Included | Paid add-on | Paid add-on | Paid add-on | | Enterprise E1, E3, E5 | Included | Paid add-on | Paid add-on | Paid add-on | | Frontline F1, F3 | Included | Paid add-on | Paid add-on | Paid add-on | *Based on Microsoft's Power Automate licensing documentation, checked October 2026. Microsoft 365 licenses also cap each user at 6,000 Power Automate actions per day.* ## What your existing license already covers If you pay for Microsoft 365 Business Standard, Business Premium, or most of the enterprise plans, you already have Power Automate cloud flows using what Microsoft calls **standard connectors**. A connector is just a pre-built bridge to another system. The standard set covers the Microsoft world and a decent slice of everything else: Outlook, Teams, SharePoint, OneDrive, Excel, Forms, Planner, To Do, plus a long list of common outside services. That is genuinely useful. Things you can build today without spending another dollar: - A form submission that creates a task and emails the right person - An approval request that routes to a manager and records the answer in a SharePoint list - A file dropped in a specific folder that gets renamed, filed, and announced in a Teams channel - A daily summary email assembled from a spreadsheet - A reminder chain that stops nagging once someone actually responds Most of the repetitive office work we get asked about lives in exactly that territory. ## What costs extra The paid tier, currently sold as Power Automate Premium, unlocks **premium connectors** and a few heavier capabilities. That is where you find: - **Direct database access.** SQL Server, Dataverse, and similar. - **Raw web requests and custom connectors.** The escape hatch for any system that does not have a ready-made bridge. This one matters more than people expect, because your line-of-business software is usually the system with no connector. - **The on-premises data gateway**, for reaching things that live in your building rather than in the cloud. - **Unattended automation**, meaning a robot that drives a desktop application on its own, overnight, with nobody logged in. - **Process mining**, which watches how work actually flows and tells you where it stalls. List pricing has sat around fifteen dollars per user per month, but Microsoft moves these numbers and renames the plans often enough that you should confirm current pricing rather than trust any article, this one included. ## The distinction that actually decides it Forget the plan names for a second. The question that determines whether you need to pay is simple: **Does the automation need to touch a system Microsoft does not already have a bridge to?** If everything happens inside Outlook, Teams, SharePoint, Excel, and Forms, you are almost certainly covered by what you own. If the useful version of the automation has to reach into your practice management system, your estimating software, your accounting package, or a database sitting on a server in the back office, you are probably looking at a premium connector or a custom one. That is also the honest reason so many small automation projects stall. The demo works beautifully on the Microsoft-only version, then the real requirement shows up, and the real requirement always involves the one system nobody wants to touch. ## Power Automate Desktop is a separate conversation Windows 11 ships with Power Automate Desktop, which records and replays actions on a computer the way an old macro would. It is free for an individual to use on their own machine while they are sitting there watching it run. Running it unattended, on a schedule, across a company, is the licensed version. If someone on your team has built something clever on their own desktop and it has quietly become load-bearing for the business, that is worth knowing about before they take a vacation. ## What we would check first Before anyone buys anything: 1. **Confirm which Microsoft 365 plan you are actually on.** Not what you bought three years ago. What is on the current invoice. 2. **Look at what has already been built.** Power Automate is enabled by default in most tenants, and in nearly every company we look at, somebody has already made a few flows. Sometimes they are useful. Sometimes they are sending mail on behalf of a person who left in 2024. 3. **Write down the workflow you actually want**, listing every system it has to touch. That list, not the marketing page, tells you your license. The pattern we see over and over is a company paying a third-party automation tool to do something their existing license already covered. Checking what you own costs an afternoon. It is the cheapest IT project available, and nobody ever schedules it. --- # Is Zapier Safe to Give Your Company Data? URL: https://etoptechnology.com/blog/is-zapier-safe-for-company-data/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-09-14 People ask whether Zapier encrypts data in transit and at rest. It does. That was never the part that was going to hurt you. Zapier is a well-run company with a real security program and third-party audits to show for it. If your mental picture of the risk is someone intercepting your data mid-flight, you can relax. The actual exposure is duller and far more common, and it has almost nothing to do with Zapier's own defenses. ## The real risk is the keys, not the traffic To connect an automation tool to your email, your file storage, your customer database, and your accounting system, you hand it credentials for each one. Usually that is an access token, which is a long-lived key that says *this service may act as this user*. Stack up a few of those and the account becomes something worth thinking carefully about. **It holds standing access to multiple systems at once.** Not a copy of your data. Something more useful to an attacker: permission to go and get it, on demand, from several places. **The permissions are usually broader than the job.** A connection that only needs to read one folder will often be granted the whole drive, because that is the scope the integration asks for and nobody negotiates with a consent screen. **Whoever set it up owns it.** In most small companies every connection is authorized under one person's login. That person's credentials are now the entry point, and their departure is now a business event rather than a paperwork event. **Data that passes through is retained for a while.** Task history exists so you can debug a broken automation, which is genuinely helpful, and it also means recent records live in a second place you never thought of as a system of record. None of that is a defect. It is the shape of the tool. But it means the security question is really an access management question, and access management is something you control, not something a vendor can do for you. ## The HIPAA question deserves a careful answer If you handle protected health information, the only answer that matters is whether the vendor will sign a Business Associate Agreement covering your specific plan, in writing, today. Vendor positions on this change. Plans get renamed, capabilities move between tiers, and a policy that was accurate when an article was written stops being accurate. So do not take this from a blog post, including this one. Ask the vendor directly, get the agreement in hand, and confirm it covers the plan you are actually on rather than the one you might upgrade to later. If they will not sign, the answer is no, no matter how good the encryption is. The same discipline applies to anything else with a regulator or a contract attached. Client files under legal privilege, payment card data, and anything covered by a promise you made to a customer all deserve that question before a connector gets authorized, not after. ## What to check before you connect anything A short list that catches most of it: 1. **Create a dedicated service account** for integrations instead of using a person's login. When someone leaves, the automations keep running and the human account can be closed cleanly. 2. **Put multi-factor authentication on that account**, meaning a second proof of identity beyond the password. An account holding keys to five systems has earned it. 3. **Grant the narrowest access the automation actually needs.** If it reads one folder, do not hand it the drive. 4. **Write down what is connected and why.** This is the step everybody skips, and it is the one that makes a review possible at all. 5. **Review the connection list on a schedule.** Old integrations do not announce themselves. They just keep holding valid keys. 6. **Decide what is not allowed to pass through it, and tell people.** A rule nobody has heard is a preference. ## The question underneath the question When an owner asks whether Zapier is safe, what they usually mean is *am I about to do something I will regret*. Fair question, and the honest answer is that the tool is fine and the habits around it are usually the problem. We have walked into plenty of companies with a tidy firewall, current patching, working backups, and a forgotten automation account holding live credentials to four systems, set up by somebody who left two years ago. Software you have inventoried is software you can defend. The rest is just a surprise you have not had yet. --- # The Spreadsheet That Runs Your Company URL: https://etoptechnology.com/blog/the-spreadsheet-that-runs-your-company/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-09-14 Every company has one. A spreadsheet on one person's computer that the business genuinely depends on. It has tabs nobody else understands. It has a formula somebody wrote in 2019 that everyone is now afraid to touch. It gets emailed around with version numbers in the filename, and the real version is whichever one that person happens to be looking at right now. Nobody planned this. It started as a shortcut, it worked, and it kept working. That is how every one of these gets built. ## How to find yours Ask your team one question: **if this person were out for two weeks, what would stop?** Not slow down. Stop. The answers are always specific, and they are almost never what the org chart would suggest. The schedule that gets rebuilt by hand every Monday morning. The pricing workbook that decides what goes on every quote. The job costing file that is the only place labor and materials meet. The commission calculation. The compliance log that gets assembled the week before the audit. The list of who has access to what, maintained in a tab called Sheet3. If your answer takes more than a few seconds, ask the person who does the work rather than the person who manages it. They will know immediately. They have been carrying it. ## Why it is a problem, in the order it will bite you **It is a single point of failure attached to a human being.** Vacation is a risk. A resignation is a crisis. We have watched a company spend three weeks reverse engineering a file because the person who built it left and the formulas had no notes. **It is probably not backed up the way you think.** If it lives on a desktop, or in a folder one person created, it may not be in the backup at all. Owners routinely assume coverage that was never actually configured. **It has no access control worth the name.** Anyone who was ever emailed a copy still has that copy. If it holds payroll figures, client lists, or pricing, that has quietly become a data question rather than a filing question. **Nobody can tell you whether it is right.** A spreadsheet edited by four people over six years contains at least one error. The only question is whether it is a rounding difference or the reason a bid came in wrong. **It is a hiring ceiling.** You cannot delegate work that exists only in one person's head and one person's file. This is the one owners feel constantly without ever naming it. ## What to do, in a sensible order **Do not start by replacing it.** The instinct is to go buy software. Software projects that begin with nobody understanding the current process end badly and expensively. The spreadsheet works. Respect that it works. **Get it off the desktop today.** Into shared company storage, with real backup and real permissions. That takes about ten minutes and removes the worst of the risk before you have decided anything else. **Have the owner walk you through it.** Record the conversation. Where does the data come from, what happens to it, who gets the output, what do they do with it. You are not looking for formulas. You are looking for the process the formulas are a shadow of. **Write the steps down in plain language.** One page. This is the actual deliverable. A process somebody else can read is a process somebody else can run. **Then decide.** Sometimes the answer is that the spreadsheet is fine, and now it is documented and backed up, which is a real win. Sometimes there is a system you already own that does the job properly. Sometimes it is worth automating the two or three steps that eat the most time and leaving the rest alone. ## The test worth applying The workflows worth changing share a shape. **Somebody does it at least a few times a week, it follows the same steps every time, and the steps are boring.** Frequency times tedium, with a known procedure. Work that is genuinely different every time is judgment, and judgment is what you hired the person for. Leave it alone. The goal was never to automate a person. It was to stop spending them on retyping. Most companies have three or four of these files. Finding them is a conversation, not a project, and it is the one we would want to have first. Every business runs on something nobody wrote down. The only real question is whether you find yours on a quiet Tuesday afternoon or during somebody's notice period. --- # Will AI Replace Accounting? URL: https://etoptechnology.com/blog/will-ai-replace-accounting/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-09-14 No, and the profession has been answering this question for longer than most people remember. Data entry started leaving accounting when bank feeds arrived. Nobody in practice today mourns hand-keying a bank statement. This wave moves faster and reaches further, but it is heading somewhere the profession has been walking toward for twenty years, and it was never where the value lived. The useful question is which specific tasks are moving, and what a firm should do about it now. ## What is genuinely getting absorbed **Transaction categorization.** Software has been guessing at this for years and is now good enough that the review is a review rather than a redo. **Document intake.** Pulling numbers off receipts, invoices, and statements that arrive as photographs of paper. This used to be somebody's entire morning. **Reconciliation, first pass.** Matching the obvious and surfacing the handful that need a person. The exceptions were always the real work. Now the exceptions are most of what reaches a human at all. **Drafting the routine written product.** Management letters, engagement letters, the recurring client email that says the same thing every quarter with different numbers in it. **Finding things.** Searching prior year workpapers and client correspondence for the treatment you used last time, without having to ask the one person who remembers. Notice the shape. Every one of those is high volume, pattern-shaped, and easy to check. That is the territory where these tools are strong, and it is a meaningful share of the hours in a typical close. ## What it does not take **Judgment where the answer is defensible rather than correct.** Materiality. Classification calls with real ambiguity. Anything that would be argued rather than looked up. A tool that produces a fluent answer regardless of whether it knows is the wrong instrument for a position you may have to defend. **Signing.** A license belongs to a person. No software vendor is sharing that liability, and the contract will say so plainly. **The client conversation.** The part where somebody explains what the numbers mean for a decision the owner is about to make. In most practices this is what the client believes they are paying for, and they are not wrong. **Anything where being wrong is expensive and hard to notice.** Confident, plausible, incorrect output is the characteristic failure mode. In this profession that is not an inconvenience. ## The risk that is actually urgent Client financial data is exactly the category of information that should never be pasted into a consumer chatbot, and it is exactly the category people are pasting in right now, because the tool is useful and nobody offered them an approved alternative. You do not solve that with a prohibition. A rule that makes somebody's day harder gets routed around quietly, and you find out about it after something has already happened. You solve it by providing a sanctioned version inside your own environment, so the convenient path and the permitted path are the same path. The related exposure is the one we find in practice. A capable staff member builds an automation on their own machine, it quietly becomes load-bearing for the close, and nobody else knows how it works. That is not an artificial intelligence problem. That is a documentation problem wearing a new hat, and it predates all of this by decades. ## What a firm should do this year 1. **Ask what people are already using.** Without consequences. You will learn more in one honest conversation than in a year of policy. 2. **Provide an approved tool inside your own tenant**, covered by your own agreements, where client data is not training someone else's model. 3. **Write the rule on one page.** What may go in, what may never, who to ask. 4. **Pick the single most repetitive thing in your close** and measure it properly. Time it today, automate one slice, time it again. One measured result beats a year of opinions. 5. **Keep a human review on everything that reaches a client.** Not as ceremony. As the control that makes the rest safe to use. The firms that get hurt here will not be the ones that moved slowly. They will be the ones that never decided anything, and inherited whatever their staff signed up for on a Tuesday. Automation has been eating the bottom of this profession for decades. It has yet to make a single client stop wanting somebody to tell them what the numbers mean. --- # Will AI Replace Lawyers? URL: https://etoptechnology.com/blog/will-ai-replace-lawyers/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-09-14 No. That is the complete answer to the question as asked, and it is not a very useful one. The worry underneath it is legitimate, so let us take the useful version instead: which parts of the work are actually changing, and what should a firm do about it this year. We support law firms for a living, so this is not a thought experiment for us. Here is what we actually see. ## What it is genuinely good at The pattern is consistent. Artificial intelligence performs well where the work is **high volume, language-shaped, and verifiable**. Somebody still has to check it, but checking is far faster than producing. **Reading large document sets and telling you what is in them.** Medical records, discovery productions, deposition transcripts, years of correspondence. A person reads those at a fixed speed. A machine does not. **First drafts of routine documents.** Engagement letters, standard motions, discovery responses that follow a known pattern. The draft is rarely final, and it is nearly always faster than starting from a blank page. **Summarizing and building timelines.** Turning nine hundred pages into a chronology with citations back to the source page is exactly the shape of work these tools do well. **Finding the thing you half remember.** Searching your own closed files for the argument that worked two years ago beats asking the one associate who might recall it. We built a records summarizer for a firm that was spending serious paralegal hours turning medical record productions into usable chronologies. The work did not disappear. It moved. The paralegal now reviews and corrects a draft chronology instead of building one from scratch, and correcting takes a fraction of the time that building did. That is the realistic shape of this. Not replacement. Compression. ## What it does not touch **Judgment with consequences.** Deciding whether to file, whether to settle, what a particular judge will do with a particular argument. These tools produce confident text whether or not they are right, which is precisely the wrong trait for a decision that carries liability. **The relationship.** Clients in distress are not looking for a faster document. They are looking for a person who will tell them the truth about their situation. **Accountability.** A bar card belongs to a human being. No vendor is signing up to be sanctioned on your behalf, and reading a terms of service page will confirm that quickly. **Anything where being wrong is expensive and hard to detect.** Fabricated citations have already embarrassed enough firms to make the point. The failure mode is not that the tool says it does not know. The failure mode is that it answers beautifully and incorrectly. ## The risk nobody puts on the list The threat to most firms is not that this technology takes the work. It is that staff adopt consumer versions of it privately, paste privileged client material into them, and nobody finds out for a year. That is not hypothetical, and it is not a technology failure. It is what happens when a tool is useful, the official answer is no, and nobody offered a sanctioned alternative. People route around a policy that makes their day harder. The fix is not a ban. Bans produce exactly this behavior. The fix is providing a version inside your own tenant, with your own data controls, so that the useful thing and the permitted thing are the same thing. ## What a firm should actually do this year 1. **Find out what is already in use.** Ask without consequences attached. You will learn more in one honest conversation than in six months of policy work. 2. **Give people a sanctioned tool.** Inside your environment, covered by your agreements, where client material is not training somebody else's model. 3. **Write the rule on one page.** What may go in, what may never, who to ask. If it runs twenty pages, nobody reads it and you are back to hoping. 4. **Pick one workflow and actually measure it.** The highest volume, most repetitive, most language-shaped thing your firm does. Time it now. Automate a slice. Time it again. 5. **Keep a human signature on everything that leaves the building.** Not as ceremony. As the control. The firms that struggle here will not be the ones that adopted too slowly. They will be the ones that adopted accidentally, through whatever their staff signed up for on a Tuesday, and never wrote anything down. Technology rarely replaces a profession. It just quietly reprices the parts of it that were never the hard part. If you want help with the first three steps, it's the kind of work we do as [IT for law firms in the Inland Empire](/it-services-law-firms-inland-empire/). --- # The AI Tool We Built for a Law Firm, and the Five Rules That Made It Safe URL: https://etoptechnology.com/blog/ai-tools-we-build-for-clients-medical-records-summarizer/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-09-11 A workers' compensation defense firm we support gets subpoenaed medical records by the box. A single production runs anywhere from around fifty scanned pages to two thousand. Somebody at the firm reads every page and writes a "Summary of Records" letter by hand: the page number, the visit date, what happened, who signed the report, and whether it touches the body parts the claim is about. Their estimate was about an hour per hundred pages, and they had a stack of them. Their question to us was simple. Can AI do this without us getting in trouble? "Can AI do this" turned out to be the easy half. Gpt-5.1 reads a clinic note and writes a tight paragraph in the firm's house style better than most first-year associates. "Without getting in trouble" is the whole job. Those records are protected health information (PHI), the kind of data HIPAA exists to protect. The firm is the custodian. If a summary tool leaks them, the AI vendor doesn't get the bar complaint. The firm does. So here is what we built, and more importantly, the five rules that made it something a law firm could actually use. ## What it does An attorney opens a web page, types the case name, where the records came from, and the body parts pled on the claim. They upload the PDF. Somewhere between one and fifteen minutes later, depending on the size of the file, they get a review table: one entry per encounter or document, in page order, with the date, a paragraph in the firm's voice ("Applicant presented to the clinic with..."), the clinician who signed it, and a flag on every entry that touches a pled body part. They edit, delete the noise, and click export. Out comes a Word document on the firm's letterhead, already named the way their document system expects. Under the hood it is three Azure AI services in a row, plus a Word document generator: optical character recognition (OCR) to turn the scans into text, a de-identification service, and a language model. The interesting part is not the summarizing. It is where the data is allowed to go at each step. ## Rule 1: The AI never learns who the patient is Before a single word reaches the language model, a separate service strips the injured worker's name, date of birth, medical record number, address, phone, and Social Security number. This is not a line in the prompt asking the model to please ignore the name. A prompt is a request. It is not a control. De-identification runs as its own deterministic step, and the model only ever sees text that has already been through it. We made one deliberate exception on names. The names of treating and signing clinicians are preserved, because the attorney needs to know who wrote each report. HIPAA's Safe Harbor rule covers the individual's identifiers, not the doctor's, so this is consistent with de-identification. It took real engineering to keep those names while stripping the patient's, and it was worth it. A summary that says "an unnamed provider signed this" is useless in a deposition. ## Rule 2: The data never leaves the client's house The whole thing runs inside the firm's own Microsoft Azure subscription. Their tenant, their storage, their AI services, their login. We built it, and we can't read a single record. That is on purpose. Because every AI service in the chain is a Microsoft service, one Business Associate Agreement (BAA) covers the entire path. A BAA is the contract HIPAA requires from any vendor that touches health data; it makes the vendor legally responsible for protecting it. There is no third-party model API and no consumer chatbot, so there is no second vendor whose data terms you would have to read and trust. The language model deployment is pinned to US data centers. It costs about ten percent more than the global option. For protected health information, that is the cheapest ten percent you will ever spend. Compare this to the pattern I see constantly: a paralegal pasting a medical record into a free chatbot because it's faster. Same task. Completely different risk. The difference is not the AI. It is the plumbing around it. ## Rule 3: Keep nothing you don't need The uploaded PDF is deleted as soon as processing finishes. Anything that survives a crash gets purged automatically by a storage lifecycle policy within days. The only thing the system keeps long-term is a usage log with the user, a matter label, page counts, and cost. Never the record content. Most AI data leaks are not dramatic. They are a forgotten upload folder that has been quietly accumulating client files that nobody remembered was there. The fix is a retention policy you set once and then never think about again. ## Rule 4: Access should be boring Who can use the tool is controlled by one group in the firm's Microsoft 365. Add someone to the group and they can log in with the account they already have. Remove them and they can't. No separate password, no shared login, no list of users buried in the code that somebody has to remember to update when an attorney leaves. Boring is a feature. The best security controls are the ones nobody has to think about. ## Rule 5: A human signs it The tool writes the first draft. The attorney owns the letter. The review table exists because the model is very good, not perfect, and "very good" is not a standard you can sign your name to. My working number for AI is that it's about 98 percent awesome. The tool exists to catch the other two percent. Early in the build we found a case where the AI service was rate-limiting us during a large job and the tool was silently skipping the throttled pages. The summary looked complete. It wasn't. We fixed it so the tool retries, and if it still can't get through, the whole job stops with an error instead of handing you a letter with a hole in it. The same rule applies to the de-identification step: if that service fails, nothing goes to the model at all. A tool that quietly skips pages is far worse than one that stops and tells you. ## What it costs People assume this kind of thing is expensive. Measured across the first 19 real jobs and about 6,300 pages: | | | |---|---| | Azure cost per 300-page record | about $2 | | Per 1,000 pages | about $6.40 | | Hosting | about $25 per month, flat | By the firm's own estimate, about three hours of staff time for a 300-page record, versus about two dollars of cloud compute. The math is not close. And because it runs in the firm's own Azure, they see every penny on their own bill. ## The one we got wrong I'll tell you about the mistake, because the lesson is the point of this post. During the build, an automation on our side that periodically saves work into version control swept up a test file that contained real record data and pushed it into a private repository. Nobody outside eTop ever saw it. We caught it, scrubbed it, and changed the process: automation never touches a working folder that can hold client data, and the project now refuses to accept a PDF or a rendered letter into version control at all. Notice what the mistake was not. It was not the AI model. It was not a hacker. It was a convenience script doing exactly what it was told. That is where AI projects actually go wrong. The model gets all the attention, and the boring plumbing around it, the folders and the scripts and the logs, is where the data escapes. It's only an expensive lesson if we don't learn from it. ## The questions to ask anyone building you an AI tool I think of AI as a 3D printer for knowledge work. It will happily print whatever you feed it. The safety is entirely in what you feed it and where the output goes. If someone is building an AI tool for your business, or your team is about to start using one, these are the questions that matter: - **Where does the data physically go?** Whose cloud account, whose country, whose agreement? - **What is removed before the model sees it?** And is that a separate step, or a polite request in the prompt? - **What gets kept, and for how long?** If the answer is "we hadn't thought about it," the answer is forever. - **Who can use it, and how do you turn someone off?** If it's not tied to your existing logins, it will drift. - **Who signs the output?** If nobody reviews it, the tool is making decisions, not drafts. None of these questions are about the AI. All of them are about the plumbing. That's the part we do. We build tools like this for [law firms and professional services businesses across the Inland Empire](/it-services-law-firms-inland-empire/), and more often we help clients figure out which of the AI tools their staff are already using are safe. If you want to know where your business stands, our [AI Readiness Assessment](/ai-consulting-inland-empire/) is a fixed-fee review that shows you what your team is actually using, where the data is going, and what to do about it. You keep the findings and the roadmap either way. --- # What Is SOC Monitoring and Why Does Your Business Need It? URL: https://etoptechnology.com/blog/what-is-soc-monitoring/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-08-20 Here's a question I ask business owners all the time: if something suspicious happened on one of your computers at 2 AM on a Saturday, who would know? Not "what tool would flag it." Who — as in, which human being — would see the alert, decide whether it's real, and do something about it before Monday morning? For most businesses, the honest answer is nobody. And that gap is exactly what SOC monitoring exists to close. ## What Is a SOC? SOC stands for Security Operations Center. Straight into the alphabet soup, I know — I'm sorry. But the concept behind the acronym is refreshingly simple: a SOC is a team of security analysts whose entire job is watching environments like yours for signs of trouble, around the clock, every day of the year. Think of it like the difference between a security camera and a monitored alarm system. A camera records everything. That's useful for figuring out what happened after your stuff is already gone. A monitored alarm means a human gets notified the moment glass breaks, evaluates whether it's a burglar or a raccoon, and calls the police if it's real. Same building, completely different outcome. Your security tools are the cameras and sensors. The SOC is the monitoring station. You need both, because a sensor that fires into an empty room protects exactly nobody. ## How SOC Monitoring Actually Works SOC monitoring runs on a three-beat loop: detection, analysis, response. **Detection.** Your security tools — [endpoint detection and response](/blog/what-is-edr/) agents, email security, identity protection, network monitoring — generate a constant stream of signals. Most are harmless noise. A login from a new device. A script a vendor's software runs every night. An admin doing admin things. **Analysis.** This is where the humans earn their keep. Analysts triage the stream and separate "Bob logged in from his beach house" from "someone in a country Bob has never visited just logged in as Bob and started forwarding his email." That judgment call is genuinely hard, and it's the part software alone still gets wrong in both directions — missing real attacks and crying wolf on innocent behavior. There's even a name for what happens when nobody filters the stream: alert fatigue. When every ping looks urgent, people stop looking at all. **Response.** When something is real, the SOC acts: isolate the machine from the network, kill the malicious process, disable the compromised account, and escalate to your IT team with the full story of what happened. Speed is the whole game here. An attacker who gets contained in twenty minutes is an incident report. An attacker who gets a whole weekend is a ransomware negotiation. One more thing analysts watch for that surprises people: silence. When a machine that reports in every hour suddenly goes quiet, or a security agent stops checking in, that absence is itself a signal — it's one of the first things attackers arrange on purpose. We wrote up a real-world example of that pattern in our breakdown of the [Akira Safe Mode attack](/blog/akira-safe-mode-edr-bypass/). ## SOC vs. SIEM vs. EDR: Untangling the Alphabet Soup These three get mixed up constantly, so let me give you the plain-English version: - **EDR** (Endpoint Detection and Response) is a *tool* — software on each computer and server watching behavior. It's the smoke detector. - **SIEM** (Security Information and Event Management) is also a *tool* — a system that collects logs and alerts from everything (endpoints, firewalls, Microsoft 365, servers) into one place so patterns across systems become visible. It's the alarm panel in the hallway that all the smoke detectors report to. - **SOC** is *people* — the team watching the panel, deciding what's real, and responding. The felt meaning for you as a business owner: EDR and SIEM are things you buy. A SOC is a capability you staff. And that's why the tools-versus-team distinction matters so much — a business can spend real money on excellent security software and still be effectively unprotected at 2 AM, because the software's alert went to an inbox nobody reads until Monday. At the end of the day: the technology detects, the people respond. You need both halves. ## Why Mid-Size Businesses Need This Running your own SOC means staffing security analysts around the clock — realistically a team of several people, plus the tooling, plus someone senior enough to make judgment calls. For a Fortune 500 company, that's a line item. For a 30-to-150-person business, it's completely out of reach, which is why this used to be an enterprise-only capability. But the threat doesn't scale down just because your headcount does. Attackers deliberately time their operations for when nobody's watching — CISA and the FBI have [warned specifically](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a) about ransomware timed for weekends and holidays, because attackers know that's when detection and response are slowest. Your business hours are their off-hours on purpose. And modern attacks move fast. The playbook we walked through in the [EDR post](/blog/what-is-edr/) — phished credentials, quiet reconnaissance, then encryption — can run start to finish inside a weekend. If your response starts Monday at 8 AM, you're not responding. You're recovering. This is where managed SOC monitoring changed the math. Instead of building the capability, you share it: a provider's SOC watches many environments at once, which spreads the cost of that 24/7 team across all of them. The capability that used to require an enterprise budget now fits a mid-size one. There's also a practical nudge coming from the insurance side — [cyber insurance carriers](/blog/cyber-insurance-requirements-2026/) increasingly ask pointed questions about monitoring and response capability, not just what software you own. ## What to Look For in a SOC Monitoring Provider If you're evaluating providers — including us — here are the questions worth asking: 1. **Is it actually 24/7/365, with humans?** Some offerings are software-only with "SOC" in the product name. Ask who reviews alerts at 3 AM on a holiday, and what their response time commitment is. 2. **Can they respond, or only notify?** An email that says "you might be compromised" at 2 AM is not a response. Ask whether they can isolate machines and disable accounts directly, and what's pre-authorized versus what waits for your approval. 3. **What do they monitor?** Endpoints are the core, but your identity layer — Microsoft 365 logins, email rules, MFA changes — is where a huge share of modern attacks start. If nobody's watching sign-in activity, there's a big hole in the coverage. 4. **How do they handle false positives?** The right answer involves tuning over time and a human filter, so you get the three alerts that matter instead of three hundred that don't. 5. **Who owns the follow-through?** A SOC that contains an incident and hands you a report still leaves someone needing to rebuild the machine, reset the accounts, and close the hole. If your IT provider and your SOC are different companies, be clear about where that handoff line sits — this is where [incident response planning](/blog/incident-response-planning/) earns its keep. ## How We Handle SOC Monitoring at eTop I'll describe our approach less as a pitch and more as a working example of what integrated looks like. SOC monitoring is [included in our managed services plan](/pricing/) — it's not an add-on, because in my mind selling managed IT without monitoring is selling a car without brakes. Every endpoint we manage runs EDR, the alert stream goes to a 24/7 SOC, and confirmed threats get contained immediately — isolate first, investigate second. A machine that's been isolated can be un-isolated in minutes; data that's been encrypted cannot be un-encrypted, so we don't treat those two risks as equals. Because the same team manages the environment and receives the escalations, the follow-through problem I mentioned above goes away: the people who get the 2 AM alert are the same people who already know your network, your applications, and which server absolutely cannot go down during payroll week. ## The Bottom Line Security tools have gotten genuinely good. But a tool can only tell you something is wrong — it takes people to decide what's real, act in minutes, and see the pattern across systems. You can't protect what you can't see, and you can't respond to what nobody's watching. So go back to my opening question, and please actually ask it this week: if something suspicious happened in your environment at 2 AM on a Saturday, who would know? If the answer is a specific team with a response time, you're in good shape. If the answer is "I think our antivirus would catch it," that's worth a closer look. If you want that closer look, [book an intro call](/contact/) — qualifying Inland Empire businesses receive our IT Risk Assessment complimentary, and where your monitoring gaps are is one of the first things it shows you. --- # Free Copilot vs. Microsoft 365 Copilot: What $21 a User Actually Buys (and What It Doesn't) URL: https://etoptechnology.com/blog/copilot-free-vs-paid/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-08-16 Here is the one-sentence version, and it is the sentence we find ourselves repeating in almost every AI conversation with clients this year: **The free Copilot protects your data. The paid Copilot knows your business. Those are different things, and you probably want both, in that order.** Everything else in this article is the plain-English unpacking of that sentence, plus the arithmetic for deciding whether the paid one is worth it for your team. We are writing this in August of 2026; prices and names below are current as of now. ## What the free one actually is If your company runs on Microsoft 365, every employee already has Microsoft 365 Copilot Chat at no extra cost. Work account sign-in, green shield at the top of the window, and that shield means Enterprise Data Protection: prompts and responses covered under the same Microsoft agreement that protects your email and files today. Not used to train models. Same contractual promises you already trust for Exchange and SharePoint. That is genuinely valuable, and it is the part most businesses have not turned into a decision. Because the alternative is not "no AI." The alternative is what people are already doing: personal ChatGPT accounts, personal Copilot, whatever tool a well-meaning employee found on their own. The free business version exists so that work AI happens inside your company's legal umbrella instead of outside it. But read the label carefully: Copilot Chat answers from the public web. It cannot go searching your files, your email, your calendar, or your Teams messages. The only company data it works with is what a user hands it, a file uploaded into the chat or the mailbox content when it is used inside Outlook. Ask the chat "what did we quote the Johnson job" and it has no idea. It is a very capable assistant that has never met your company. Protection, not context. ## What the paid one actually is Microsoft 365 Copilot, the paid add-on, is the same class of AI with permission to read what your team can already read: mail, files, chats, meetings, through Microsoft Graph. It also lives inside the Office apps themselves, so Word can draft from your documents, Excel can work on your spreadsheet, Outlook can summarize the thread you are actually looking at, and Teams can tell you what happened in the meeting you missed. The pricing, as of this writing: $30 per user per month on enterprise plans, which carry an annual term, or $21 per user per month list on the small-business version (up to 300 seats), which also offers a month-to-month option at a small premium. Microsoft has been running an $18 promo on the small-business version for much of 2026 and it was still live as we wrote this, so check the current number before you buy. Two boundaries worth knowing before you buy: **It only sees what each user can see.** Copilot respects your existing permissions. That is the right design, and it has a sharp edge: if your permissions are sloppy, and after fifteen years of SharePoint sprawl most are, Copilot becomes a very efficient way for employees to find files they were never supposed to have access to. Worth checking before you roll it out, not after. **It is only as good as what it reads.** If the answer to a question lives in someone's head, or in a folder called "FINAL final v3 USE THIS ONE," Copilot will do what any new hire would do with that mess: guess. We wrote a whole article on this because it is the number one reason paid Copilot disappoints people: [Copilot is only as smart as your SharePoint](/blog/copilot-readiness-sharepoint/). ## The math, honestly Run the math on the standing $21 price (the promo just makes it better): $21 per user per month is $252 a year. Take an employee whose fully loaded cost is around $30 an hour; $252 is a little over eight hours of their time, which works out to about 10 minutes a week. That is the whole bar: for the license to pay for itself, Copilot has to save ten minutes a week. A low bar for anyone who writes emails, sits in meetings, or hunts for documents, which is to say, everyone in the office. (Higher wage, lower bar. Run your own number the same way.) So why not just buy it for everybody? Because in practice the value is lumpy. In our experience the people who get daily value out of the paid license are the ones drowning in communication and documents: owners, office managers, estimators, project managers, anyone who writes proposals or summarizes meetings for a living. The person who lives in one line-of-business app all day and touches Outlook twice a week will not notice it, and at the end of the day an unused license is just a subscription with better marketing. Our standard recommendation looks like this: 1. **Everyone:** free Copilot Chat, on work accounts, with a one-page AI use policy so it is a decision instead of an accident. 2. **A pilot group of 3 to 5 heavy communicators:** paid licenses for 60 to 90 days with a short list of things to actually try (meeting recaps, first-draft proposals, inbox catch-up). 3. **Then decide with data.** Microsoft's admin center shows who is actually using their license. Expand the people who use it, pull it from the people who do not, and revisit twice a year. A restoration company we work with, about 16 people, is the honest picture of where most businesses start: when we ran a cloud discovery, six or more staff were already on the free Copilot with work accounts, two were on personal ChatGPT, one was a heavy user of a different paid AI tool, and the company held zero paid Copilot licenses. Nothing about that is unusual, and nothing about it was planned. The gap between "AI is happening here" and "we decided how AI happens here" is where both the risk and the wasted money live. ## The one-sentence version, again Free Copilot Chat is your legal umbrella; open it today, it costs nothing. Paid Microsoft 365 Copilot is a productivity tool for people who live in email, meetings, and documents; pilot it, measure it, then scale it. And before you scale it, make sure the house it is about to read is one you would want read: [start with your SharePoint](/blog/copilot-readiness-sharepoint/). Still not sure which Copilot is which? The full map of every product wearing the name is here: [Every Microsoft Copilot, explained](/blog/microsoft-copilot-versions-explained/). **Want the numbers for your own team?** Our complimentary AI maturity assessment inventories what your people already use, which licenses you already own, and where a paid seat would actually pay back. [Book a complimentary AI maturity assessment](/contact/) and we will run it with you. --- # You Bought a Copilot+ PC. You Still Don't Have Copilot. URL: https://etoptechnology.com/blog/copilot-plus-pc-vs-copilot-license/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-08-16 We see this one at quote time, and it is such a reasonable mistake that Microsoft's marketing has to own most of it. A business replaces a batch of laptops, the new machines all say Copilot+ PC on the box, and somewhere in the buying conversation a sentence forms: "these come with the AI." They do not. Not the way you mean. ## The sticker is about the chip Copilot+ PC is a hardware certification, like "Intel Inside" was. To wear the badge, a machine has to meet a spec: - **A neural processing unit (NPU)** rated at 40+ trillion operations per second: a chip built specifically for AI math - **16 GB of RAM** minimum - **256 GB of storage** minimum And the badge does buy some genuinely on-device features that only run on that chip: live captions with real-time translation, creative image tools, better battery life on the ARM models, and Windows Recall, which we will get to in a second because it deserves its own paragraph. A Copilot+ machine is a perfectly good laptop. Here is what the badge does not include: any Copilot license. No Microsoft 365 Copilot. Not a month of it. The AI your business actually cares about, the one that reads your email and drafts your documents, is a subscription tied to your Microsoft 365 accounts, and it costs the same $21 to $30 per user per month list whether your team types on a brand-new Copilot+ machine or a five-year-old desktop. The laptop and the license do not know about each other. So: you can buy ten Copilot+ laptops and have exactly as much business Copilot as yesterday. You can also skip the badge entirely and give your team the full paid Copilot experience on the hardware you already own. The sticker and the software are sold separately, and in my mind that one sentence would have saved half the confused purchasing conversations of the past year. Which Copilot is which, in full: [Every Microsoft Copilot, explained](/blog/microsoft-copilot-versions-explained/). ## The arithmetic, because the sticker costs real money Copilot+ machines typically carry a price premium over an equivalent laptop without the badge; call it a couple hundred dollars a unit depending on the model. On a ten-laptop refresh, that can be a couple thousand dollars of "the AI," purchased by accident. That same couple thousand dollars buys eight or nine seats of actual Microsoft 365 Copilot for a year at small-business pricing. One of those purchases changes how your office managers and estimators work every day. The other buys a faster AI chip that most business software does not use yet. Please spend the money on purpose, whichever way you spend it. The honest counterpoint, because there is one: if you are refreshing laptops anyway and the price gap is small, the NPU is decent future-proofing. Microsoft is clearly moving more AI features on-device over time, and a machine you will keep for four or five years might as well be ready. Buying the badge is fine. Believing the badge is a subscription is the mistake. ## The Recall conversation your business should have on purpose One more thing rides along with Copilot+ hardware, and you should hear about it from your IT provider instead of from an employee's discovery: Windows Recall. It is a feature, off by default and Copilot+ only, that takes continuous snapshots of what is on the screen so the user can search their own past activity in plain English. "That vendor quote I saw somewhere last Tuesday" becomes findable, which is genuinely useful. It also means a rolling visual record of everything on that screen: customer records, financials, HR conversations. The snapshots stay on the device, encrypted and gated behind Windows Hello, and it all requires the user to opt in. But whether a tool like that belongs in your business is a policy decision, not a default you inherit because the new laptops happened to have a sticker. If you handle regulated data (health information, legal client files, taxpayer records), please decide about Recall before your fleet does, and put the decision in the same one-page policy that covers [which AI tools are approved and what never gets pasted into them](/blog/is-copilot-safe-for-business-data/). ## How to buy laptops without the confusion Three questions, in order, before anyone quotes hardware: 1. **What do we want the AI to do?** If the answer involves your email, documents, and meetings, that is a license conversation. Start with [free vs. paid Copilot](/blog/copilot-free-vs-paid/), not a spec sheet. 2. **Is our data ready for it?** A Copilot license reading a messy, overshared SharePoint just finds the mess faster. [Readiness first](/blog/copilot-readiness-sharepoint/). 3. **Then pick hardware.** If the refresh is due anyway, Copilot+ is a reasonable default. If someone is proposing new laptops in order to "get Copilot," that is the sticker talking. The laptop is where the work happens, the license is what knows your business, and the sticker is just a chip. Buy each one on purpose. **Planning a hardware refresh or an AI rollout, or untangling one from the other?** Our complimentary AI maturity assessment sorts exactly this: what your licenses already include, what is worth paying for, and what your next laptop order actually needs. [Book a complimentary AI maturity assessment](/contact/). --- # Copilot Is Only as Smart as Your SharePoint URL: https://etoptechnology.com/blog/copilot-readiness-sharepoint/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-08-16 There is a conversation happening in a lot of businesses right now, and it goes like this. The company buys Microsoft 365 Copilot licenses, the demo looked incredible, and three months later somebody says the quiet part: "Honestly? It gives me generic answers. I stopped using it." Then the conclusion gets drawn: the AI is overhyped. In my opinion, that conclusion is wrong almost every time. The license was never the problem. Copilot did exactly what it was designed to do: it read what you gave it. The problem is what you gave it. ## Hiring a genius and handing them the junk drawer Think of paid Copilot as a brilliant new hire who reads at superhuman speed and remembers everything. Day one, you hand them your company's entire file system and say "get up to speed." Now be honest about what they just inherited. A SharePoint that grew for a decade without a plan. Three folders named Final. A pricing sheet from 2019 sitting next to the current one with nothing to say which is which. The real process for how you onboard a customer living in one veteran employee's head, and nowhere else. Old proposals, dead clients, drafts of drafts. A human new hire survives this by asking the person at the next desk. Copilot cannot ask. It reads the junk drawer, weighs the 2019 sheet the same as the current one, and produces an answer with complete confidence. Then the employee who asked loses trust, and the license goes quiet. Copilot cannot know what your company never wrote down, and it cannot tell current from stale unless the files themselves make it obvious. ## The permissions problem nobody wants to find There is a second issue, and it is sharper than the messy-folders one. Copilot respects your existing permissions: each user's Copilot sees only what that user can already open. Correct design. But in most businesses that have been on Microsoft 365 for years, "what each user can already open" is a much bigger pile than anyone intends. A folder shared with "everyone" in 2021 to get through a crunch week. A site where new employees were added to the wrong group. Salary sheets, buyout terms, HR notes, technically visible to half the company for years. Before Copilot, that oversharing was mostly protected by obscurity: nobody went looking. Copilot ends obscurity, because now anyone can ask a plain question in plain English and the tool will diligently search everything they have access to. It does not create the hole, it just finds it, and that is the whole problem: you can't protect what you can't see, and Copilot is about to see all of it. This is why we tell clients, please, run the permissions review before the rollout, not after the first awkward discovery. ## What Copilot readiness actually means Vendors have turned "Copilot readiness" into a buzzword, so here is the concrete version. Getting real value out of paid Copilot is three jobs, and none of them are optional: **1. Fix who can see what.** Audit sharing links and group membership, lock down the folders that were never meant to be broad, and put sensitivity labels on the genuinely confidential stuff. Microsoft gives you the tools for this; the work is deciding, not clicking. **2. Give it something worth reading.** This is the unglamorous one and the one that decides everything. The businesses getting real value from Copilot maintain what we call a company brain: a current, organized, deliberately maintained set of documents that describe the business. What you sell and at what price, how your processes actually run, the templates you actually use, the answers to the questions people actually ask. Not everything you have ever saved. The curated version, with the stale stuff archived out of sight so the AI reads the current truth instead of averaging a decade. Skip the maintenance and the answers drift stale again within a year. This is not a one-time cleanup, it is a habit, the same way payroll is a habit. **3. Point people at real use cases.** "Go use Copilot" fails. "Use it to recap every project meeting and draft the follow-up email" sticks. Pick five workflows that matter in your business and teach those, not the tool in the abstract. Do those three and the same license that disappointed everyone starts looking like the demo. Skip them and no AI product on the market will save you, because every one of them reads the same junk drawer. ## The part worth stealing even if you never buy Copilot Here is the thing we find genuinely exciting about this, and it is a bigger idea than one Microsoft product. The company brain you build for Copilot is not Copilot-specific. The same organized, current knowledge base is exactly what makes any AI useful: ChatGPT's business plans can connect to it, Claude can work from it, the next tool can too. The tools will keep changing. The asset is yours. Our clients pay us to keep their networks and security maintained. Increasingly, we maintain this layer too, because it decays the same way an unpatched server does, and because it is the difference between AI that demos well and AI that answers like it works there. The model is a commodity now. Your context is not. The businesses that win with AI in the next few years will not be the ones with the best subscriptions. They will be the ones whose company actually fits inside the machine. Not sure which Copilot any of this applies to? Start with the map: [Every Microsoft Copilot, explained](/blog/microsoft-copilot-versions-explained/), and the [free vs. paid breakdown](/blog/copilot-free-vs-paid/). **Want to know if you are Copilot-ready before you spend $21 a seat?** Our AI maturity assessment looks at exactly this: your permissions exposure, the state of your file estate, and which five workflows would pay back first. [Book a complimentary AI maturity assessment](/contact/). The permissions findings alone are usually worth the conversation. --- # Is Copilot Safe for Your Business Data? An Honest Answer URL: https://etoptechnology.com/blog/is-copilot-safe-for-business-data/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-08-16 Short answer: used the right way, yes, and the protection is contractual, not marketing. Used the way it actually happens in most offices, you have a gap, and it is probably not the gap you think. Let us take both halves honestly. We are writing this in August of 2026; the terms below are current as of now. ## The protection is real when the sign-in is right When an employee uses Copilot signed in with their work account (the Microsoft Entra account your Microsoft 365 runs on), their prompts and the AI's responses are covered by what Microsoft calls Enterprise Data Protection. You will see older articles call it "commercial data protection"; Microsoft retired that term in 2024 and upgraded the coverage. The visible tell in the chat window is a small green shield. Plain English, Enterprise Data Protection means: - **Your prompts are not training material.** What your team types does not get used to train Microsoft's models. - **Same contract as your email.** Prompts and responses fall under the same Microsoft Data Protection Addendum that already covers your Exchange mailboxes and SharePoint files. If you trust Microsoft 365 with your email, and you literally already do, the AI chat rides under that same agreement. - **Your rules follow the data.** Encryption in transit and at rest, tenant isolation, audit, retention. For the paid Microsoft 365 Copilot, your sensitivity labels and permissions apply too: each user's Copilot sees only what that user can already open. The free Copilot Chat has one more safety property nobody advertises: it cannot go searching your files, email, or Teams on its own. The only company data it touches is what an employee hands it, a file uploaded into the chat or the mailbox content when it is used inside Outlook. That limit is exactly why it gives generic answers, and it is also why the blast radius is small: a tool that cannot crawl your data cannot stumble into it. What remains is the human half, what people choose to paste and upload, and that is precisely what the one-page policy further down is for. You only trade this safety-by-ignorance for usefulness when you deliberately choose the paid, connected version. Is any of this zero-risk? Nothing is, and we never claim a hundred percent on anything in security. But "is Copilot safe for business data" is, on Microsoft's side of the fence, one of the better-papered questions in the industry. For most small businesses, the contractual protection on work-account Copilot is stronger than the protection on half the other apps the team already uses without thinking about it. ## The gap is not the tool, it is the sign-in Now the half that actually bites people. Every protection above hangs on one condition: the work account. The same Copilot website, opened with a personal Microsoft account, is a consumer product under consumer terms. Personal ChatGPT is a consumer product under its own terms, where, unless the user goes and changes settings, the default posture is very different. None of the contractual coverage your business pays for follows the employee to a personal login. And personal logins are what actually happens. At one 16-person company we assessed, the discovery data showed both patterns running side by side: most of the AI use was on protected work accounts, and two employees were on personal ChatGPT for work tasks. Nobody was careless and nobody was sneaky. They were being resourceful with tools nobody had given them an answer about. In our experience that split is completely typical, and it means the real question is not "is Copilot safe." It is "which AI is our data actually in, and under whose terms?" What you have not decided, your employees have already decided for you. Think about what gets pasted into a chat window during one honest workday: a customer's claim details, an employee issue, a spreadsheet of financials, the draft contract. On a work account, that stays under your Microsoft agreement. On a personal account, you have effectively emailed it to a service with no contract with your company. Same employee, same intent, completely different outcome, decided by which login was active. ## What "safe" looks like in practice The fix is not banning AI. Please do not ban AI; the ban does not stop the use, it just chases it onto personal devices and personal accounts where you cannot see it, and at the end of the day, the do-nothing option is the one that loses. The fix is three moves, none of them expensive: **1. Give everyone a sanctioned door.** If you pay for Microsoft 365, the free work-account Copilot Chat is already included. Announce it, show the green shield, and make it the default answer to "can I use AI for this?" A sanctioned free option beats an unsanctioned free option every day of the week. (Not sure which version you have? [Here is the map of every Copilot](/blog/microsoft-copilot-versions-explained/).) **2. Write the one-page AI use policy.** Not a 30-page legal document nobody reads. One page: here are the approved tools, here is the sign-in you must use, here are the data classes that never go into any AI tool (customer PII, health information, payroll, anything under NDA), and here is who to ask when you are not sure. In some industries this is not optional hygiene, it is compliance: if you handle health information under HIPAA, client files at a law firm, or taxpayer data at a CPA firm, an employee pasting that data into a personal AI account is the kind of gap that forces a breach assessment on a bad day, and the assessment is expensive even when the answer comes back "no harm done." **3. Check the permissions before you upgrade.** If you move to the paid Microsoft 365 Copilot, remember that it can see whatever each user can see. Years of casual SharePoint sharing means that is usually more than you intend. Run the access review first. We wrote up why in [Copilot is only as smart as your SharePoint](/blog/copilot-readiness-sharepoint/). ## The bottom line Copilot on a work account: contractually protected, not used for training, governed by the agreement you already trust with your email. Genuinely safe enough for everyday business use, with the same caveat as everything else in security: safe is a process, not a purchase. AI use nobody has looked at: that is where your actual exposure is, and it is running at your company today whether or not you have decided anything. It is only an expensive lesson if you don't learn it from somebody else's incident instead of your own. **Want to know what is actually in use at your company?** Our complimentary AI maturity assessment inventories the AI your team is really using, sorts it into sanctioned and shadow, and leaves you with the one-page policy and a rollout plan. [Book a complimentary AI maturity assessment](/contact/). It is a short conversation, and the discovery report alone usually settles the "are we okay?" question with data instead of hope. --- # Every Microsoft Copilot, Explained: Which One Do You Actually Have? URL: https://etoptechnology.com/blog/microsoft-copilot-versions-explained/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-08-16 A business owner asked us a simple question recently: "Do we have Copilot?" Honest answer: it depends on which Copilot you mean, and in true Microsoft fashion, there are at least seven things called Copilot. Some are free. One is $21 to $30 per user per month. One is a sticker on a laptop. One is a different product for programmers that happens to share the name. Nobody in your office is wrong for being confused. The naming is the problem, not your people. So here is the map. We are writing this in August of 2026, and Microsoft has renamed parts of this lineup three times in three years, so if you are reading this much later, the labels may have shifted again. The structure underneath tends to stay the same. ## The quick answer table | Name | What it is | Cost | Knows your business data? | |---|---|---|---| | Microsoft Copilot (consumer) | Free chat with a personal Microsoft account | Free | No | | Microsoft 365 Copilot Chat | Free chat for work accounts, protected by your company's Microsoft agreement | Included with Microsoft 365 | Only what you hand it | | Microsoft 365 Copilot | The paid one inside Word, Excel, Outlook, Teams | $21 to $30 per user/month | Yes, that is the point | | Copilot Pro | Retired. Consumer plan, replaced by Microsoft 365 Premium | Was $20/month | No | | Copilot Studio | A tool for building custom AI agents | Usage based | Only what you wire up | | Copilot+ PC | A hardware badge on new laptops | Price of a laptop | No, it is a laptop | | GitHub Copilot | Coding assistant for software developers | Separate product | No | That table settles most arguments. The rest of this article is the plain English version of each row, because the differences matter more than they look. ## So, is Copilot free? Since it is the most-asked question, here it is straight: two Copilots are free. The consumer chat app is free for anyone. And if your business pays for Microsoft 365, every employee already has the business-grade Copilot Chat included, protected under your existing Microsoft agreement. The version that reads your company's email and files is the one that costs money: $21 to $30 per user per month. Free gets you a capable assistant with legal protection. Paid gets you one that knows your business. Fair question at this point: why would Microsoft give the business version away? Because it is not really free, it is included. You already pay for Microsoft 365, and Copilot Chat is a feature of that subscription the same way Teams is. Normally when something is free, you are the product; here Microsoft cannot monetize your prompts (the contract says they are not training material), so what they are monetizing is your next decision. The free tier keeps your team off personal AI accounts, builds the daily habit on Microsoft's surfaces, and makes the paid license a short hop instead of a sales pitch. Understand that and you can use it accordingly: take the free tier without suspicion, and treat the upgrade as arithmetic, not mystery. Now the rows, one at a time. ## Microsoft Copilot, the free consumer one This is copilot.microsoft.com and the Copilot app on your phone or in Windows, signed in with a personal Microsoft account, or not signed in at all. It is a general-purpose chat assistant, it is genuinely useful, and it is a consumer product with consumer terms. The thing to understand: if your employees are using this one for work, your company data is going through a consumer service. Not because anyone is doing anything wrong, but because nobody told them the work version exists. Please keep that thought, because it comes up again in a minute. ## Microsoft 365 Copilot Chat, the free one your business already has If your company pays for Microsoft 365, your team already has a business version of Copilot chat at no extra cost. It lives at m365copilot.com and inside the Microsoft 365 app, and the tell is a small green shield at the top of the chat window. That shield means Enterprise Data Protection: your prompts and answers are covered by the same Microsoft agreement that already protects your email in Exchange and your files in SharePoint. Microsoft does not train its models on what your team types there. Two things to know about Copilot Chat. First, the protection only applies when people sign in with their work account. Same website, different sign-in, completely different rules. Second, and this is the part that surprises people, Copilot Chat answers from the public web. It cannot go searching your files, your email, or your Teams messages on its own; the only company data it sees is what someone hands it, a file dragged into the chat or the mailbox content when it is used inside Outlook. Out of the box, it is a smart assistant that knows nothing about your company. In our experience, most small businesses are already using this version by accident: employees signed in with work accounts, protected without anyone having planned it, right alongside coworkers on personal AI accounts with no protection at all. AI adoption happens to you before it happens with you. We walk through a real example of that mix (and the money math) in [Free Copilot vs. Microsoft 365 Copilot](/blog/copilot-free-vs-paid/), and an [AI use policy](/blog/is-copilot-safe-for-business-data/) is how you turn the accident into a decision. ## Microsoft 365 Copilot, the paid one This is the one Microsoft means when they advertise Copilot to businesses, and the one worth a real decision. It is an add-on license on top of your Microsoft 365 plan: $30 per user per month for enterprise plans, and since late 2025 there is a small-business version for up to 300 people that lists at $21 per user per month. Microsoft has been running an $18 promo on that small-business version for much of 2026, still active as we write this, so ask for the current number before you buy rather than assuming either figure. What the money buys is not a smarter chatbot. It is the same class of AI with your permission to read your company's data: your email, your files, your meetings, your Teams chats, through something Microsoft calls the Microsoft Graph. That is how you get "summarize this contract against our standard terms" or "draft a reply based on the last three emails with this customer" or Copilot sitting inside Word and Excel working on the actual document in front of you. At the end of the day, that is the entire difference between free and paid: free Copilot protects your data but knows nothing about your business. Paid Copilot knows your business. We wrote up the full comparison, including when $21 per user is worth it and when it is not, in [Free Copilot vs. Microsoft 365 Copilot](/blog/copilot-free-vs-paid/). One honest warning before you buy it for everyone: paid Copilot is only as good as the data you point it at. If your SharePoint is a mess, Copilot reads the mess. More on that in [Copilot is only as smart as your SharePoint](/blog/copilot-readiness-sharepoint/). ## Copilot Pro, the one you can stop googling Copilot Pro was the $20 per month consumer upgrade. Microsoft retired it: closed to new sign-ups in late 2025, and support for existing subscribers ended August 1, 2026. Its features moved into a consumer plan called Microsoft 365 Premium at about the same price. If you were searching "Copilot vs Copilot Pro" to decide for your business, the real answer is that neither was the business product. For work, the choice is Copilot Chat (free) versus Microsoft 365 Copilot (paid), on work accounts. Copilot Pro was for personal use, and now it is for nobody. ## Copilot Studio, the one for building agents Copilot Studio is not an assistant, it is a workbench. It is what you or a partner uses to build custom AI agents: a bot that answers HR questions from your handbook, an agent that drafts quotes from your price list, that kind of thing. It bills by usage (Microsoft sells prepaid credit packs, roughly $200 a month for a healthy allowance, or pay as you go). Most businesses under 100 people do not need to think about Copilot Studio until they have a specific, repetitive workflow they want to hand to an agent. When you do, that is a project conversation, not a license checkbox. ## Copilot+ PC, the one that is a laptop This one causes real purchasing mistakes, so let us be clear: Copilot+ PC is a hardware badge, like "Intel Inside." It means the laptop has a neural processing chip fast enough for certain on-device AI features. It does not include, activate, or substitute for any Copilot license. You can buy ten Copilot+ laptops and have exactly as much business Copilot as you had before: whatever your Microsoft 365 licenses say. We wrote that one up separately, because we keep seeing the confusion at quote time: [You bought a Copilot+ PC. You still don't have Copilot.](/blog/copilot-plus-pc-vs-copilot-license/) ## GitHub Copilot and the other ones GitHub Copilot is an AI assistant for software developers writing code. Same brand, different product, different bill. Security Copilot is an AI tool for security operations teams. If your business does not employ programmers or run a security operations center, neither is your problem. They are on this list only because they show up when you search "Copilot" and muddy the water. ## So which one do you actually have? Quick self-check, in order: 1. **Do you pay for Microsoft 365?** Then everyone already has Copilot Chat free. Look for the green shield when signed in with a work account. 2. **Does anyone have the paid license?** Check your Microsoft 365 admin center under licenses for "Microsoft 365 Copilot." If you do not know who holds them, that is worth finding out; at $21 to $30 per user per month, unused seats add up fast. 3. **Are people using AI outside both of those?** Personal ChatGPT, personal Copilot, whatever else. In our experience the answer is yes at almost every company, and it is nobody's fault, because nobody made a decision. That third one is the real finding at most businesses we assess. You cannot get value from AI your business never decided to use. **If you want the picture for your company:** we run a complimentary AI maturity assessment that inventories what your team is actually using, what your licenses already include, and what is worth paying for. It usually finds free capability you already own and at least one surprise. [Book a complimentary AI maturity assessment](/contact/) and we will walk it with you. --- # Microsoft Patched 400 Flaws This Week. Here's the Part That Applies to You. URL: https://etoptechnology.com/blog/august-2026-patch-tuesday-smb-roundup/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-08-14 This week Microsoft shipped its August security update, and it was a big one: [roughly 400 vulnerabilities fixed, including three zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/), one of which attackers were already using before the patch existed. You don't need to read 400 CVE writeups. You need to know which handful change what your IT team or IT provider should be doing this week. Here's that list, in plain English. ## 1. The zero-day attackers are already using: CVE-2026-68820 **The headline:** [CVE-2026-68820](https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/) is a flaw in a low-level Windows networking driver (the Ancillary Function Driver for WinSock) that lets an attacker who already has a foothold on a machine elevate themselves to SYSTEM — the highest level of privilege Windows has. It was being exploited before the patch shipped: reporting ties the exploitation to North Korea's Lazarus group, which used it to install a kernel-level rootkit. [CISA added it to the Known Exploited Vulnerabilities catalog on August 11](https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog), the same day the patch came out. **Why it matters to SMBs:** "An attacker who already has a foothold" sounds reassuring until you remember how footholds happen: a phishing email, a malicious document, a compromised browser session. Privilege-escalation bugs like this are the second half of nearly every serious intrusion. The first half gets the attacker onto one machine as a regular user. This bug turns that regular user into the machine's owner — able to disable security tooling, harvest credentials, and move deeper into the network. When a flaw like this is on CISA's KEV list, it isn't theoretical. It's in active use. **What to do:** - Apply the August Windows updates across every workstation and server. This is not a "next maintenance window" patch. Aim for days, not weeks. - If your patching is automated (it should be), confirm the August cumulative update is actually landing — check the reporting, don't assume. Machines that are off, off-network, or wedged on a failed update are the ones that get you. - Ask whoever runs your IT one question: "What percentage of our machines have the August update installed, and when will it be 100?" A good provider answers with a number. ## 2. Two more zero-days, publicly disclosed before patching The other two zero-days — [CVE-2026-62832, nicknamed "LegacyHive," in the Windows User Profile Service](https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/), and CVE-2026-72971 in a Windows container driver — were publicly disclosed before Microsoft patched them, which means attackers had a head start on studying them. Both are privilege-escalation flaws in the same family as the one above: they turn a small compromise into a full one. There's no separate action here. The same August update covers them. They're extra weight on the same scale: this month's update closes three known doors, one of which is confirmed in active use. ## 3. Critical flaws in Windows DNS, DHCP, and remote access services **The headline:** Buried in the 400 are [critical remote-code-execution flaws in Windows DNS Server, DHCP Server, and the Routing and Remote Access Service](https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/) — plus more than a dozen critical bugs across Office apps including Word, Excel, and Access. **Why it matters to SMBs:** In most small business networks, DNS and DHCP run on the same box as everything else: the domain controller. A remote-code-execution flaw in a service running on your domain controller is about as serious as it gets — that's the server that holds every password hash in the company. The Office flaws matter for a different reason: they're the kind that get triggered by opening a document someone emailed you. **What to do:** - Make sure servers are in the patch cycle, not just workstations. We regularly walk into environments where laptops patch automatically and the servers are months behind because "rebooting them is disruptive." That tradeoff made sense in 2015. It doesn't now. - If you run your own domain controllers, patch and reboot them this week, in a planned window, in the right order. If your IT provider manages them, ask when it's scheduled. ## 4. The SharePoint bypass being exploited right now: CVE-2026-55040 **The headline:** This one wasn't patched this week — it was patched in July. It's on this list because [attackers started actively exploiting it this week](https://thehackernews.com/2026/08/attackers-exploit-sharepoint.html), using a public proof-of-concept. CVE-2026-55040 is an authentication bypass rated 9.1 out of 10: by forging the tokens SharePoint uses to decide who's logged in, an attacker can impersonate users — including administrators — on a vulnerable SharePoint server without any credentials. Researchers recorded a dozen exploitation attempts since mid-July, with the majority landing on August 12 and 13. It's the fifth SharePoint flaw exploited in the wild this year. **Why it matters to SMBs:** If your SharePoint lives inside Microsoft 365, patching it is Microsoft's job and this isn't your fire to fight. But plenty of businesses — especially in legal, engineering, and manufacturing — still run SharePoint Server on their own hardware, often supporting one legacy workflow nobody wants to touch. A month-old patch plus a public exploit plus active scanning is exactly the combination that gets unpatched servers compromised at scale. Attackers don't find these servers by targeting you. They find them by scanning everyone. **What to do:** - Answer one question definitively: "Do we run SharePoint on any server we own?" If nobody knows, that's the first problem. - If yes, confirm the July 2026 SharePoint security updates are installed. Not "we think so" — confirmed, with the version number checked. - If the server exists to support one old workflow, put a migration to SharePoint Online on the roadmap. Every year it stays on-prem is another year of months like this one. ## The pattern this month Two things are worth internalizing beyond the individual bugs. **The window between patch and exploitation keeps collapsing.** The SharePoint flaw went from patched to proof-of-concept to active exploitation in about a month, and most of the observed attacks happened in a two-day burst this week. The WinSock zero-day was being exploited before the patch existed at all. If your patch cadence is "monthly, when convenient," you're structurally behind attackers who move in days. **Privilege escalation is the theme.** All three zero-days are ways to turn a small foothold into full control. That's a reminder that patching and prevention are half the game — the other half is detecting the initial foothold before it escalates. That's what [endpoint detection and response](/blog/what-is-edr/) and [managed monitoring](/blog/what-is-soc-monitoring/) exist for. ## The bottom line Four hundred fixes, three zero-days, one active exploitation campaign against a month-old patch. None of it made the evening news, and all of it is the normal operating tempo of 2026. Your business doesn't need to track any of this — it needs to be able to answer, quickly and with numbers, "are we patched, and how do we know?" If you can't answer that today, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary. We'll look at your actual patch coverage, your server update cadence, and what's still running in your environment that shouldn't be, and give you a prioritized punch list ranked by real risk. We covered [May's vulnerability roundup here](/blog/may-2026-critical-vulnerabilities-smb-roundup/) — the months keep looking like this. The businesses that do fine are the ones with a system, not the ones with luck. --- # Ransomware Rebooted the Server Into Safe Mode — and the Security Software Never Saw It URL: https://etoptechnology.com/blog/akira-safe-mode-edr-bypass/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-08-14 Here's an uncomfortable question: what happens to your security software when the computer it runs on boots into Safe Mode? For most third-party endpoint protection, the answer is: it doesn't load. Safe Mode is Windows' minimal-boot troubleshooting state — it deliberately skips most drivers and services, and that includes a lot of security tooling. Ransomware crews know this, and in [an incident documented in detail this week](https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/), an Akira ransomware affiliate used it as the centerpiece of an attack. The play-by-play is worth walking through, because almost every step has a direct lesson for a small or mid-sized business — including the step where the attack partially failed. ## How the attack unfolded According to the incident report, on August 4 the attacker logged into the victim's **SonicWall VPN using an account that had no multi-factor authentication**. Not an exploit. Not malware. A username and password on an internet-facing VPN, and no second factor to stop it. Within about two hours they had mapped the network's Active Directory — the who's-who and what's-where of the environment. They installed AnyDesk, a legitimate remote-access tool, to keep a reliable way back in. Then the notable part: they **rebooted a machine into Safe Mode with Networking**. The third-party security tooling didn't load. Real-time antivirus protection was blinded. The report describes a roughly ten-minute window where the host had no working EDR at all. The attacker had pre-registered AnyDesk to run in Safe Mode via the registry, so their access survived the reboot while the defenses didn't. From there they harvested credentials and exfiltrated data — compressing files with WinRAR and shipping them to an attacker-controlled cloud storage bucket with a copy tool. ## Where it went wrong for the attacker The final act failed. The ransomware executable wouldn't run in Safe Mode — it crashed with memory errors. And when the machine rebooted back to normal mode, a scheduled Microsoft Defender scan caught and quarantined the payload. So the encryption never happened. But be honest about why: the payload failed for technical reasons the attacker didn't anticipate. That's luck. The data theft had already succeeded — and with crews like Akira, stolen data is its own extortion lever. "The files never got encrypted" and "the incident was harmless" are very different sentences. ## What this incident actually teaches **The VPN account without MFA was the whole ballgame.** Everything downstream — the reconnaissance, the Safe Mode trick, the data theft — was enabled by one credential with no second factor on an internet-facing system. This is the single most common serious finding in the assessments we run. Not exotic. Not expensive to fix. If you have any remote access into your network — VPN, remote desktop, remote-access software — every account on it needs MFA, with zero exceptions, including (especially) the old service and vendor accounts everyone forgot about. **EDR is a layer, not a force field.** We're strong advocates for [endpoint detection and response](/blog/what-is-edr/), and this incident doesn't change that — it clarifies it. EDR raises the cost and noise of an attack dramatically. It also runs on the same machine the attacker is trying to control, and attackers invest heavily in switching it off: Safe Mode reboots, vulnerable-driver tricks, straight uninstalls with stolen admin credentials. A security posture that amounts to "we bought good antivirus" fails exactly here. The tooling needs to be part of a stack: MFA at the entrances, EDR on the endpoints, and monitoring that notices the things a blinded agent can't report. **Absence of signal is a signal.** When a machine reboots into Safe Mode, or an EDR agent goes quiet mid-day, or a new remote-access tool appears in the environment, those events are the alarm. Detecting them requires someone — a [monitored security operation](/blog/what-is-soc-monitoring/), internal or outsourced — watching for machines that stop reporting, not just machines that report something bad. The incident responders' own recommendations here were concrete: enforce MFA on all VPN accounts, watch for Safe Mode boot configuration changes, and track remote-access tools being added to the environment. **Exfiltration is the attack now.** Ten minutes of blindness was enough to start moving data out. Even a fully successful backup and recovery posture — which you still need, and [we've written about what that actually requires](/blog/backup-vs-disaster-recovery-ransomware/) — doesn't un-steal the client files, financials, and credentials that left the building. Prevention and early detection are the only controls that address the theft half of modern ransomware. ## The Tuesday-morning checklist Translate this incident into five questions for your business: 1. Does every account on every remote-access path (VPN, RDP, remote-access tools) have MFA enforced? Who verified that, and when? 2. Do we know every remote-access tool installed in our environment? Would we notice a new one appearing? 3. Would anyone notice if a workstation or server rebooted into Safe Mode at 2 a.m.? 4. If our endpoint protection went silent on one machine, does an alert fire, or does it just... go silent? 5. If data were exfiltrated tonight, would we be able to tell what left? If any answer is "I don't know," that's not a criticism — it's the to-do list. Most businesses we assess can't answer all five on day one. ## The bottom line This attack was stopped by a crashed executable and a scheduled scan — not by the defenses that were supposed to stop it. The defense that would have actually prevented it costs almost nothing: MFA on a VPN account. The defenses that would have caught it in progress — monitoring for dead agents, Safe Mode reboots, and new remote-access tools — are exactly what separates a security stack from a security program. If you want to know how your environment would have handled this specific playbook, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary. We'll check the remote-access paths, the MFA coverage, the endpoint tooling, and the monitoring behind it, and give you the prioritized list of what to fix first. --- # The Patch Wasn't the Fix: Lessons from the N-able N-central Takeover URL: https://etoptechnology.com/blog/n-able-n-central-rmm-takeover-lessons/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-08-13 Last week brought the clearest recent example of the attack pattern we think business owners underestimate most: [attackers took over N-able N-central servers](https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html) — a remote monitoring and management (RMM) platform that IT providers use to run their clients' computers — and used that access to plant persistent backdoors on the endpoints those servers managed. We wrote earlier this year about [what happens when your IT provider gets hijacked](/blog/msp-rmm-supply-chain-attacks-what-to-ask/) and the questions to ask about RMM security. This incident is that post playing out in real time, with two new lessons attached. Here's the plain-English version. ## What actually happened N-central is management software. An IT provider (or an internal IT department) runs an N-central server, and every computer it manages runs an agent that takes instructions from that server — install this update, run this script, restart that service. By design, the server has administrative control over every machine it manages. That's the product. The short timeline, per [reporting on the incident](https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html): - An authentication bypass (CVE-2026-18556) allowed **unauthenticated administrative takeover** of N-central servers — no password, no phishing, just a request to a vulnerable server. - N-able patched it. Then researchers found **an alternative path to the same flaw that the first patch didn't block** (CVE-2026-18577), and N-able shipped an emergency hotfix on August 2. - [CISA added the flaw to its Known Exploited Vulnerabilities catalog](https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html) after real-world compromises were confirmed. - On compromised servers, attackers didn't stop at the server. [Security researchers at Huntress found](https://www.huntress.com/blog/n-able-vulnerability-exploitation) they pushed **Cloudflare tunnel software to the managed endpoints, installed as a persistent service** — a quiet, legitimate-looking backdoor onto the client machines themselves — at organizations reached through a compromised instance. Read that last point again, because it's the part that matters most. Patching the server closes the door the attacker came through. It does nothing about the backdoors the attacker already installed downstream, on computers belonging to the IT provider's clients. Those have to be found and removed by hand. ## We don't run N-central. This is still worth your attention. Full disclosure: N-central is not part of our stack, so this wasn't our fire drill. But it would be dishonest to frame this as an N-able problem. ScreenConnect, SimpleHelp, Kaseya, and others have all had critical flaws in the last few years — we covered several in [the RMM supply chain post](/blog/msp-rmm-supply-chain-attacks-what-to-ask/). Every RMM platform is a high-value target for exactly the reason this incident demonstrates: compromise one management server, inherit administrative control of every business it manages. The right takeaway isn't "avoid vendors that have vulnerabilities." That list is empty. The right takeaway is that how your IT provider operates their tools — patch speed, monitoring, and honesty when something breaks — matters more than which logo is on the tool. ## The two new lessons from this incident **Lesson one: the first patch isn't always the fix.** Organizations that patched promptly when the first advisory dropped were still vulnerable, because the fix was incomplete. The vulnerability was only actually closed by the emergency hotfix weeks later. A provider whose process is "patch once, mark it done" would have stayed exposed while believing they were safe. Vulnerability response is a loop — patch, then keep watching the advisory — not a checkbox. **Lesson two: persistence outlives the patch.** The attackers' first move after taking over a server was to establish access that would survive the server being fixed — legitimate tunneling software, installed as a service, on downstream client machines. This is standard playbook now. It means "we patched" and "we're clean" are two different claims, and the second one requires actually going and looking at the endpoints. In this incident, remediation explicitly required manually removing the malicious tunnel services from managed machines. ## What to ask whoever runs your IT this week If you outsource IT, send these three questions. They're specific to this incident and the answers are revealing: 1. **"Do we have any exposure to N-able N-central, directly or through any subcontractor or co-managed arrangement?"** If yes: "Are we on the fixed build, and have our endpoints been checked for unauthorized tunnel or remote-access services?" 2. **"When your RMM vendor publishes a critical advisory, what's your target time to patch, and who watches for follow-up advisories?"** This incident is the argument for why the second half of that question matters. 3. **"How would you detect a new persistent service — like tunneling software — appearing on our machines?"** The honest answers involve endpoint detection and response with someone actually watching it. We explain what that looks like in [our EDR explainer](/blog/what-is-edr/). If you have internal IT running your own RMM or remote-access tooling, the same questions apply — just pointed inward. And if any tool in that category is reachable from the open internet without multi-factor authentication in front of it, that's the finding; fix that before anything else. ## The bottom line The tools that make modern IT support possible — remote management, remote access, automated patching — concentrate administrative power by design, and attackers have fully absorbed that this makes them the best target in the building. This week it was N-central. It has been ScreenConnect and SimpleHelp before, and it will be another one next. You can't pick a vendor that will never have a vulnerability. You can pick a provider that patches in hours, watches for the follow-up advisory, monitors the endpoints for what slips through, and tells you plainly when something affects you. If you don't know which kind you have, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary, and part of that assessment is looking at exactly this: who has administrative reach into your environment, through what tools, and how well-guarded that reach actually is. --- # Excel Date Math That Actually Works: EDATE, EOMONTH and Age Calculations URL: https://etoptechnology.com/blog/excel-edate-date-functions/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-08-07 One of the oldest posts on this site was a walkthrough of Excel's EDATE function, and years later it was still one of the most-visited pages we had. Date math is a permanent problem. Contracts renew, warranties expire, certifications lapse, and somebody in every office is maintaining the spreadsheet that tracks it. Here is the current version of that walkthrough: the three functions that handle nearly all business date math, and the mistakes that produce wrong answers quietly. ## EDATE: a date some number of months away `EDATE(start_date, months)` returns the date that many months before or after the start date. - `=EDATE(A2, 12)` — one year after the date in A2. A contract signed 3/15/2026 returns 3/15/2027. - `=EDATE(A2, 3)` — a quarterly renewal. - `=EDATE(A2, -6)` — six months *before* A2. Negative numbers go backward, which is useful for "send the renewal notice 60 days early" columns. Two things to know: **The result looks like a number until you format it.** Excel stores dates as serial numbers. If your formula returns something like 46456, the math worked; the cell just needs a date format (Home → Number Format → Short Date). **Month ends are handled sensibly.** `=EDATE("1/31/2026", 1)` returns February 28, not a nonexistent February 31. EDATE clamps to the last real day of the target month, which is exactly what you want for billing dates. ## EOMONTH: the end of a month, some number of months away `EOMONTH(start_date, months)` works like EDATE but always lands on the last day of the resulting month. - `=EOMONTH(A2, 0)` — the last day of A2's own month. - `=EOMONTH(A2, 1)` — the last day of next month. This is the classic "net 30, due end of following month" invoice formula. - `=EOMONTH(A2, 0) + 1` — the first day of the *next* month, a trick worth memorizing since Excel has no FOMONTH. ## DATEDIF: ages and elapsed time The function Excel does not advertise. `DATEDIF` does not appear in the formula autocomplete, but it has worked in every version for decades and it is the correct way to compute an age or a tenure. `DATEDIF(start_date, end_date, unit)`: - `=DATEDIF(A2, TODAY(), "Y")` — complete years between a birthdate (or hire date, or contract start) and today. This is the age calculator. - `=DATEDIF(A2, TODAY(), "M")` — complete months. - `=DATEDIF(A2, TODAY(), "YM")` — the leftover months after the whole years, so you can display "12 years, 4 months": ``` =DATEDIF(A2,TODAY(),"Y") & " years, " & DATEDIF(A2,TODAY(),"YM") & " months" ``` The start date must be the earlier of the two, or DATEDIF returns #NUM!. ## The errors that actually happen **#VALUE! means your "date" is text.** The most common cause is data pasted from another system. A cell can display 3/15/2026 while containing the text string "3/15/2026", and every date function fed from it fails. Quick test: `=ISNUMBER(A2)`. If it says FALSE, the cell is text. `=DATEVALUE(A2)` converts it. **TODAY() moves.** Any formula built on `TODAY()` recalculates every day, which is the point — but it means a snapshot you email today shows different numbers next week. If you need a frozen as-of date, put the date in a cell and reference the cell. **Manual date math drifts.** `=A2 + 365` looks like "one year later" and is wrong every leap year, and `=A2 + 30` is not "one month." If you are adding days to simulate months or years, replace it with EDATE and the drift disappears. ## Where this shows up in real offices The spreadsheets we see at client sites that depend on this math are the ones that matter: software license renewals, insurance policy dates, equipment warranty expirations, employee certification tracking. When the formula is wrong, the first symptom is a lapsed renewal, and by then it has already cost something. If a spreadsheet is what stands between your business and a missed renewal, it may also be worth asking whether that tracking should live in a system that sends the reminder itself — that conversation is part of what [managed IT services](/managed-it-services/) covers. ## Related reading - [Microsoft 365 management](/microsoft-365-management/) - [One login, twelve apps](/blog/one-login-twelve-apps/) --- # Why MerusCase and Microsoft Word Keep Fighting URL: https://etoptechnology.com/blog/meruscase-word-outlook-integration/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-08-07 If your firm runs MerusCase, you already know the tickets. Someone cannot save a Word document back to a case. Emails that were linked to a matter have quietly unlinked themselves. The Merus button has vanished from Outlook. Somebody cannot merge a letter. Across the firms we support, these are the most common practice management tickets we see, and they are not random. They are all the same underlying issue showing up in different places. ## The seam is the problem, not the software MerusCase is cloud based. It runs in a browser and your data lives on their servers, which is genuinely good. No server in your closet, no version drift across workstations, no upgrade weekend. But the actual work of a law firm happens in Microsoft Word and Microsoft Outlook, and those run on the computer in front of you. So there has to be a bridge. A document opens from the cloud, gets edited in desktop Word, and has to find its way back. An email arrives in desktop Outlook and has to get attached to the right matter in the cloud. That bridge is where almost everything breaks. Not MerusCase. Not Word. The seam between them. Once you see it that way, the tickets stop looking like unrelated glitches: - Cannot save a Word document back to the case - Word macros interfering with saves - Writeback errors after editing - Emails unlinking from matters - The Outlook add-in not loading, or disappearing from the toolbar - Cannot link an email to a case - Merge and email failing from within a matter Seven symptoms. One category. ## Why the seam is fragile **Browsers and desktop apps were not designed to hand files to each other.** The handoff relies on a helper component, a download folder, or an add-in. Each of those has its own permissions, its own updates, and its own ways to fail. **Office updates itself independently.** Microsoft ships changes to Word and Outlook on its own schedule. An add-in that worked last week can stop loading after an update, with no warning and no obvious connection between cause and symptom. **Macros and document protection get in the way.** Firms use Word macros and templates heavily. Security settings that block macros, sensibly, can also block the mechanism that saves a document back to the case. **Add-ins are per-user and per-machine.** Which is why the answer to "it works for her but not for me" is usually not about permissions in MerusCase at all. **The clock matters.** Here is a genuinely obscure one worth knowing. If a workstation's system time drifts far enough out of sync, cloud services start rejecting it, because the security tokens they issue are time sensitive. It presents as a confusing message from the application. The fix is to correct the clock, which is not where anybody looks first. ## What actually reduces these tickets **Standardize the workstation build.** Same Office version, same add-ins, same settings, deployed the same way to every machine. Most "works for one person, not another" problems are build differences that nobody chose. **Manage Office updates rather than letting each machine decide.** You want updates applied on a schedule you control, so that if an update does break the add-in, it breaks on a day when somebody is ready for it and can fix all machines at once. **Sort out macros deliberately.** Decide which templates and macros the firm actually needs, make them trusted properly, and stop relying on individual users clicking through warnings. This single change removes a large share of document-save tickets. **Keep the email sync configured, not improvised.** Linking mail to matters should be set up consistently for everyone, not discovered independently by each new hire. Write down the setup, and use the same one every time. **Keep clocks synchronized.** Trivial to configure centrally, and it removes an entire category of baffling cloud errors. **Know the vendor escalation path.** Some of these genuinely are product issues, and the answer is a support case with the vendor rather than more local troubleshooting. Your IT provider should be opening that case for you and tracking it, not handing you a phone number. ## The reframe worth having Firms often conclude from these tickets that their case management system is bad. Usually it is not. A cloud system that removes servers, upgrades and version drift is a genuinely good trade for a small firm. What it does not remove is the need for the desktop side to be consistent. Cloud software does not make endpoint management optional. It moves where the problems live, from the server room to the workstation, and if nobody is managing the workstations then the same number of tickets arrive wearing different clothes. The firms that have the fewest MerusCase problems are not on a different version. They are the ones whose machines all look the same. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [When your billing system goes down, you stop billing](/blog/when-your-billing-system-goes-down/) - [Remote access for law firms that actually works](/blog/law-firm-remote-access-that-works/) --- # When an Attorney Leaves, What Happens to the Client Files? URL: https://etoptechnology.com/blog/when-an-attorney-leaves-client-files/ Type: Article Category: Compliance Author: William “BJ” Pote Published: 2026-08-07 An attorney gives notice. Somewhere in their mailbox is the message where a client agreed to a settlement position. Somewhere on their laptop is the working draft of a brief. Somewhere in their calendar are the dates that matter on three active matters. Most firms find out how good their document practices are during exactly this week. ## Why this is different from ordinary staff turnover In most businesses, losing an employee's files is expensive. In a law firm it can also be an ethical problem. **Client files belong to the client, not the attorney.** The firm has obligations about maintaining and producing them regardless of who is still employed. **The email trail is part of the record.** An attorney's mailbox is not personal correspondence. It is where the client asked a question, where advice was given, and where a deadline was agreed. If a dispute surfaces later, the firm needs that thread. **Work product needs to stay protected.** Materials prepared in anticipation of litigation carry protections that assume the firm controls them. A draft sitting in a personal cloud account is harder to defend as protected. **Retention obligations survive the person.** How long you must keep a closed file is set by rule and by your own policy. Neither is affected by somebody changing jobs. ## Where things actually go missing Not the case management system. That is usually fine, because it is the system everybody agreed to use. What goes missing is everything that lived beside it: **The mailbox.** Approvals, clarifications, scheduling agreements and client instructions that never got filed into the matter. **Local drafts.** Work in progress that lived on one laptop because the network folder was slow or awkward. **Personal cloud storage.** Somebody synced a matter folder to a personal account years ago to work from home, and never stopped. **Knowledge that was never written down.** Which expert is reliable. Why the case was structured that way. What the client actually cares about. ## What to standardize, in order of payoff **Get matter work out of personal storage.** Files belong in firm-controlled storage. If people work locally because the shared location is painful, fix the friction rather than sending a memo. The memo loses. **Decide mailbox retention deliberately, before you need it.** When an account is deleted, the mailbox can go with it. In Microsoft 365 this is a specific configuration, not a default. Decide how long a departed attorney's mail is retained, who can search it, and under what circumstances. Then configure it, and write it down. **Make offboarding a written checklist.** It should exist before it is needed and cover, at minimum: mailbox retained and accessible to a named person, files relocated to firm storage, matter reassignment recorded, access removed on the correct day across every system including the small ones, and devices returned and wiped. The version of this that gets improvised on somebody's last afternoon always misses something, and what it misses is usually the system nobody remembered was there. **Know where every copy of a matter can exist.** Practice management system, document storage, email, local machines, personal devices, and the printer's stored jobs. You cannot control what you have not listed. **Match your technical retention to your written policy.** Many firms have a retention policy in the employee handbook and a completely different reality in their storage. If the policy says seven years and the backup keeps thirty days, one of those is wrong. ## The test Take a matter closed two years ago, handled by someone no longer at the firm. Without calling them, produce the final documents, the client correspondence and the closing record. If that takes an afternoon, the problem is not that people leave. It is that the file was never really in the firm's hands to begin with. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [The backup you think you have](/blog/the-backup-you-think-you-have/) - [Never click "update" in your practice management software](/blog/never-click-update-practice-management/) --- # Your Practice Management Software Is Older Than Your Newest Associate URL: https://etoptechnology.com/blog/legacy-legal-software-modern-infrastructure/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-08-06 A lot of the software running law firms today was designed before the smartphone existed. Some of it before broadband was common. That is not automatically a problem. Old software that does the job correctly is often better than new software that does it approximately. But it does mean that general IT advice, most of which assumes modern cloud applications, is frequently wrong when applied to your firm. ## What "legacy" actually means here It is not about the year on the box. It is about architecture. Legal practice management, billing and accounting systems commonly share a set of traits: **They expect a file server.** The application on the desktop and the data on a server, talking constantly. That relationship is sensitive to latency, which is why these applications feel instant in the office and unusable over a VPN. **They have their own database engine.** Not a modern managed database. Something specific to the product, sometimes an engine most IT people have never touched. **They are licensed per workstation, with matching versions.** Update the server, and every workstation has to move too. Miss one and that user gets errors nobody else sees. **They assume Windows, permanently.** Which constrains what you can do with tablets, Macs, and anything web-based. **Their upgrade paths are narrow.** You often cannot jump from an old version to the newest one directly. You have to step through intermediate versions in order, and skipping steps is how firms lose data. ## Most firms are already running both, and that is the real situation The tidy version of this discussion pretends a firm is either on old on-premise software or modern cloud software. In practice almost every firm we support is running both at once, and often has been for years. A cloud case management system for matters and documents. A traditional on-premise package for billing and trust accounting, because that is where the history lives and nobody wants to migrate ten years of financial records. Sometimes a third, older system still running because one practice area depends on it. That is a perfectly reasonable position to be in. What matters is recognizing that the two halves fail in completely different ways, and need different attention. **The cloud half fails at the edges.** The service itself is rarely down. What breaks is the connection between it and the desktop: document handoff to Word, email linking in Outlook, add-ins after an Office update. Managing that means managing workstations. **The on-premise half fails in the middle.** Server problems, version mismatches between machines, database limits, update failures. Managing that means managing servers and being extremely careful about updates. A provider who only understands one of those will do a poor job on the other. It is worth asking directly which one they are better at. ## Why "just move it to the cloud" is usually wrong It is the advice every firm gets and it means at least three different things. **Move to a cloud-native product.** Replace your system with a browser-based one. This is genuinely good if a product exists that fits your practice. It is also a full data migration, retraining, and a period where nobody can find anything. Real option, big project, and not something to start in your busy season. **Host the same software on a server in a data center.** Your existing application, running on a machine you do not own. This is what most firms actually mean, and it works well. Performance is protected because the application and database stay together, and remote access becomes the normal way of working rather than a compromise. **Put the files in cloud storage and keep the app local.** This is the one that sounds cheapest and causes the most damage. Practice management databases generally must not live in a consumer file-sync folder. Sync tools are designed for documents, not for a database being written to by six people at once, and the result is corruption that is slow to appear and painful to unwind. If somebody proposes moving your case management data into a file-sync folder, that is the moment to get a second opinion. ## The honest framework **If the software still fits how you practice, keep it and modernize around it.** Put it on a properly specified server, publish it so people can work remotely without a VPN, back it up in a way you have tested, and update it carefully and rarely. This is the cheapest good answer and it is the right one for most small firms. **If the software is genuinely holding you back, replace it deliberately.** Not during a busy period, not without a data migration plan, and not without knowing what happens to your history. **Never let the decision get made accidentally.** The worst outcomes come from firms that never chose. The vendor stopped supporting the version, an update went wrong, or a server died, and now they are migrating under emergency conditions with no plan. ## The three questions worth answering this year **What version are we on, and is it still supported?** A surprising number of firms cannot answer this. If your version is out of support, you have a deadline whether you have acknowledged it or not. **What does our upgrade path look like?** Not whether you can upgrade. What the specific sequence of steps is, and whether any of them cross a database engine, because those are the risky ones. **If the server holding this died tonight, what is the plan?** Answering that will tell you more about your firm's risk than any security assessment. Old software is a manageable condition. Old software nobody has thought about is a countdown. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [Never click "update" in your practice management software](/blog/never-click-update-practice-management/) - [Remote access for law firms that actually works](/blog/law-firm-remote-access-that-works/) --- # Remote Access for Law Firms That Actually Works URL: https://etoptechnology.com/blog/law-firm-remote-access-that-works/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-08-05 Your practice management system was built to run on a desktop connected to a server in your office. Your attorneys are at the courthouse, at home, at a deposition, and occasionally at the office. Something has to bridge those two facts, and how you bridge it determines whether remote work at your firm is pleasant or miserable. ## The three approaches, honestly compared **Traditional VPN.** The laptop joins the office network over an encrypted tunnel, then runs the software as if it were at a desk. It works, and it is the most common setup. The problems are practical. It is slow, because a client-server legal application chatters constantly with its database and every one of those round trips now crosses the internet. It breaks in hotel and courthouse wifi. And it puts the whole device on your network, which is more access than a laptop in a coffee shop needs. **Published applications (RemoteApp or a remote desktop).** The software runs on a server in your office and only the screen is sent to the attorney. The application window appears on their laptop, but the actual work happens next to the data. For legacy legal software this is usually the right answer. Because the application and database stay together, performance does not depend on the quality of the attorney's connection, only on it being stable enough to carry a screen image. Documents never leave the server unless somebody deliberately moves them. **Zero Trust access.** Rather than joining the network, the user is authenticated per application. They get to the specific systems they are entitled to and nothing else. Modern, more granular, and it removes the "one compromised laptop equals full network access" problem that VPNs carry. Most firms end up with a combination: published applications for the legacy practice management and billing systems, Zero Trust for everything else. ## The failure nobody expects Here is a specific one worth knowing about, because it presents as a disaster and is trivial once identified. Published applications are digitally signed so the client machine trusts them. That signature relies on a certificate, and that certificate expires. When it lapses, remote users cannot launch anything from outside the office. The symptom is unhelpful: a message about problems verifying source files, or the application simply refusing to open externally while working perfectly for anyone sitting in the office. It looks like the server broke. It looks like the data is gone. It is neither. It is an expired certificate, and renewing it restores everything immediately. We have watched this consume a couple of hours of a very stressful day because the symptom points in completely the wrong direction. The fix is to track the expiry the way you track a domain renewal, and to know the signature is the first thing to check when remote access fails but local access does not. ## What good looks like for a firm **Attorneys can work from anywhere without thinking about it.** No instructions, no "first connect to the VPN, then wait." They open the application and it works. **The connection quality does not determine the experience.** Courthouse wifi is bad. Your setup should tolerate that. **Access is per-person and revocable in one place.** When someone leaves the firm, remote access ends when their account is disabled, not whenever somebody remembers a separate system exists. **Documents stay where they belong.** Remote work should not mean case files scattered across personal laptops. **Certificates and licenses are tracked before they expire.** Every part of this depends on something with a renewal date. Somebody should own that list. ## The question to ask Ask an attorney at your firm how they work from home. Not whether they can. How. If the answer involves a sequence of steps, a wait, and a caveat about what does not work remotely, that friction is being paid every day by people who bill by the hour. It is usually fixable, and the fix is usually not a bigger internet connection. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [When your billing system goes down, you stop billing](/blog/when-your-billing-system-goes-down/) - [Your whole company is one circuit away from stopping](/blog/one-circuit-away-from-stopping/) --- # The Billable Hour Is an Uptime Metric URL: https://etoptechnology.com/blog/billable-hour-is-an-uptime-metric/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-08-04 Most businesses lose productivity when their systems go down. Work gets delayed, people catch up later, and the cost is real but diffuse. A firm that bills by the hour loses something more specific. It loses the hour. And unlike a manufacturer who can run the line longer tomorrow, you cannot bill Tuesday twice. That makes the arithmetic on IT reliability unusually clean for law firms, and worth actually doing. ## Do the arithmetic once Take your attorneys and paralegals, whatever they bill at, and multiply by the number of them. That is roughly what an hour of firm-wide downtime costs in billable capacity you cannot recover. For a small firm with a handful of fee earners, an hour of everyone being unable to work is typically several hundred dollars of capacity, sometimes more. A morning is a meaningful number. A day is a number that gets a partner's attention. Now compare that to what reliability costs. A second internet connection with automatic failover. Monitoring on the server that runs your case management. Backup that somebody actually tests. Those are monthly costs measured in tens or low hundreds of dollars. Most firms are one avoided outage per year away from those things having paid for themselves. Most firms have more than one outage per year. ## The costs that do not show up in that number The arithmetic above is the floor, not the total. Three things sit underneath it. **The deadline that does not move.** Court filing deadlines are indifferent to your server. Most outages are survivable. An outage the afternoon before a filing is a different category of event, and the cost is not measured in billable hours. **Work that never gets captured.** When the billing system is down, time still gets worked. It gets written on a legal pad, or remembered, and some of it never makes it back into the system. That is revenue that was earned and never invoiced, and it does not appear in any outage report. **The client's experience of it.** A client who cannot reach you, or who is told that the firm cannot access their file today, forms an impression. It is rarely fatal and it is never helpful. ## Where the hours actually go In our experience the recurring losses in a law firm are not dramatic. They are small and constant: - Remote access that takes several attempts each morning - A billing system that is slow at month end when everyone is in it - Practice management software that has to be restarted a few times a week - One person whose machine has a problem everybody else's does not - Password resets and lockouts, particularly after phone changes None of those generate an emergency. All of them are billable minutes, every day, for every person affected. Added across a year they usually exceed the cost of the outage everyone remembers. ## What to ask for You do not need to become technical to hold your IT provider to this. Ask for three things. **A number for last year.** How many hours were fee earners unable to work due to a technology problem? If nobody can answer, that is the first thing to fix, because you cannot manage what nobody measures. **Monitoring that finds problems before people do.** The measure of a good provider is not how fast they answer the phone. It is how often you never had to call. **A single-point-of-failure list.** What could stop the whole firm working? Usually it is a short list: the internet connection, the server, the practice management system. Each one has a known, affordable mitigation. ## The reframe Firms tend to treat IT as an expense to be minimized. That is reasonable for anything that does not affect billing. But the parts that determine whether people can bill are not overhead. They are the equipment that produces the product. A firm would not run a single copy of an irreplaceable file, and it should not run a single internet connection or an unmonitored billing server for the same reason. The question is not what reliability costs. It is what an hour of the whole firm not working costs, and how many of those you are willing to have. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [When your billing system goes down, you stop billing](/blog/when-your-billing-system-goes-down/) - [Your whole company is one circuit away from stopping](/blog/one-circuit-away-from-stopping/) --- # Never Click "Update" in Your Practice Management Software URL: https://etoptechnology.com/blog/never-click-update-practice-management/ Type: Article Category: Business Continuity Author: William “BJ” Pote Published: 2026-08-03 There is a button inside most legal practice management systems that says something like *Help, then Update Software*. It looks like the safe, official way to stay current. It is the single most dangerous button in your firm. ## What can go wrong, concretely We have worked an incident that went like this, and the shape of it is worth understanding even if you never use the same product. A firm ran the in-application update on a weekday morning. The installer that link served did two things at once. It jumped the software forward by roughly sixteen builds, and it migrated the underlying database from one engine to a completely different one. Neither of those is routine. Together, in a single unattended step, they are a serious risk. The conversion did not carry every record forward. The firm was locked out firm-wide that morning. Users were let back in around midday and carried on working, which is the detail that turned a bad morning into a bad week. Because by the afternoon, staff started noticing that the calendar was going backward. Trials that should have been there were not. Mediations were missing. A well-intentioned partial restore made it worse, because restoring only the data folder onto the new engine left the system straddling two database formats at once. The eventual fix was to go back to the verified pre-update database, confirm against known reports that the records were genuinely all there, and then apply a small, controlled step within the original engine. The firm's data was intact up to the moment before the update. What had to be re-entered by hand was roughly half a day of work, reconstructed from a two-hundred-page audit report. ## The four rules that would have prevented all of it **1. Updates to line-of-business software are vendor-driven, never self-service.** The vendor confirmed afterward that the in-app link intermittently serves the wrong installer. That is not a rare defect you can assume away. For practice management, billing, accounting and tax software, the update should be scheduled with the vendor or performed by your IT provider in coordination with them. Never by clicking the button because it appeared. **2. Paired backups immediately before, every time.** Not last night's backup. Two backups taken right before you start: a full system image, and an in-application backup using the software's own export. The image lets you put the machine back. The in-app backup lets you put the data back. You need both, because they fail in different ways. **3. Baseline reports before and after.** This is the step almost nobody does and it is the one that catches silent loss. Before the update, run three or four reports you know the answers to and screenshot them. Count of open matters. Count of upcoming trials. Calendar entries for the month. Then run exactly the same reports immediately after. If the numbers match, you are done. If they do not, you have caught the problem in the first ten minutes rather than after half a day of new work has been layered on top of a broken database. **4. Treat a database engine change as a project, not an update.** If a release note mentions moving between database platforms, that is not a version bump. That is a migration, and it needs a scheduled window, a tested rollback, and the vendor on the call. Any version jump large enough to cross engines should be done in incremental, vendor-supervised steps. ## The part that actually costs money Notice where the real damage came from. Not the failed update itself, which was recoverable. It came from the gap between the update finishing and anyone realizing data was missing. During that gap, people worked. They entered new information into a database that was already wrong. Every hour of that made the recovery harder, because now you cannot simply roll back without losing legitimate new work too. That is the argument for baseline reports in one sentence: they close the gap between the failure and the discovery. ## What to ask your IT provider Ask how they handle a practice management update. A good answer includes: coordinating with the vendor, taking paired backups first, capturing before-and-after reports, and having a rollback plan they have actually tested. If the answer is "we run the updater," you now know what to fix, and you know it before it costs you a week. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [When your billing system goes down, you stop billing](/blog/when-your-billing-system-goes-down/) - [The backup you think you have](/blog/the-backup-you-think-you-have/) --- # When Your Billing System Goes Down, You Stop Billing URL: https://etoptechnology.com/blog/when-your-billing-system-goes-down/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-08-02 One of the most common tickets we get from law firms is some version of the same sentence: *cannot get into my billing, and I need to bill.* That is not an IT ticket. That is revenue, stopped, with a person sitting in front of it who cannot do the thing the firm gets paid for. Billing software at a law firm is not office software. It is the machine that converts work into money. It deserves to be treated like production infrastructure, and in most firms it is not. ## Why billing systems break more than everything else Legal billing platforms like Tabs3 tend to be older, more specialized, and more tightly coupled to a server than a modern cloud app. That produces a specific set of failure modes we see repeatedly. **It is a client-server application pretending to be a desktop app.** The icon is on the workstation, but the data lives on a server, and the connection between them is fragile. Anything that disturbs that path, a server reboot, a network blip, a workstation losing its mapped drive, presents to the user as "the program is broken." **Version drift between workstations.** The server gets updated, one workstation does not, and that machine starts producing errors nobody else sees. This is the single most common cause of "it works for everyone but me." **Data files that fill up.** These systems maintain internal files that have limits. One we have documented is a verification file that stops accepting entries when it hits ten thousand records. Nothing is corrupt, nothing is lost, but the software refuses to work until somebody clears it. If you do not know that failure mode exists, it looks like a catastrophe. **Permissions that drift.** Billing data is sensitive, so access is restricted, and restrictions accumulate. A staff member changes role, a folder permission gets tightened, and suddenly a specific person cannot open a specific module. ## Why it always seems to happen at month end Because that is when everybody uses it at once. The rest of the month, two or three people are in the billing system at a time. At month end, the whole firm is in it, running large reports, generating statements, and pushing more concurrent load through the system in three days than the previous four weeks combined. Problems that were always present but invisible become obvious under load. That is why the outage lands on the day you least want it, and it is not coincidence. ## What actually keeps it running **Treat it as a monitored production system.** The server it lives on, the service it depends on, and the free space it needs should all be monitored, with alerts going to somebody whose job is to act. Most firms discover a billing server problem when a person complains. **Keep versions matched, deliberately.** One version across the server and every workstation, updated together, on a schedule. Not whenever a machine happens to prompt. **Know the vendor relationship before you need it.** These platforms have real support organizations. The question is whether your IT provider has an account, knows how to open a case, and will do it on your behalf, or whether that lands on your office manager at 4pm. **Never update it casually.** This is worth its own article and gets one. The short version: line-of-business software updates should be planned, backed up immediately beforehand, and verified afterward against known reports. An update that goes wrong in a billing or case management system is not an inconvenience. **Have a plan for month end.** Know when your heavy period is and make sure nothing else, no maintenance, no migrations, no big updates, is scheduled into it. ## The question worth asking Ask your IT provider one thing: if the billing system stopped working right now, at 3pm on the last business day of the month, what happens? If the answer involves somebody starting to investigate from scratch, you have a gap. If the answer includes monitoring that would have caught it earlier, a known vendor escalation path, and a recent verified backup, you are in reasonable shape. The firms that suffer least are not the ones with the newest software. They are the ones who decided that billing is production, and treated it accordingly. ## Related reading - [IT services for law firms](/it-services-law-firms-inland-empire/) - [The backup you think you have](/blog/the-backup-you-think-you-have/) - [Your whole company is one circuit away from stopping](/blog/one-circuit-away-from-stopping/) --- # Your Field Techs Change Phones Constantly. Stop Letting That Become an IT Ticket. URL: https://etoptechnology.com/blog/field-techs-change-phones-constantly/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-07-29 Phones in the trades have a hard life. They get dropped off scaffolding, soaked on mitigation jobs, cracked in truck doors, and replaced on a Saturday at a carrier store without telling anybody. That is normal and it is not going to change. What can change is whether each new phone costs your office an hour. ## The thing that actually breaks It is almost never the phone. It is the login. When your team uses multi-factor authentication, and they should, the second factor is usually an app on the phone. New phone, no app, no access. The employee cannot get into email, cannot get into the job system, and cannot fix it themselves because the thing that proves who they are is on a device sitting in a drawer with a shattered screen. So they call the office. Somebody has to verify it really is them, reset the authenticator, and walk them through setting it up again. We do this for clients regularly, including a restoration contractor whose field staff change devices often enough that it shows up as its own category of request. None of that is difficult. It is just an interruption that lands during the day, on someone who was doing something else, and it repeats every time a phone changes. ## Why it is worse in the trades Three things make this more frequent for service businesses than for an office. **Higher device turnover.** Phones in trucks and on job sites break more often than phones on desks. **Personal devices in the mix.** If people use their own phones for work, every upgrade cycle and every carrier switch becomes your problem, and you have no visibility into when it is about to happen. **The person is not near you.** An office worker with a login problem walks down the hall. A technician with a login problem is at a customer's property with somebody waiting, which turns a small IT task into an urgent one. ## What to set up instead **Give people more than one way to prove who they are.** This is the single highest value change. If someone has both an authenticator app and a registered phone number or a second device, a broken phone stops being a lockout. They use the other method, add the new phone themselves, and never call you. **Let them self-serve the reset.** Modern identity systems support verified self-service recovery. Set it up properly, with genuine verification, and the majority of new-phone events stop generating a ticket. **Write the three-step version down.** Most people can re-add an authenticator if somebody tells them where to tap. A short page, in plain language, sent with every new hire and pinned wherever your team looks. Not a manual. Three steps and a screenshot. **Decide about company phones.** Company-owned devices cost money and remove a category of problem. You can wipe them, you can set them up before handing them over, and they do not leave with the employee. Whether that trade is worth it depends on your headcount and turnover. It is worth doing the arithmetic rather than defaulting. **If you manage devices, watch the certificate.** Anyone using mobile device management for iPhones or iPads depends on an Apple push certificate that expires annually. When it lapses, device management stops working, quietly. We track these for clients because the renewal notice is easy to miss in a busy inbox and the failure is not obvious until somebody needs to enroll or wipe a device. ## The five-minute check Ask one person on your crew what they would do if their phone went in a bucket of water right now. If the answer is "call the office," you have found the ticket before it happens. If the answer is "use my backup method and set the new one up," you are already done here. ## Related reading - [Where your job photos actually live](/blog/where-job-photos-actually-live/) - [Your whole company is one circuit away from stopping](/blog/one-circuit-away-from-stopping/) - [Microsoft 365 management](/microsoft-365-management/) --- # The Plotter Problem: Large-Format Printing That Just Works URL: https://etoptechnology.com/blog/large-format-plotter-printing-that-works/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-07-29 Nobody writes about plotters. Every general contractor and engineering firm has one, everybody's breaks in the same four ways, and the fix is almost never interesting enough for anyone to document. So here it is, written down. ## Why the plotter is always the thing that fails A large-format printer is the most demanding device in a construction or engineering office and it gets treated like the least. It sits in a corner, it is asked to produce a D-size sheet immediately before a meeting, and it has a driver stack considerably more fragile than the desktop printer down the hall. Four failure modes cover most of it. **The driver got wiped by a Windows update.** Large-format drivers sit deeper in the system than a normal print driver. A feature update to Windows can leave them half-working: the queue accepts the job, nothing comes out, no error that means anything. Reinstalling a plotter driver as a deliberate task is normal rather than unusual. **Only one person can install it.** The driver requires administrator rights. If the office manager is a standard user, and she should be, then a plotter driver update is a support call rather than a five-minute task. That is fine as long as somebody has decided who does it. It becomes a problem when the answer is whoever is free. **It is connected the wrong way.** A plotter plugged into one workstation by USB is a plotter that only works when that workstation is on, logged in and not asleep. Then that person takes a laptop to a site and the whole office cannot print plans. Network connection with a fixed address, always. **The sheet is wrong and everyone blames the machine.** Wrong scale, wrong paper size, plans that come out at 90 percent because someone printed "fit to page." This one is almost always the page setup and almost never the plotter, and it wastes an enormous amount of paper before anyone says it out loud. ## The setup that stops most of it **Put it on the network with a static address.** Not USB, not shared from somebody's PC. The plotter should be a device on the network with an address that never changes, so every workstation prints to the same place and no single machine can take it down. **Install the driver on every machine that needs it, once, deliberately.** Do this as a planned task rather than the first time somebody needs a drawing at 4:45. If you have IT support, they can push it to every workstation at the same time so all machines are on the same version. **Decide who is allowed to update it, and write it down.** Standard users should not have administrator rights, and the answer to "then who installs the driver?" should be a name or a phone number, not a shrug. **Pin the driver version.** If a driver works, note the version. When Windows breaks it, you want to reinstall the version you know is good rather than discovering whether the newest one has a new problem. **Save the page setups.** Most plan-printing errors are page setup errors. Save presets for your common sheet sizes so nobody is choosing scaling by hand under time pressure. **Keep media and ink on a reorder point.** A plotter that is out of a roll at the wrong moment is functionally a broken plotter. Two rolls of each common size on the shelf, reorder when you open the last one. ## Ten minutes that saves an afternoon Print a test sheet at full size once a month, before you need one. Check the scale bar with a ruler. If it is right, you have confirmed the whole path works. If it is wrong, you found it on a Tuesday morning instead of an hour before a submittal. That is the entire maintenance routine. It is not sophisticated. It is just the difference between finding out on your schedule and finding out on the client's. ## Related reading - [IT services for engineering firms](/it-services-engineering-inland-empire/) - [IT services for construction](/it-services-construction-inland-empire/) - [When the estimator leaves, who owns the bid files?](/blog/when-the-estimator-leaves/) --- # Your Whole Company Is One Circuit Away From Stopping URL: https://etoptechnology.com/blog/one-circuit-away-from-stopping/ Type: Article Category: Business Continuity Author: William “BJ” Pote Published: 2026-07-29 Here is a pattern we see across our client base, in trades and offices alike: one internet circuit fails and the entire business stops. Not degrades. Stops. Phones, because they run over the internet now. Email. The field service software. The scheduling system. Card payments. The ability to look up a customer's address. All of it, at once, because all of it depends on the same wire coming into the building. We have logged this as Priority 1 Critical more than once. It is worth understanding why it happens and what the three tiers of fix actually look like, because they are very different in cost and very different in outcome. ## Tier one: one circuit, and everybody waits This is where most small companies are, usually without having decided to be. A single business internet connection, everything behind it. When it drops, the answer is to call the provider and wait. The provider will give you a window, and the window is their window. We support a commercial door company whose internet and phone outages have come through as Priority 1 Critical, more than once. For a company where customers call with a broken door and expect somebody to answer, that is not an IT problem. It is the business being closed with the lights on. A pest control company we support has had the same failure. Different trade, same shape: a service business whose demand arrives by phone, unable to receive it. And this is not a trades problem specifically. We have logged the same outage at a law firm, a nonprofit, a dental practice and a manufacturer. Anyone with one circuit is one backhoe away from a very long morning. ## Tier two: two circuits, and nobody notices The fix is not sophisticated and it is not expensive. A second connection, usually cellular, in a router that fails over automatically. One of our clients has a ticket in our system whose title is, essentially, "Spectrum outage, failover to AT&T." It came in as Priority 2 rather than Priority 1. That difference is the whole point of this article. Same upstream outage, same provider having a bad day, and the business kept taking calls. What that setup requires: - A business-class primary circuit - A cellular backup with its own SIM, in the same router - Automatic failover, configured and then actually tested - Battery backup on the router and phone equipment - Monitoring, so somebody knows before a customer tells you For most small businesses the monthly cost of the second connection is less than one lost afternoon. It is the highest-value technology purchase available to a company that answers its phone for a living, and it is boring, which is why it does not get made. ## Tier three: stop depending on the building at all The most interesting version of this is not about the office. We support a civil engineering firm whose field inspectors work from sites all day, not desks. After their own run of ISP trouble, their field devices stopped depending on any particular building's internet. The inspectors work on Microsoft Surface tablets with cellular SIMs built in, reaching the company network over Cloudflare Zero Trust rather than a traditional VPN. The consequence is worth sitting with. An inspector's ability to open a drawing, mark it up, and log time against a project does not depend on the office circuit, a jobsite connection, or somebody's hotspot. The device carries its own connectivity. If the office goes dark, the field keeps working. That is a different design philosophy from "make the office connection more reliable." It says: assume connectivity will fail somewhere, and make sure the failure is local rather than total. It is not the right answer for everyone. Cellular data on every device costs more than office wifi, and it only makes sense where people genuinely work away from a desk. But for inspectors, estimators, service technicians and anybody else whose work happens somewhere else, it removes an entire category of outage. ## Where to start Work out which tier you are in. It takes one question: if the internet went out right now, what would still work? If the answer is "nothing," you are tier one, and a second circuit with automatic failover is the next thing you should buy. If you already have failover, test it deliberately during business hours, because untested failover is a belief rather than a control. And if you have people who work away from the office all day, ask whether their devices should depend on a building at all. The companies that handle outages well are not the ones with better providers. Everybody has the same providers. They are the ones who decided in advance what happens when a circuit fails. ## Related reading - [Business continuity and disaster recovery](/business-continuity-disaster-recovery/) - [The backup you think you have](/blog/the-backup-you-think-you-have/) - [Managed IT services](/managed-it-services/) --- # One Login, Twelve Apps: Cutting the Point-Solution Sprawl URL: https://etoptechnology.com/blog/one-login-twelve-apps/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-07-29 Count the software your company pays for. Not the big ones. All of them. Estimating. Project or job management. Scheduling. Time tracking. Safety. Accounting. Payroll. Fleet or GPS. Document storage. The equipment app. The one the insurance carrier requires. The one somebody signed up for in 2023 that three people still use. Most owners get to a number that surprises them. Each one was a sensible decision by itself. Together they are the reason your crew groans when you announce another rollout. ## Sprawl costs more than the subscriptions The monthly total is the smallest part. **Every app is a login, and every login is a support call.** Password resets are the most common IT request in almost every business. Twelve systems with twelve separate accounts guarantees a steady stream of them. **Your data ends up in pieces.** When labor lives in one system, job costs in another and field activity in a third, nobody can answer simple questions without exporting things into a spreadsheet. Owners end up making decisions on numbers that are a week old because assembling current ones takes a day. **Adoption gets harder every time.** This is the compounding one. Firms are not just resisting new tools, they are exhausted by them. Which means the next system you buy, even if it is genuinely better, inherits the resistance built by the previous four. **Nobody knows who still has access.** Someone who left eighteen months ago probably still has a login to at least one of these. Small systems are exactly the ones that get missed at offboarding, because they were never on anyone's list. ## The cleanup, in a sensible order **Inventory it honestly.** Pull the last twelve months of card and bank statements and list every software charge. Not what you think you use. What you pay for. Expect surprises: duplicates from different departments, and at least one subscription for something you stopped doing. **Mark each one essential, overlapping, or dead.** Dead ones cancel today. Overlapping ones are the real work. Two systems that both do scheduling means somebody chose differently at some point, and one of them should win. **Check what you already own before buying anything.** This is where most companies find money. If you have Microsoft 365, you already have file storage, video calls, chat, basic task management, forms and simple automation. Companies routinely pay for separate products that duplicate things already sitting in a license they bought. **Consolidate the logins you keep.** Most business software can sign in with your Microsoft account instead of its own password. That means one account to create, one to disable when someone leaves, and one password for your team to remember. It is the single highest-value change in this article and it is mostly configuration rather than purchase. **Then reduce the count.** Once you know what overlaps, retiring one system per quarter is realistic. Faster than that and you are running three migrations at once, which is how people end up hating all of it. ## What good looks like Not one system. That is a fantasy sold by whoever wants to be the one system. Good looks like a small number of tools each doing a job properly, signed into with one company account, with the important ones connected to each other so the same job is not typed in twice. For most companies that lands somewhere around five or six systems rather than twelve. Fewer logins, fewer resets, fewer arguments, and a much better chance the next thing you introduce actually gets used. ## Where to start Monday Do the statement review. It takes an hour and you cannot make any other decision here without it. Almost everyone who does it finds at least one subscription they forgot they had, and usually two systems doing the same job. That is the cleanup paying for itself before you have changed anything. ## Related reading - [Why your crew won't use the software you bought](/blog/why-your-crew-wont-use-the-software/) - [Microsoft 365 management](/microsoft-365-management/) - [Co-managed IT services](/co-managed-it-services/) --- # The Backup You Think You Have URL: https://etoptechnology.com/blog/the-backup-you-think-you-have/ Type: Article Category: Business Continuity Author: William “BJ” Pote Published: 2026-07-29 Backup is the only part of your technology that is designed to be invisible until the worst day of your year. Which means it is also the only part that can be quietly broken for months without anyone noticing. Most business owners we meet believe they have backup. Most of them are right. Fewer can answer the three questions that determine whether it will actually help. ## The failure is silent by design Backup does not fail loudly. It fails as a job that did not complete, logged somewhere nobody reads, in a system that keeps reporting success for everything else. We monitor backups for a general contractor we support, and when their cloud backup started failing it came to us as a Priority 1 alert. That is the point of monitoring: a failed backup should be an emergency on the day it fails, not a discovery you make during a restore. The uncomfortable version of this is the company where nobody is watching. The backup stopped in March. Nobody finds out until the ransomware, or the drive failure, or the bookkeeper deleting the wrong folder in September. Six months of nothing, and the first person to learn about it is the owner, on the worst possible day. ## Three questions worth asking this week You do not need to understand the technology to audit this. Ask your IT provider, or whoever handles it, these three. The quality of the answers tells you most of what you need to know. ### 1. What is actually being backed up? Not "the server." Specifically what. In a typical office the list should include the accounting file, your project or job files, email, and anything living on individual workstations that is not stored centrally. That last category is where companies get hurt. Estimates on the estimator's laptop. Job photos on one desktop. Files somebody keeps locally because the network folder is slow. If those are not in the backup, they are not backed up, no matter what the invoice says. Microsoft 365 deserves specific mention. A lot of owners assume email and files in Microsoft 365 are backed up by Microsoft. Microsoft keeps the service running. Retaining your data against deletion, a compromised account, or a departing employee is a separate product that you either bought or did not. ### 2. When did someone last restore something from it? This is the question that separates real backup from theoretical backup. A backup that has never been restored is an assumption. The test does not have to be dramatic. Pick a file from a month ago and ask for it back. Time how long it takes. That number is your actual recovery time, and it is frequently very different from the one in the proposal. ### 3. How long could we operate without it? If the server died this morning, what would your team do today? Could you still see tomorrow's schedule, get to your files, run payroll on Friday? The answer determines what you should be paying for. A company that can work from phones and cloud files for two days needs something different from one where everything stops when the office server stops. Both are legitimate. Guessing is not. ## What good looks like **More than one copy, and one of them somewhere else.** A backup that lives in the same building as the original is a fire and theft plan with a gap in it. **Someone watching it daily, not monthly.** Failures need to surface as alerts to a person whose job is to act on them. If the only monitoring is a report nobody opens, you have logging, not monitoring. **Restores tested on a schedule.** Quarterly is reasonable. It should be somebody's task with a date on it. **Microsoft 365 covered deliberately.** Either you have a backup product for it or you have accepted the risk. Both are decisions. Only one of them is usually made on purpose. **Written down.** What is covered, how long it is kept, how fast it comes back. One page. So the answer does not live only in the head of whoever set it up. ## The uncomfortable exercise Ask for a restore this week. Not a report, an actual file, actually recovered, actually opened. If it comes back in an hour, you can stop thinking about this. If the request produces hesitation, you have learned something important while it is still an inconvenience rather than a catastrophe. ## Related reading - [Business continuity and disaster recovery](/business-continuity-disaster-recovery/) - [Where your job photos actually live](/blog/where-job-photos-actually-live/) - [When the estimator leaves, who owns the bid files?](/blog/when-the-estimator-leaves/) --- # When the Estimator Leaves, Who Owns the Bid Files? URL: https://etoptechnology.com/blog/when-the-estimator-leaves/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-07-29 Your estimator gives notice on a Friday. There are four live bids. Everything he has built over six years, the historical pricing, the subcontractor comparisons, the takeoffs you have been reusing since 2021, is on his laptop and in his mailbox. This is not a theoretical risk. It is a normal Tuesday in construction, and most contractors discover their document practices during it. ## What actually goes missing Not the obvious things. Nobody loses the accounting system. What goes is the stuff that was never anywhere official: **Bid history.** What you bid, what you won, what the margin actually was. This is how you price the next one. If it lives in one person's spreadsheets and email, it leaves. **Subcontractor knowledge.** Who bid what, who was reliable, who came in low and then found problems. Frequently this is not written anywhere at all. **Takeoff templates and assemblies.** Years of accumulated shortcuts that make estimating fast. Rebuilding them is expensive and nobody budgets for it. **As-builts and closeout sets.** The final record of what was actually built. You need these years later, usually when something goes wrong, and they are often in a project folder somebody organised their own way. **The email trail.** Change order approvals, scope clarifications, the message where the owner said yes. If a dispute arises after the person is gone and the thread was in their mailbox, you are reconstructing your position from memory. ## Why it happens even in well-run companies It is not carelessness. It is three ordinary things. **Personal storage is faster.** The network folder is slow, the naming convention is awkward, so people work locally and mean to move it later. Later does not come. **Email is a filing system.** Approvals live in threads because that is where they happened. Nobody consciously decided the change order record should live in one person's inbox. **Nobody owns the standard.** Everyone has a reasonable way of organising. Six reasonable systems is no system. ## What to fix, in order of payoff **Get the work out of personal drives.** Project files belong in shared company storage, not on a laptop or a personal cloud folder. If people are working locally because the shared location is painful, fix the pain rather than issuing an instruction. The instruction will lose. **Decide where bid history lives, and make it a place.** One location, one structure, every bid, win or lose, with the number and the outcome. This single change is usually the biggest return in this article, because bid history compounds and its loss is permanent. **Make offboarding a checklist rather than a scramble.** It should already exist before you need it, and cover: mailbox retained and accessible to a named person, files moved to company storage, licenses reclaimed, and access removed on the correct day. We run this for clients as a defined process, because the version that gets improvised on someone's last afternoon always misses something. **Retain the mailbox deliberately.** When someone leaves, their email is a company record. Decide how long you keep it and who can search it. In Microsoft 365 this is a specific configuration, not a default, and a deleted account can take its mailbox with it. **Write down the naming convention. One page.** Boring, and it is the difference between finding a 2022 closeout set in two minutes or forty. ## The test Pick a job you closed two years ago. Without calling anyone who worked on it, find the final bid, the signed change orders and the as-builts. If that takes more than fifteen minutes, the risk is not that your estimator might leave. It is that the knowledge already only exists in people, and people leave on their own schedule. ## Related reading - [The backup you think you have](/blog/the-backup-you-think-you-have/) - [Microsoft 365 management](/microsoft-365-management/) - [IT services for construction](/it-services-construction-inland-empire/) --- # Where Your Job Photos Actually Live (And Why That's a Problem) URL: https://etoptechnology.com/blog/where-job-photos-actually-live/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-07-29 If you run a restoration company, photos are not paperwork. They are the job. They are what the adjuster pays against, what protects you when a scope gets questioned six months later, and what proves the work you did behind a wall nobody can see anymore. So it is worth asking a question most owners cannot answer: where are they right now? Not where they are supposed to be. Where they actually are. ## The honest answer for most companies They are in three places at once, and none of them is the job file. Some are on a technician's personal phone, in the camera roll, mixed in with photos of his kids. Some are on one desktop in the office, in a folder named after the street. Some made it into the job management system, usually the ones somebody remembered to upload before the end of the week. We manage IT for an Inland Empire restoration contractor, and this is not a criticism of how they run jobs. It is a pattern we see because we watch the machines. Over several months their workstations kept generating the same alert: local storage filling up. Not one machine. Four of them, repeatedly. That is what job photos look like from the IT side. Nobody decided to store years of loss documentation on a desktop under someone's monitor. It accumulated, because that is where the photos landed when they came off the phones. The other tell showed up in a separate ticket. Someone needed a tool installed whose only purpose is pulling data off an iPhone. That is what it looks like when a technician's phone has become part of your documentation system without anyone deciding that it should be. ## Why this is a real business risk and not an IT annoyance The industry has a name for the version of this that hurts. Scope notes and photos stranded on paper or in a technician's phone get lost. Not usually in a dramatic way. The technician leaves. The phone goes in a drawer. The phone gets wiped and handed to the next hire. Nobody notices until an adjuster asks for the pre-mitigation photos on a job from last spring. Three specific ways it costs money: **The claim you cannot fully support.** If the photos that justify a line item are on a phone that left with an employee, you are negotiating from memory. **The full disk that stops the day.** A workstation at 100 percent does not just refuse to save photos. It gets slow, applications stop behaving, and someone loses an afternoon to a problem that started as housekeeping. **The backup that was never covering it.** Most backup is scoped to the server and the accounting system. Photos sitting in a folder on one desktop are frequently outside it. People assume they are covered because "we have backup." Worth checking whether that is true for the machine the photos are actually on. ## What good looks like You do not need to buy a platform to fix most of this. You need the photos to stop making a stop at someone's phone. **Capture into the job file, not the camera roll.** Whatever job management system you already run, if it has a mobile capture function, use that instead of the camera app. The photo should arrive attached to the job, not need to be matched to it later. **If capture has to happen in the camera app, automate the offload.** Company phones can sync to company storage automatically. It is a setup step, not a daily task. The goal is that a phone can be lost, broken or wiped on any given day and nothing is gone. **Give it somewhere to land that is not a desktop.** Photos belong in shared cloud storage that is backed up and that survives a machine being replaced. A folder on one computer is a single point of failure with a person's name on it. **Set a retention rule that matches your exposure.** Ask how long after a job closes you could plausibly be asked to prove what you did. Keep them at least that long, deliberately, rather than keeping everything forever until the disk complains. **Take the personal phone out of the loop.** This is the one that matters most and gets resisted most. It is not about trust. It is that a personal device is outside every process you have, and it walks out the door on the employee's last day. ## The question worth asking this week Pick a job you closed four months ago. Ask someone to produce the complete photo set for it in ten minutes, without calling the technician who ran it. If that is easy, this article is not about you. If it turns into a search across a phone, a desktop and the job system, you have found the problem while it is still cheap to fix. ## Related reading - [The backup you think you have](/blog/the-backup-you-think-you-have/) - [Xactimate, QuickBooks, and the double-entry tax](/blog/xactimate-quickbooks-double-entry-tax/) - [Your field techs change phones constantly](/blog/field-techs-change-phones-constantly/) --- # Why Your Crew Won't Use the Software You Bought URL: https://etoptechnology.com/blog/why-your-crew-wont-use-the-software/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-07-29 You paid for it. You sat through the demo. Somebody ran a training session. And three months later the foremen are still texting photos and the schedule still lives in a spreadsheet. This is not a discipline problem, and it is more common than the vendor told you. Roughly half of contractors say the single hardest part of construction technology is getting employees to actually use it. Not the price. Not the integration. Adoption. That number should change how you buy. ## Why it happens **The tool was chosen in an office by people who do not use it in the field.** Most construction software demos beautifully on a laptop at a conference table. The same tool on a phone, one-handed, in the sun, with gloves on, at a site with two bars of signal, is a different product. If the person who will use it every day was not in the evaluation, you are going to find this out after you have signed. **Training happened once.** A single session before go-live is not a rollout, it is an announcement. People learn a new process by using it during real work with someone available when it goes sideways, not by watching a walkthrough three weeks before they need it. **Under pressure, everyone reverts.** When a job is behind, nobody experiments. They reach for the thing they know works, which is the spreadsheet, the text message, the phone call. That instinct is correct and you should design around it rather than fight it. **You already had eleven other apps.** This is the one that gets missed. The problem is often not the new tool, it is the twelfth login. Estimating has one. Scheduling has one. Safety has one. Accounting has one. Each was a reasonable decision on its own, and together they are the reason nobody wants another. ## What to do differently **Put a foreman in the evaluation, with a veto.** Not to be consulted. To decide. If the person who has to open it every morning does not want it, you have learned something worth more than the demo. **Test it where it will be used.** Take the trial to an actual site, on the actual phones your crew carries, on the actual connection they have. A tool that needs a good signal is not a field tool, whatever the sales engineer says. **Replace something.** Every new tool should retire an old one. If your app count only goes up, adoption will keep going down, and each new rollout will be harder than the last one. **Pick one workflow and make it complete.** Half a process in a new system and half in the old way is worse than either. People will use the system that has all of the answer. Daily reports, or photos, or time. One thing, end to end. **Budget for the second month.** Most of the real adoption cost is not the license, it is somebody being available in weeks two through six when people hit the first thing that does not work the way it did in training. ## The honest test Before you sign anything, ask the salesperson one question: what percentage of your customers are still actively using this a year after purchase, and how do you measure that? A good vendor will have an answer and it will be specific. A vendor who deflects to feature lists is telling you something about what happens after the invoice clears. Then ask yourself a harder one. The last piece of software you bought for the field: is it in daily use right now? If not, the next purchase will not fix that. Fixing the last one might. ## Related reading - [One login, twelve apps](/blog/one-login-twelve-apps/) - [IT services for construction](/it-services-construction-inland-empire/) - [Your whole company is one circuit away from stopping](/blog/one-circuit-away-from-stopping/) --- # Xactimate, QuickBooks, and the Double-Entry Tax URL: https://etoptechnology.com/blog/xactimate-quickbooks-double-entry-tax/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-07-29 Every restoration company pays a tax nobody put on the invoice. It is the time your office staff spends typing the same job into a second system, and then a third. The estimate goes into Xactimate because that is what the carrier expects. The job details go into whatever system your crews work out of. The invoice goes into QuickBooks. Same job, same addresses, same line items, entered by hand more than once. It is not dramatic. It is fifteen minutes here and half an hour there, on every job, forever. ## Where the retyping actually happens Four handoffs cause most of it: **Estimate to job file.** The scope exists in the estimating system. The crew needs it in the system they actually work from. If those do not talk, somebody rebuilds it. **Field notes back to the estimate.** The crew finds more damage. That has to get back into the estimate as a supplement, usually from photos and a text message, usually retyped by someone who was not there. **Job file to invoice.** The finished scope becomes an invoice in the accounting system. Same line items, third time entered. **Invoice to the carrier's portal.** Depending on the program, the same information gets submitted again in the format the carrier wants. Each of those is a place where a number can change without anyone meaning to change it. That is the part that actually costs money. Not the typing, the drift. When the estimate, the job file and the invoice disagree, somebody has to reconcile them, and that conversation happens with an adjuster. ## What can actually be connected Be realistic about this. Restoration software integration is better than it was and it is still not seamless. **Xactimate and XactAnalysis** are the same ecosystem and pass information between themselves reasonably well. If you are in a carrier program, this part is largely decided for you. **Job management systems** vary enormously in how well they import an estimate. Some pull a scope directly. Some import a file. Some offer an integration that in practice means a spreadsheet export. Ask for a live demonstration using one of your own jobs before you believe a data sheet. **QuickBooks** is where most of the practical wins are, because it is the most commonly integrated destination. Getting the invoice built from the job rather than retyped is usually the single biggest reduction in double entry available to a restoration company. **Carrier portals** are the least flexible link. Assume manual submission unless you are told otherwise in writing. ## How to evaluate this without getting sold **Count the entries first.** Before you look at any product, take one recent job and write down every place the same information got typed. That list is your requirement document, and it is more useful than any feature comparison. **Ask what the integration actually moves.** The answer should be specific fields, not "it syncs with QuickBooks." Syncs which direction? Which fields? What happens when somebody edits on both sides? **Ask what breaks it.** Every integration has a failure mode. A vendor who cannot describe theirs has not supported it at scale. **Insist on your own data in the trial.** A demo with clean sample data proves nothing. Your jobs have supplements, changed scopes and odd line items. That is what you are buying the integration to handle. ## The part that is not a software problem Some double entry survives every integration, because the systems are genuinely separate and the carrier requires it. That is fine. What is not fine is not knowing which category you are in. Sort your retyping into two piles: the entries a connection could remove, and the ones that exist because a carrier demands a specific format. Fix the first pile with integration. Fix the second by making it one person's defined job with a template, not something three people improvise at month end. Most restoration companies we talk to have never separated the two, so the whole thing feels like an unavoidable cost of doing business. Usually about half of it is not. ## Related reading - [Where your job photos actually live](/blog/where-job-photos-actually-live/) - [One login, twelve apps](/blog/one-login-twelve-apps/) - [Managed IT services](/managed-it-services/) --- # AI Just Got Serious About Small Business. Here's What Actually Changed. URL: https://etoptechnology.com/blog/ai-got-serious-about-small-business-2026/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-06-10 In one stretch of May, a few things happened that, taken together, mean small business AI just stopped being a science experiment. Anthropic [launched a dedicated Claude for Small Business offering](https://www.anthropic.com/news/claude-for-small-business). KPMG announced it's [rolling Claude out to its workforce of more than 276,000 people](https://www.anthropic.com/news/anthropic-kpmg). PwC put tens of thousands of its professionals on Claude. Anthropic also [acquired Stainless](https://www.anthropic.com/news/anthropic-acquires-stainless), the company behind the SDK tooling — software development kits, the libraries developers use to wire AI into their own software — that powered much of the industry, reportedly for over $300 million. Microsoft kept shipping Copilot updates. Google announced [Gemini 3.5 Flash and a new multimodal model called Gemini Omni](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-5/) at I/O. Any one of those would be noise. All of them inside two weeks is a pattern. The big AI vendors have stopped pretending small business is a side project. They're building products, pricing tiers, and integration partnerships aimed at companies that look like yours. The question for a business owner is no longer "should we be paying attention to AI." It's "given how fast this is moving, what should we actually do with our money and our time this quarter." ## What "Claude for Small Business" actually is This is the headline most likely to matter for you. Anthropic launched a packaged offering explicitly named for small businesses. Until now, the choices for a 30-person company were: - Use the consumer version of Claude.ai or ChatGPT and accept the data governance risks (we wrote about [the data leakage problem here](/blog/ai-tools-at-work-data-leakage/)) - Pay for Microsoft 365 Copilot, which is excellent if you're already deep in M365 and willing to do the permissions cleanup it requires - Pay for ChatGPT Team or Enterprise, which has historically been priced for larger teams - Use the Claude API directly, which works if you have a developer on staff but isn't a fit for most non-technical buyers Claude for Small Business is the offering that fills the middle of that map: native connectors for the tools small businesses actually run — QuickBooks, PayPal, HubSpot, DocuSign, Canva, Google Workspace, and Microsoft 365 — plus a set of pre-built workflows for things like invoice chasing, month-end close, and cash-flow forecasting. Notably, there's no extra subscription on top of your Claude licenses, and no custom development required. If you've been waiting for a sanctioned, non-developer way to roll Claude out to your team, this is it. ## What the KPMG and PwC deals mean for the rest of us You're not KPMG. You don't have 276,000 employees. So why does it matter that they're deploying Claude across their workforce? Two reasons. **First, it removes the "is this real" question from the conversation.** Until recently, AI in the enterprise was an experimental line item. Now the firms that audit your clients, advise your competitors, and tell their clients what to do with their technology are betting their own operations on this. When PwC tells a mid-market client to look at AI for finance workflows, they're now speaking from experience, not from a slide deck. **Second, it shifts the talent and tooling market.** The big consulting firms will produce playbooks, methodologies, and reference architectures that trickle down. They'll also hire the people who would otherwise have been available to small businesses for the same work. The window for an SMB to get ahead by adopting deliberately, before the playbooks become commoditized, is right now. ## What the Stainless acquisition signals This one is more technical but it matters for any business that's planning to use AI for more than chat. The new wave of AI products are called "agents," and the easy way to understand the difference between an agent and a chatbot is this. A chatbot answers your question. An agent does the work. You don't ask the agent how to file an expense report. You hand it the receipt and walk away while it actually files the report, attaches the documentation, and routes it for approval. Building real agents is hard because they need access to your actual business systems. They have to read your email, write to your file storage, make API calls, and sometimes browse the web on your behalf. Every one of those touchpoints is a place where security, performance, and reliability can break. That's why Anthropic paying a reported $300+ million for Stainless matters. Stainless builds the plumbing — the SDKs and connectors that let agents talk to APIs — that hundreds of companies, including Anthropic's own rivals, relied on. When a vendor buys the toolchain layer of the agent ecosystem outright, it's telling you where it believes the next several years of value live: not in chat, but in agents wired into real business systems through controlled, audited channels. If you've been waiting for "agents" to graduate from impressive demos to deployable workloads, the infrastructure consolidation happening right now is the strongest signal yet that the industry agrees with you. ## What you should actually do this quarter Translating the news into a real plan looks like this. ### Pick a sanctioned stack and commit The single biggest unforced error we see in small business AI right now is using too many tools without sanctioning any of them. Employees use ChatGPT for some things, Claude for other things, a free trial of Gemini for a third, and a random AI meeting note-taker that nobody approved. The data leaks compound and the productivity gains never materialize because everyone is teaching themselves a different tool. Pick one. For most M365-centric businesses, that means Microsoft 365 Copilot for in-context productivity and one general-purpose AI for everything else. The general-purpose layer is where Claude for Small Business is now a strong candidate. Pay for it, deploy it, train on it, and ban the rest. ### Clean up permissions before you turn on Copilot This deserves its own emphasis because every Copilot rollout that goes badly goes badly for the same reason. Copilot can only respect the permissions that already exist in your Microsoft 365 tenant. If your SharePoint sites are overshared from years of "share with everyone, we'll clean it up later," Copilot will surface that data to anyone who asks the right question. The clean-up happens before the rollout, not after. We covered the full pattern in our [AI tools at work post](/blog/ai-tools-at-work-data-leakage/). ### Identify two or three concrete workflows, not "everywhere" The companies that get real value from AI in 2026 are not the ones that deploy it organization-wide on day one. They're the ones that pick a handful of high-volume, well-defined workflows and automate them deliberately. Customer support email drafting. Sales call summaries. RFP response generation. Marketing copy production. Financial variance commentary. Pick the two or three that map to your highest-cost or highest-volume work, get them right, and then expand from there. ### Write down what data is allowed where Two pages, not twenty. Which AI tools are approved. What data each one can touch. What's off limits in any AI tool. Who to ask for exceptions. We have a five-bucket framework that works for most SMBs in our [AI tools at work post](/blog/ai-tools-at-work-data-leakage/). Use it, modify it, write your own. Just make sure something exists. ### Plan for the agent wave before it arrives The next eighteen months are going to bring a flood of "agentic" tools that promise to take work off your plate by acting autonomously. Some will be transformative. Many will be vaporware. A few will be security disasters waiting to happen. The right posture is curious and patient. Pilot agents in low-stakes workflows. Don't give them admin credentials. Make sure every agent action has a logged audit trail. Don't deploy any agent that doesn't tell you exactly what it did when it's done. ## What the Microsoft side looks like right now For businesses already deeply invested in Microsoft 365, Copilot remains the path of least resistance for in-context AI. It's getting better quickly. The latest updates extend it deeper into the Office apps, improve grounding in your tenant content, and expand the workflow templates available for common tasks. Copilot is excellent at "help me do what I'm already doing, faster." It's less suited to "be my general-purpose research and writing partner outside Office." That's where having a second sanctioned tool, like Claude for Small Business, makes the stack complete. The two are complementary, not competing, for most SMBs. ## What about the cost Honest answer. For a typical 30-person business that gets serious about this in 2026, you're looking at $30 to $50 per user per month in AI tooling all-in, plus whatever you spend on training and rollout. That's real money. The companies that justify it are the ones that pick the workflows where the AI saves measurable hours per week per user. The companies that don't justify it are the ones that buy the license, send a setup email, and hope productivity goes up on its own. The productivity gain is real. The default rollout doesn't produce it. The deliberate rollout does. ## The bottom line AI for small business stopped being theoretical sometime in the last six months. The vendors have built the products, signed the enterprise deals that validate the technology, and lowered the friction for a 30-person company to deploy it the right way. The risk is no longer "we wasted money on hype." The risk is now "our competitors deployed deliberately while we deployed by accident." The next twelve months are about picking your stack, hardening the data side, and putting AI on the two or three workflows where it actually moves your numbers. If you want help mapping that out for your specific business, that's exactly what our [AI consulting practice](/ai-consulting-inland-empire/) does — readiness and governance, rolling out whichever agent fits (Copilot, Claude, ChatGPT — we run all of them ourselves), and custom automation. We work with companies across the Inland Empire on AI rollouts that actually produce measurable returns, not impressive demos. We'll look at your workflows, your existing M365 setup, and your data posture and tell you honestly what to do first, what to do later, and what to skip. The science experiment phase is over. Time to deploy. --- # Three Critical Vulnerabilities You May Have Missed in May URL: https://etoptechnology.com/blog/may-2026-critical-vulnerabilities-smb-roundup/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-06-10 If you don't spend your day reading cybersecurity feeds, you missed a busy month. May 2026 brought four developments that any business owner should know about, not because you need to become a vulnerability researcher, but because each one changes the math on what your IT team or your IT provider should be doing right now. Here's the plain-English version of what happened, why it matters to small and mid-sized businesses specifically, and what to actually do about it. ## 1. On-premises Microsoft Exchange: Outlook on the web flaw exploited via crafted email **The headline:** A new vulnerability in on-premises Microsoft Exchange, tracked as [CVE-2026-42897](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498), is being actively exploited and has been [added to CISA's Known Exploited Vulnerabilities catalog](https://nvd.nist.gov/vuln/detail/CVE-2026-42897). It's a cross-site scripting and spoofing flaw in Outlook on the web (the browser version of Outlook that on-prem Exchange serves). The attack arrives as a specially crafted email, and the trap springs when a user opens the message in Outlook on the web: the attacker's script runs inside the user's browser session, letting the attacker act as that user — reading mail, sending mail, spoofing content — without ever touching a password. No attachment, no download, no obviously suspicious link. Microsoft rates it 8.1 out of 10, and given confirmed exploitation in the wild, treat that score as a floor, not a ceiling. **Why it matters to SMBs:** Most small and mid-sized businesses moved their email to Microsoft 365 years ago, but on-premises Exchange is still alive in three places we keep finding it: - Hybrid environments where a small Exchange server was left behind after a cloud migration to handle account provisioning. Microsoft has been telling people to remove these for years. Most never did. - Industries with regulatory or compliance requirements that pushed them to keep mail on their own hardware. Legal, healthcare, and a few specialized financial verticals are common holdouts. - Old enough environments that nobody on the current team remembers Exchange is still running. We've walked into client sites where the on-prem server has been quietly humming in a closet for years, forwarding mail to M365 but still receiving inbound messages from the internet. If any of those describe you, this vulnerability is your problem until proven otherwise. **What to do:** - Confirm whether any version of Exchange is still running anywhere in your environment. If you have outsourced IT, ask the question explicitly. "Do we have any on-prem Exchange servers, including hybrid configuration servers, anywhere in our network?" - If yes, apply Microsoft's patch immediately. Not next maintenance window. This week. - If you can't patch immediately, restrict inbound mail flow at the perimeter, isolate the server, or take it offline until it's patched — and consider limiting Outlook on the web access in the meantime, since that's where the exploit fires. - If you have a hybrid Exchange server you don't actually need anymore, this is the prompt to finally retire it. Microsoft publishes a documented decommissioning path. Talk to whoever runs your M365 about getting that scheduled. ## 2. Cisco Catalyst SD-WAN controller authentication bypass added to CISA's emergency list **The headline:** [CVE-2026-20182](https://nvd.nist.gov/vuln/detail/CVE-2026-20182) is an authentication bypass in Cisco Catalyst SD-WAN controllers. [CISA added it to the Known Exploited Vulnerabilities Catalog on May 14](https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog) with an aggressive federal remediation deadline. The flaw lets an attacker gain administrative access to the controller, which in a fully deployed SD-WAN means administrative access to the network fabric. **Why it matters to SMBs:** Cisco SD-WAN is most common in mid-market and enterprise environments, not in 20-person businesses. But there are two ways this becomes your problem: - You're a larger SMB or a multi-site operation that runs Cisco SD-WAN as your wide-area network backbone. In that case this is critical infrastructure and needs immediate attention. - You're a smaller business that inherited or partnered into a network where Cisco SD-WAN is part of the upstream. We've seen this with franchise operations, joint ventures, and businesses that ride on a partner organization's network. CISA adds vulnerabilities to KEV only when there's confirmed active exploitation in the wild. That's the threshold. If it's on KEV, criminals are using it today. **What to do:** - If you don't run any Cisco SD-WAN equipment, you're done with this one. Skip to the next. - If you do, confirm with your network team or IT provider that the controller is on a patched version. The CISA advisory references Cisco's specific guidance, including [Emergency Directive 26-03](https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems), which has detailed remediation steps. - Even after patching, run the hunt and hardening guidance CISA published alongside the directive. If exploitation already happened, patching closes the door but leaves the attacker inside. The hardening guidance is how you find out if you've been touched. ## 3. cPanel critical vulnerability weaponized against MSPs and hosting providers **The headline:** [CVE-2026-41940](https://nvd.nist.gov/vuln/detail/CVE-2026-41940) is a critical vulnerability in cPanel and WHM, the control panel software that runs a large fraction of the world's small business web hosting. [European incident responders have confirmed it being used in ransomware campaigns](http://www.vulnerability-lookup.org/2026/06/03/vulnerability-report-may-2026/), and it ranked among the most-sighted exploited vulnerabilities for two months running. **Why it matters to SMBs:** Most small businesses don't run cPanel themselves. They pay a web host that runs cPanel. The compromise happens at the host level, but the consequence lands on the customer. If your hosting provider's cPanel installation gets compromised, the attacker may be able to access: - Your website source code and any customer data stored alongside it - Email accounts hosted on the same provider, including mailbox contents - Database credentials and backups - Any SSL certificates or API keys configured at the hosting level Even if you've never touched the cPanel interface yourself, this attack still reaches you through your provider. **What to do:** - Ask your hosting provider directly whether they've patched CVE-2026-41940. A serious host will answer fast and clearly. A slow or evasive answer is a signal. - If your website handles any customer data, including form submissions or e-commerce, ask whether your hosting provider has reviewed access logs for indicators of compromise since the vulnerability went public. - If you can rotate passwords, API keys, and database credentials stored at the hosting level, do it. This is good hygiene any month and especially right after a major hosting vulnerability. - For mission-critical sites, this is a reasonable trigger for a re-evaluation of whether your current hosting arrangement matches your security needs. Bargain-basement hosting and serious customer data are an increasingly bad combination. ## 4. "Mini Shai-Hulud" npm worm: 170+ packages compromised in a supply chain attack **The headline:** Researchers identified a new wave of the self-spreading supply chain worm dubbed ["Mini Shai-Hulud"](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html), which compromised more than 170 packages across the npm and PyPI registries — collectively downloaded over 500 million times — including widely used libraries from TanStack, Mistral AI, and Guardrails AI. Downstream impact included a [breach at Grafana Labs' GitHub environment](https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/), which has published a postmortem. [OpenAI separately published a response](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/) describing how they detected and contained their own exposure. **Why it matters to SMBs:** npm is the package manager that powers most modern JavaScript and Node.js software. If your business has a custom web application, a mobile app with a JavaScript backend, an internal tool built by a contractor, or any kind of marketing site more complex than a static page, there's a meaningful chance your supply chain includes npm packages. The way these attacks work is that an attacker quietly injects malicious code into a popular package. Anyone who installs or updates that package downloads the malicious version along with everything else. The compromised code then steals credentials, secrets, or environment variables from the developer's machine or the deployed environment. You don't have to be a software company for this to hit you. You just have to use software that other people built using these compromised packages. **What to do:** - If your business runs any custom software, ask your development team or your provider whether they've audited their dependencies against the published list of compromised packages. The lists are public and updated regularly as more packages are identified. - Rotate any secrets that may have been exposed through development environments or CI/CD pipelines in the last month. Specifically: cloud provider API keys, database credentials, third-party service tokens, and any signing keys. - Make sure your software providers, including your marketing agency if they built your website, have automated dependency scanning and have run a scan since the most recent wave of Mini Shai-Hulud disclosures. - Long term, this is the prompt to require your software vendors to maintain a software bill of materials (SBOM) and to demonstrate their dependency monitoring practices. Vendor risk management used to mean asking about SOC 2. Now it also means asking about npm. ## The pattern across all four The four vulnerabilities above look different on the surface. Email servers, network controllers, hosting platforms, and JavaScript packages don't have much in common. But the pattern is consistent. **Modern attacks are increasingly indirect.** None of these are "a hacker phishes your CEO and steals her password." They're "a hacker compromises something your business depends on, and the consequence flows downhill to you." Mail server you forgot you had. Hosting provider you barely think about. Software dependency three layers deep in a tool a contractor installed for you. **The defense is visibility, not paranoia.** You don't need to read every vulnerability advisory. You need to know what software, vendors, and dependencies your business actually runs, so that when the news cycle highlights one, you can answer "are we affected" in less than an hour. **The patching window keeps shrinking.** "Critical" used to mean "patch in 30 days." It now means "patch in 24 to 72 hours." Anything actively exploited and on CISA KEV is closer to "patch today." If your patch management cycle assumes monthly maintenance windows, that cycle is no longer fast enough for vulnerabilities at this severity. ## What a serious patch and vulnerability management program looks like for SMBs The good news is that you don't need an enterprise security team to get this right. Here's what we expect to see in any well-run small business in 2026: - An accurate inventory of software, devices, and services. You can't patch what you don't know you have. We covered the foundational version of this in our [IT security assessment checklist](/blog/it-security-assessment-checklist/). - Automated patching for endpoints and operating systems, with a documented exception process for systems that need a delay. - Active monitoring of CISA KEV and major vendor advisories, with someone responsible for triaging within one business day. - A vendor risk inventory that lists every third party with access to your data and every critical software dependency. Update it twice a year, not just when an auditor asks. - A documented incident response plan that explicitly covers vulnerability-driven incidents, not just ransomware and phishing. If you don't have most of these, the right next step isn't to panic. It's to acknowledge the gap and start closing it methodically. ## The bottom line Four serious vulnerabilities. Three actively exploited in the wild. One supply chain attack with cascading impact. All in one month. None of it is dramatic enough to make the local news, but all of it is the new normal in 2026. Your business doesn't need to track every CVE. Your business does need to make sure someone competent is tracking them on your behalf, and that the loop between "new vulnerability published" and "we've assessed and acted" is measured in days, not weeks. If you want a clear-eyed read on how your current setup would handle a month like this one, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary. We'll walk through your software inventory, your patch cadence, your vendor exposure, and your incident response readiness, and give you a prioritized list of changes ranked by actual risk, not generic checklists. The next critical vulnerability is already being researched somewhere. The work is making sure it doesn't catch your business off guard when it lands. --- # When Your IT Provider Gets Hijacked: What to Ask About RMM Security URL: https://etoptechnology.com/blog/msp-rmm-supply-chain-attacks-what-to-ask/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-06-10 In an incident [documented in detail by Sophos](https://www.sophos.com/en-us/blog/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers), a managed service provider got hit in a way that should change how every business thinks about outsourced IT. The attackers didn't break into the MSP's office, didn't crack a password, didn't phish an employee in the usual sense. They exploited vulnerabilities in SimpleHelp — the remote monitoring and management tool the MSP used to maintain its clients' computers. Once inside that tool, they pushed malicious installers to the endpoints the MSP managed. Multiple downstream client networks ended up encrypted with DragonForce ransomware. The MSP didn't choose to attack its own clients. The MSP was the way in. This is the supply chain attack pattern that's been quietly growing for the last few years and accelerating in 2026. Attackers have figured out that compromising one MSP can give them a foothold inside dozens, sometimes hundreds, of small and mid-sized businesses simultaneously. Your firewall didn't fail. Your email security didn't fail. Your IT provider's tools were turned against you. If you're a business owner who outsources IT, this is the threat model that should be keeping you up at night, not generic phishing emails. ## How the attack actually works Every managed IT provider uses some form of remote monitoring and management software, commonly called RMM. It's the tool that lets a technician install updates overnight, troubleshoot a frozen workstation without driving to the office, or push security software to a hundred laptops in one click. RMM agents run with full administrative rights on every machine they touch. That's the whole point. Now imagine an attacker getting access to that RMM platform. Not to your server. To the platform that controls thousands of servers, workstations, and laptops across many companies. The path in is usually one of three: - **A vulnerability in the RMM tool itself.** ConnectWise ScreenConnect, SimpleHelp, Kaseya, and others have all had critical authentication or path-traversal vulnerabilities in the last two years. When CISA adds one of these to its Known Exploited Vulnerabilities catalog, it means attackers are already using it in the wild. Patching windows are measured in hours. - **Stolen MSP credentials.** A technician's username and password gets phished, or worse, reused from a breach somewhere else. Once an attacker has those credentials, they don't need to exploit the tool. They just log in. - **A supply chain compromise inside the RMM vendor.** A trojanized software update goes out from the vendor itself. This is what happened to Kaseya in 2021 and what we keep seeing variants of since. Once inside, the attacker uses the RMM exactly the way a legitimate technician would. They push a script. The script installs ransomware. The ransomware encrypts files. Because the activity came from the trusted RMM agent, traditional endpoint protection often lets it through. The tool that was supposed to be your IT department's best friend is the delivery vehicle for the attack. ## Why this is growing Three things changed in the last two years and the trend lines are not slowing down. **MSPs are a force multiplier.** A criminal group can phish a thousand small businesses one at a time, or it can compromise one MSP and reach a thousand small businesses in an afternoon. The economics favor the second approach. **Most SMBs don't audit their MSP.** Outsourced IT is often a "set it and forget it" relationship. The contract gets signed, the technicians do their job quietly, and nobody at the client side ever asks how the MSP itself is secured. That's a problem because your security posture is now stapled to your MSP's security posture, whether you realize it or not. **The tools themselves keep getting found vulnerable.** This is not a knock on RMM vendors. They build complex software and complex software has bugs. But it does mean that the tooling underneath your IT support is itself a moving target that needs constant patching and monitoring. ## The eight questions to ask your IT provider If you take nothing else away from this post, take this. Send these to whoever runs your IT. The answers are revealing. Sometimes the silence is more revealing than the answers. ### 1. What RMM tool do you use, and how do you patch it? You want to hear a specific product name and a specific cadence. "We use ConnectWise Automate and ScreenConnect. We apply critical patches within twenty-four hours and validate against CISA KEV daily." If the answer is vague, ask again. If they don't know which RMM they're running, you have a bigger problem. ### 2. Is multifactor authentication required on every technician account in your RMM? The answer must be yes, with no exceptions for any technician at any time. If they say "most of our techs have it on" or "we're rolling it out," you're at risk today. The gold standard in 2026 is phishing-resistant MFA — FIDO2 security keys, passkeys, or certificate-based authentication. Number matching on push notifications is a worthwhile hardening step against MFA-fatigue attacks, but it isn't phishing-resistant. SMS codes are not enough. ### 3. Do you monitor the RMM platform itself for unusual activity? A good MSP treats its own RMM like a piece of critical infrastructure, not like a productivity tool. They log every script execution, every package push, every remote session. They alert on patterns that look like attacker behavior. They know who logged in last night and from where. If they don't, the RMM is a black box and attackers love black boxes. ### 4. What's your incident response plan if your own RMM is compromised? This is the question that separates the mature shops from the rest. A good MSP has thought about this and has a documented playbook. They can tell you how they would detect it, how fast they could disconnect agents from affected endpoints, and how they would communicate with clients. If the answer is "well, that's never happened to us," push harder. The right answer is "here's exactly what we'd do." ### 5. Are your technicians using their personal email or company email to log into client systems? You'd be surprised how often the answer is the wrong one. Technician accounts in the RMM should be tied to a managed corporate identity with conditional access policies, not a Gmail account that one of the techs has been using for years. ### 6. What endpoint detection and response (EDR) tool runs on the machines you manage? Even if the RMM is compromised, a properly configured EDR can stop the ransomware payload before it runs. Look for products with behavioral detection, not just signature-based antivirus. Microsoft Defender for Business, SentinelOne, CrowdStrike, and Huntress are common answers. The right product matters less than the right configuration and an actual human watching the alerts. ### 7. Who's watching the alerts at 2am on a Saturday? Ransomware attacks happen at 2am on a Saturday because the attackers know that's when nobody's watching. The right answer is a 24/7 security operations center, either run by the MSP or contracted to a specialist. Around-the-clock coverage is a real operational investment, which is exactly why it's worth confirming rather than assuming. ### 8. Can I see your most recent third-party security audit? This is the one that ends the conversation politely for shops that have nothing to show. SOC 2 Type II, an annual penetration test, or a CIS Controls assessment is what you're looking for. It doesn't have to be perfect. It has to exist. ## What to do with the answers I'll be direct: we've been on the receiving end of these exact questions from prospective clients vetting us before signing a contract, and we think that's exactly how it should work. A good MSP welcomes the scrutiny — we'll answer every one of these questions in writing for any client or prospect who asks, and being asked to do it keeps the whole industry honest. If the answers you get back are incomplete, that doesn't necessarily mean you need a new provider tomorrow. It means you've found the agenda for your next vendor meeting. The threat model has shifted: the "trusted IT vendor" model assumes the vendor is hardened, and in 2026 that's something to verify, not assume. A few things you can do on your side of the relationship regardless of who runs your IT: - **Make sure you have your own offsite backups.** If the worst happens and your network gets encrypted through your MSP's tools, the backups your MSP holds may also be encrypted. An immutable backup outside the MSP's control is the seatbelt for this attack. Our take on [the difference between backup and disaster recovery](/blog/backup-vs-disaster-recovery-ransomware/) goes deeper on this. - **Carry cyber insurance and read the exclusions.** Some policies are starting to exclude or limit coverage for incidents that come through an MSP supply chain unless specific controls are in place. Read the application questions carefully. Make sure the answers on your application are still true today. - **Document who has access to what.** If your MSP has an admin account on your firewall, your Microsoft 365 tenant, your file server, and your line-of-business app, you should know that. Quarterly access reviews are not optional. ## The bigger picture The traditional security playbook for small business focused on the perimeter, then on email, then on endpoints. The threats kept finding the next weakest link. In 2026, for businesses that outsource IT, the weakest link is increasingly the IT vendor itself. Not because MSPs are negligent. Because they're a high-value target with a long blast radius and attackers have noticed. The good news is that the hardening is achievable. Phishing-resistant MFA on every technician account. Patching the RMM the same week the patch comes out, not the same quarter. Real-time monitoring of the RMM platform. EDR on the endpoints with humans watching the alerts. A documented incident response plan that includes "what if it's us." This is the standard a serious MSP holds itself to in 2026. If you're not sure where you stand, the answer isn't to panic. The answer is to ask the questions above, get real answers, and act on what you learn. We work with businesses across the [Inland Empire](/inland-empire-it-services/), and we're happy to answer every one of these eight questions about our own setup — that's table stakes. If you want a second opinion on how your current environment would hold up against the attack pattern described above, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary. We'll walk through your environment and your exposure honestly. No sales pitch until you've seen the findings. --- # The Phishing Attack That Walks Right Past MFA URL: https://etoptechnology.com/blog/oauth-consent-phishing-bypasses-mfa/ Type: Article Category: Microsoft 365 Author: William “BJ” Pote Published: 2026-06-10 Multifactor authentication is the single best security control most small businesses have rolled out in the last five years. It stops the basic password-stuffing and credential-theft attacks cold. Anyone who tells you to skip it is wrong. But there's a class of phishing attack that walks right past MFA, and it's been quietly hitting Microsoft 365 tenants at scale. This spring, a phishing-as-a-service operation called [EvilTokens compromised more than 340 Microsoft 365 organizations across five countries](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html) in a matter of weeks using a close cousin of this technique — [abusing Microsoft's legitimate device-code sign-in flow](https://www.helpnetsecurity.com/2026/03/31/eviltokens-phishing-microsoft-365/) so victims handed over valid tokens while completing what looked like a routine, MFA-verified login. The whole attack family works the same way: it never steals a password and never trips an MFA challenge. It looks like a normal Microsoft screen we've all clicked through a hundred times. If your security training only covers "look for the typo in the URL and check for the padlock," your team is going to lose to this one. ## What's actually happening The technique is called OAuth consent phishing, sometimes called illicit consent grant attacks, and it abuses a feature of Microsoft 365 (and Google Workspace, and most other identity platforms) that's perfectly legitimate when used correctly. Here's the legitimate version. You sign up for a new tool, let's say a scheduling app. The app needs to read your calendar, so when you connect it, Microsoft shows you a consent screen that says something like "Acme Scheduler is requesting permission to read your calendar, send mail on your behalf, and access your files." You click Accept. Microsoft gives the app a token that lets it do those things without ever seeing your password. That's OAuth. It's everywhere. It's how every "Sign in with Microsoft" or "Connect this tool to your Office 365" button works. Now here's the attack. The user clicks a link in an email. The email looks like a normal business message; maybe it's pretending to be from a vendor, an HR system, or a coworker sharing a document. The link opens what looks like a sign-in page, but it's actually a real Microsoft consent screen for a malicious app the attacker registered. The user doesn't type their password into anything sketchy. They just click "Accept" because the screen has the Microsoft logo and looks like every other corporate sign-in flow they've ever seen. The moment they click Accept, the attacker's app gets a token. That token can read mail, send mail, download files from OneDrive, search SharePoint, and pull contact lists, depending on what permissions the attacker asked for. The user's password is never disclosed. MFA was never triggered, because the user already had a valid session. The attacker now has persistent API access to that mailbox until the token is explicitly revoked, even if the user changes their password tomorrow. That's the trick. The attack doesn't break MFA. It sidesteps the whole authentication question by exploiting authorization. ## Why this is hitting now OAuth consent phishing has been around for years, but three things have changed in the last twelve months that made it the attack of the month. First, **MFA is now common enough that attackers had to find a way around it.** For years, enough small business mailboxes had no MFA at all that password phishing was free money. Now that most mailboxes have at least basic MFA, attackers are pivoting. Second, **the tooling has industrialized.** EvilTokens and similar phishing-as-a-service platforms let any low-skill attacker rent a campaign. They don't write the code. They pay a subscription, point and click, and get a working attack with a dashboard showing harvested tokens. Third, **Microsoft 365 makes it relatively easy for any user to grant consent to a third-party app by default.** Until an administrator changes the tenant settings, a regular employee can click Accept on an OAuth consent screen and grant a malicious app real permissions to their mailbox, without any IT approval. This is the single setting most SMB tenants have wrong. ## How to actually stop it The good news is that the defense is well understood. The bad news is that almost no tenant has it configured correctly out of the box. Here's the short list of what needs to be true in your Microsoft 365 environment. ### Require admin consent for third-party apps This is the single most important change. In Entra ID, under Enterprise Applications, there's a setting called User consent for applications. The default historically allowed users to consent to apps that request a wide range of permissions. The right setting for almost every small business is "Do not allow user consent" or, at minimum, "Allow user consent for apps from verified publishers, for selected permissions." When this is set correctly, the consent screen no longer says "click Accept." It says "this app requires admin approval, click here to request it." That single change shuts down the attack pattern. An attacker can still send the phishing email, but the user can no longer hand over the tokens. The request lands in an admin queue where it can be denied or quietly investigated. There's a small productivity cost. Employees who legitimately want to connect a new tool now have to wait for IT to approve it. In practice that's a feature, not a bug, because most "I want to connect this random AI note-taker to my mailbox" requests don't survive a five-second review. ### Set up the admin consent workflow If you're going to require admin approval, you also need a process for granting it. Microsoft has a built-in admin consent workflow that emails approval requests to designated reviewers, lets them see exactly what permissions the app is asking for, and lets them approve or deny with a click. It's free, it ships with M365, and most tenants never turn it on. A reasonable target turnaround is one business day. Slower than that and employees route around you, faster than that and the reviewer doesn't have time to actually look at what they're approving. ### Block the device-code flow while you're in there One important caveat. The EvilTokens campaign that opened this post used device-code phishing — a close cousin that abuses Microsoft's device sign-in flow, the "go to microsoft.com/devicelogin and enter this code" process built for TVs, kiosks, and shared devices. Locking down app consent does nothing against that one, because the victim is completing a real Microsoft sign-in, not approving an app. The fix is a Conditional Access policy in Entra ID that blocks the device code flow outright — there's a dedicated authentication flows condition for exactly this. Most small businesses have zero legitimate use for device-code sign-ins, so blocking it costs nothing. If you do have conference-room hardware that needs it, scope an exception to those specific accounts instead of leaving the flow open for everyone. ### Audit existing app consents Even if you lock down future consents today, your tenant may already have malicious or forgotten apps with active tokens. Go into Enterprise Applications and look at what's there. The first time most clients run this audit they find anywhere from a dozen to over a hundred third-party apps with permissions on their tenant. Many are legitimate but forgotten, some are old marketing tools nobody uses anymore, and occasionally one is a leftover from an active or attempted attack. Revoke anything you can't justify. If revoking might break a real workflow, ask the user. If the user doesn't know what it is, revoke it. ### Watch for new consent grants in your audit log Microsoft 365 logs every consent grant. A well-run tenant has an alert that fires whenever a new app consent is granted, especially one with high-privilege permissions like Mail.ReadWrite or Files.ReadWrite.All. If an attacker did slip through, the alert is your chance to catch them before the token actually gets used against you. ### Don't forget about token revocation in your incident response If you suspect an account has been compromised through OAuth consent phishing, changing the user's password and re-prompting for MFA does almost nothing. The attacker's token is still valid. You have to explicitly revoke the consented app, revoke the user's active sessions, and rotate the OAuth tokens. Make sure this step is in your written incident response procedure. ## How this connects to the broader Microsoft 365 hygiene problem OAuth consent phishing is one symptom of a larger pattern we see constantly. Microsoft 365 ships with permissive defaults that made sense for a small company in 2018 and are too loose for a regulated or risk-averse business in 2026. The right defaults today include admin consent for third-party apps, conditional access policies that block legacy authentication, phishing-resistant MFA for administrators, sensitivity labels on confidential content, and aggressive review of guest access. Each of these is a small configuration change. Together they shift your tenant from "out of the box" to "actually hardened," and they cost nothing if you're already paying for Business Premium or higher. We've written about this from other angles too, including [how AI tools at work create related data governance problems](/blog/ai-tools-at-work-data-leakage/). The throughline is the same: most small businesses are paying for security features they haven't turned on. ## What good looks like If you ran a quick health check against the things in this post, here's what you'd want to see in a well-configured tenant: - User consent for third-party apps is set to either Off entirely or restricted to verified publishers with low-risk permissions only. - An admin consent workflow is enabled with a designated reviewer and a published SLA for response. - The Enterprise Applications list has been audited in the last ninety days and stale or untrusted apps have been revoked. - An alert exists for new high-privilege consent grants and routes to someone who actually reads it. - The incident response playbook includes token revocation, not just password reset. - MFA for administrators and finance staff is phishing-resistant: FIDO2 security keys or passkeys. (Number matching hardens push MFA against fatigue attacks and is a fine baseline for everyone else, but it isn't phishing-resistant.) - Conditional access blocks legacy authentication protocols and the device code flow, and enforces compliant devices for sensitive roles. If you're missing more than two or three of these, you're operating with the doors propped open. ## The bottom line OAuth consent phishing is the attack pattern most security training never mentions and most Microsoft 365 tenants are wide open to. It doesn't break MFA. It walks around it. The fix is a handful of configuration changes that take a couple of hours and cost nothing if you're already on the right license. The hardest part is knowing what to look for. If you'd like a second set of eyes on your Microsoft 365 tenant, [book an intro call](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary, and it includes the exact checks described above. You'll get a report showing which settings are misconfigured, which apps have permissions on your tenant that you may not have known about, and a prioritized list of changes ranked by how much risk they actually carry. The attack already knows where to look. Your tenant should know too. --- # Backup vs Disaster Recovery: Why Your Backups Won't Save You From Ransomware URL: https://etoptechnology.com/blog/backup-vs-disaster-recovery-ransomware/ Type: Article Category: Business Continuity Author: William “BJ” Pote Published: 2026-04-25 I've sat in on a lot of post-ransomware conversations. There's a moment in almost every one of them where the owner says some version of "but we have backups." And the response from the recovery team is always some version of "yes, and that's not the same as disaster recovery." That's the conversation this post is trying to prevent. Backup and disaster recovery are not the same thing. They overlap, they share tooling, and most vendors sell them together, but the gap between them is exactly where small businesses get hurt. Ransomware is the most painful place that gap shows up. Hardware failures and accidental deletions are the others. Let me walk through the difference, the math that matters, and why most SMB "DR plans" don't survive contact with reality. ## What Backup Actually Does A backup is a copy of your data at a point in time. That's it. It exists so that if you lose the original, whether through hardware failure, accidental deletion, file corruption, or malicious encryption, you can put a copy back. Backups answer one question: "can I get this file or this database back?" Backups don't answer the question that matters when the building is on fire: "how long until we are fully operational again?" You can have perfect backups and still be down for two weeks. ## What Disaster Recovery Actually Does Disaster recovery is the broader process of restoring business operations after a disruptive event. Backups are one ingredient. The other ingredients are the things small businesses underestimate. A real DR plan has answers to: - **Where do we run if the office or the server room is gone?** Cloud failover, hot site, spare hardware ready to deploy. - **How fast can we be running again?** Your Recovery Time Objective. Hours? A day? A week? - **How much data are we willing to lose?** Your Recovery Point Objective. Last night? Last hour? Last 15 minutes? - **Who does what?** Names, phone numbers, and a sequence of operations. - **How do we communicate with employees and clients while systems are down?** Without using email, because email is what's down. - **How do we know it works?** A tested, documented restore, not a hopeful one. That's disaster recovery. Backups are step one of about twelve. We covered some of this in the [incident response planning post](/blog/incident-response-planning/), and the two plans are siblings, but DR is specifically about getting operational again, not just stopping the bleeding. ## The RPO and RTO Math Most SMBs Skip Two acronyms that matter more than any vendor brochure. **RPO, Recovery Point Objective.** How much data can you lose without serious harm? If you back up nightly at 11 PM and ransomware hits at 4 PM the next day, your RPO is roughly 17 hours. That's how much work your team will have to redo. For a 50-person company, 17 hours of lost work is a real number. For a finance team mid close, it can be catastrophic. **RTO, Recovery Time Objective.** How long can you be down before the business takes lasting damage? Two hours? Two days? Two weeks? Most SMBs have never put a number on this, and when they do the answer is much shorter than what their current setup can deliver. Here's the math that surprises people. If your RTO is 4 hours and your only backup is a USB drive in a fireproof safe, your real RTO is closer to 4 days. You have to source replacement hardware, rebuild the operating systems, restore data, reconfigure applications, and verify everything. That's not 4 hours. That's not even the same order of magnitude. The cost of meeting an aggressive RTO is real, but so is [the cost of downtime](/blog/cost-of-it-downtime/). The right move is to set the RTO and RPO based on what the business actually needs, then build the DR plan to hit those numbers. ## Why Backups Alone Lose to Ransomware Modern ransomware is not stupid. The first thing it does, before encrypting anything visible, is hunt for backups. It looks for backup repositories on the network. It looks for cloud sync folders that are backups in disguise. It looks for backup software's admin console and tries to delete or encrypt the backup catalog. If the attacker has been in your environment for two weeks, which is the average dwell time, they have time to do this thoroughly. They don't push the encryption button until they're confident your backups are also gone or worthless. The number of small businesses we've seen with backups they couldn't restore from after ransomware is sobering. Common reasons: - Backup target was a shared folder on the network. Encrypted along with everything else. - Backups went to cloud sync (Dropbox, OneDrive sync folder). The sync replicated the encrypted files to the cloud copy. Game over. - Backup credentials were compromised and the attacker deleted the cloud backup before encrypting locally. - Backups existed but had been silently failing for six months. Nobody was checking the reports. - Backups were technically successful but had never been test-restored. When it came time to restore, half the files came back corrupted. Each of those is a backup problem. None of them are a DR problem in isolation. A real DR plan assumes attackers will go after backups and is built so the recovery still works anyway. ## The Three Things That Actually Survive Ransomware If you take nothing else from this post, take these three. ### 1. Immutable Backups Immutable means write-once, can't-be-modified-or-deleted by anyone, including an admin with stolen credentials. The backup target is set up so that for a defined retention window, the data physically cannot be erased or overwritten. Ransomware can't delete what it can't modify. Immutability is now table stakes for any serious backup product. Axcient, Datto, Veeam, and others all support it in modern versions. The configuration matters. Some setups call themselves immutable but have admin override paths the attacker can find. The right configuration locks even the highest-privilege account out for the retention window. ### 2. Off-Network, Off-Account Copies The old 3-2-1 rule said: 3 copies, 2 different media, 1 offsite. The 2026 update is 3-2-1-1-0. Three copies, two media types, one offsite, **one immutable, zero recovery errors verified**. The "off-account" part is the new piece. Your offsite copy needs to be in a different security boundary than the rest of your environment. Different cloud account, different credentials, ideally a different identity provider. If the attacker compromises your Microsoft 365 tenant, they should not also have a path into your backup vault. ### 3. Tested, Documented Restore A backup that has never been restored is a hope, not a plan. We test client restores quarterly at minimum. Pick a server, pick a database, pick an entire site. Restore it to an isolated environment. Verify the data is correct, the application starts, the services come back up. Document how long it took. The first test restore is usually painful. Something is missing. Permissions are wrong. The application has a license key tied to the original hardware. The database needs a transaction log replay nobody documented. Better to discover that during a test than during a real incident at 2 AM. After two or three test cycles, the runbook is solid and the restore actually works the way the brochure promised. ## The DR Plan Components People Forget Beyond backups, a working DR plan covers: - **A current asset inventory.** Servers, applications, data flows, dependencies. You can't restore what you can't list. - **A communication plan.** Where do employees go for updates when email is down? Texted phone tree? An out-of-band Teams or Slack? It needs to exist before the day you need it. - **Defined recovery priorities.** Not everything comes back at once. What's first? Domain controllers, then ERP, then file shares, then email, then everything else. Or some other order. Decide now, not during the outage. - **Vendor contact list.** Internet provider, line-of-business application support, hardware vendors, your [cyber insurance](/blog/cyber-insurance-requirements-2026/) carrier, your MSP. Phone numbers. Account numbers. After-hours escalation paths. - **Spare or surge capacity.** If your servers are gone, where do you run? A cloud DR site that boots from backups in 60 minutes? A pre-staged VM environment? Something has to exist before the disaster, not be ordered after it. ## What "Good" Looks Like for a 50-Person Business A reasonable BCDR posture for a typical SMB looks roughly like this. RPO of 1 to 4 hours for critical systems, achieved with frequent snapshots or continuous data protection. RTO of 4 to 8 hours for the core stack, achieved through cloud failover or rapid bare-metal recovery to virtual environments. Immutable backup retention of at least 30 days. Off-account copies in a separately secured cloud vault. Quarterly test restores documented and tracked. A written runbook updated annually and after every test. That's the standard we build to for clients running [our BCDR service](/business-continuity-disaster-recovery/). It's achievable for small businesses today. The technology is mature, the costs are reasonable, and the alternative is the conversation I described at the start of this post. ## The Bottom Line Backups are necessary, but they are not disaster recovery. They are one ingredient in a recovery plan that also includes recovery time targets, immutable copies, off-network architecture, tested restores, communication plans, and a documented runbook. The businesses that get hit by ransomware and survive intact are the ones that built the full plan, not just the backup job. If you don't know your RPO, your RTO, or the last time someone successfully test-restored a critical system, you are running on hope. Hope is not a recovery strategy. We do real BCDR work for [businesses across the Inland Empire](/business-continuity-disaster-recovery/), with immutable backups, defined recovery targets, and quarterly tested restores. If you want to know where your real exposure sits today, [schedule a free assessment](/contact/). We'll walk through your current setup, identify the gaps that ransomware would expose, and tell you exactly what it takes to close them. --- # AI Tools at Work: How to Use ChatGPT and Copilot Without Leaking Company Data URL: https://etoptechnology.com/blog/ai-tools-at-work-data-leakage/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-04-23 Here's a pattern that shows up in audit logs at business after business. The controller is hitting ChatGPT every afternoon for about an hour, using it to draft client emails and clean up financial summaries. Productivity-wise it's fantastic. Security-wise it's a disaster waiting to happen, because what's getting pasted in is actual client account balances, employee names, and internal financial commentary, all going into a free consumer tool that explicitly states it can use submitted content to train its models. Nobody involved thinks they're doing anything wrong. They're just trying to get their work done faster. This is happening in every business right now. Employees are using AI tools to write emails, summarize meetings, generate code, and analyze spreadsheets. Most of them have no clue where that data actually lives once they paste it in. And almost no small business has a policy that addresses it. You can't ban AI. The productivity gains are real, and your competitors are using these tools whether you like it or not. What you can do is make sure your team gets the upside without handing over your client list, your contracts, and your financials to a model training pipeline. ## The Three Things Most Businesses Get Wrong ### 1. Treating All AI Tools the Same There's a big difference between ChatGPT.com on a personal account and Microsoft 365 Copilot tied to your tenant. Same underlying technology. Completely different data handling. The free consumer version of ChatGPT, by default, may use your prompts to improve future models. Anything pasted in is potentially training fodder. The team and enterprise versions of ChatGPT, the API, and Microsoft 365 Copilot operate under different terms. Your data stays inside the boundary, isn't used for training, and inherits the security and compliance posture of the platform it sits on. Most businesses tell employees "don't use ChatGPT." Employees use it anyway because nothing else is available. The right move is to provide a sanctioned option with enterprise data terms and make it the easier path. ### 2. No Policy, or a Policy Nobody Reads Half the businesses we work with have no AI policy at all. The other half have a policy buried in the employee handbook that nobody has looked at since onboarding. Neither approach changes behavior. A useful AI policy is short, specific, and answers the questions employees actually have. Which tools are approved. What data can go into them. What data absolutely cannot. Who to ask if you're not sure. That's it. Two pages, not twenty. ### 3. Ignoring the Sharing Problem on the Microsoft 365 Side Here's the one almost nobody is ready for. Microsoft 365 Copilot is brilliant at finding information across your tenant. SharePoint, OneDrive, Teams, email, all of it. The problem is it can only respect the sharing permissions you already have set up. If your finance folder was technically shared with the entire company because someone got lazy with permissions five years ago, Copilot will happily surface salary spreadsheets to anyone who asks the right question. Copilot is a magnifying glass on your existing permissions hygiene. If that hygiene is bad, Copilot makes it visible fast. Here's the scenario that should worry you: a 60-person team rolls out Copilot, and within a week an account manager innocently asks "what does the senior leadership team make?" Copilot answers. Accurately. From a misshared HR file nobody has looked at since 2022. The cleanup is doable, but it has to happen before you turn Copilot on, not after. ## The Five Categories of Data and Where They Can Go We use this framework with clients to make AI policy decisions concrete. Sort your data into five buckets and decide which AI tools each one is allowed to touch. **Public data.** Marketing copy, press releases, public website content, published case studies. This can go into any AI tool, including consumer ChatGPT. There's no risk because it's already public. **Internal non-sensitive.** Generic process documentation, internal memos that aren't strategic, training materials. Approved enterprise tools only. No consumer tools, even if it feels boring. The principle is consistency, not paranoia. **Confidential business data.** Pricing, customer lists, financial summaries, strategic plans, internal performance data. Microsoft 365 Copilot inside your tenant or other enterprise AI with a signed Data Processing Agreement. Never consumer tools, never personal accounts. **Regulated data.** PHI (protected health information), PII (personally identifiable information), financial records subject to FTC Safeguards or [WISP](/blog/wisp-california-businesses/) requirements, anything covered by HIPAA. Stricter still. Only AI services that meet your applicable compliance framework. For HIPAA that means a signed BAA (business associate agreement). For Microsoft Copilot in a properly configured tenant, the BAA already exists. For random AI tools, it doesn't. **Privileged or trade secret data.** Attorney-client privileged communications, source code that's a trade secret, M&A discussions, board materials. Many businesses choose to exclude these from AI tools entirely, even sanctioned ones, because the risk-reward math doesn't work. If your team can answer "which bucket is this data in" before they hit paste, you've solved most of the problem. ## What to Actually Do This Quarter ### Step 1: Survey What's Already Happening You almost certainly have shadow AI usage right now. Microsoft Defender for Cloud Apps and similar tools can show you exactly which AI services your network is talking to. Most clients are surprised by what they find. ChatGPT, Claude, Gemini, Perplexity, half a dozen note-takers, AI meeting recorders attaching themselves to Teams calls, code assistants. The list is long. You can't write a policy that matches reality if you don't know what reality is. Start with visibility. ### Step 2: Pick One Sanctioned Stack For Microsoft 365 shops, the path of least resistance is Microsoft 365 Copilot for Business or Copilot for Microsoft 365, depending on licensing. It runs inside your tenant, respects your existing security controls, has the BAA in place if you have one, and integrates with the apps your team already uses. For specific use cases like coding or research, you might add a second sanctioned tool with appropriate enterprise terms. The key is having a clear answer when an employee asks "can I use AI for this?" The answer should be "yes, here's the tool we pay for." ### Step 3: Clean Up Permissions Before You Roll Out Copilot Before you turn on Copilot for Microsoft 365, audit oversharing. Run the SharePoint Advanced Management or equivalent reports. Find sites and files shared with "Everyone" or "All employees." Restrict them to the actual audience that needs them. This is the single most important pre-Copilot project, and it's the one most rollouts skip. While you're in there, apply sensitivity labels to confidential and regulated content. Copilot respects labels. A document marked Confidential won't be summarized for someone who can't read it. Without labels, Copilot uses raw permissions, which is exactly the problem. ### Step 4: Write the Two-Page Policy The policy should cover, in plain language: - Approved AI tools and how to access them - Data categories and which tools each can touch - Specific prohibitions (regulated data into consumer tools, anything privileged into any AI, etc.) - What to do if data was already sent somewhere it shouldn't have been - Who to contact for questions or new tool requests Make it easy to read. Make it part of onboarding. Update it every six months because the AI landscape moves that fast. ### Step 5: Train Specifically for AI Risk Generic security awareness training does not cover this. The training that works walks through real examples. Here's a good prompt. Here's a prompt that just leaked client data. Here's how to rewrite the second one to get the same answer without exposing anything sensitive. The goal isn't to make people afraid of AI. It's to make them think for one second before they paste. ## The Compliance Angle You Cannot Ignore If you're in a regulated industry, AI usage is increasingly showing up in audits and breach assessments. Staff pasting PHI into a consumer AI tool is exactly the kind of unauthorized disclosure HHS fines covered entities for. Cyber insurance applications now ask about AI governance directly. Some carriers are starting to deny claims where uncontrolled AI usage played a role in the incident. If you're working on [HIPAA compliance](/compliance-it-services/), [FTC Safeguards](/blog/ftc-safeguards-rule-2026/), or any state data protection requirement, AI tool governance has to be part of the program. The regulators are not waiting for you to figure it out. ## The Bottom Line AI tools are not going away, and you don't want them to. The productivity gains for a 50-person company are real. The threats are also real, and they don't look like the cyberattacks you're used to defending against. The leak doesn't come from an attacker. It comes from your most productive employee trying to do her job a little faster. Get visibility into what's actually being used. Pick a sanctioned enterprise stack. Clean up permissions before turning on Copilot. Write a short, useful policy. Train specifically for the patterns that matter. We help [businesses across the Inland Empire](/microsoft-365-management/) roll out Copilot the right way, including the unglamorous permissions cleanup that nobody else wants to do. If you want to see where your AI exposure stands, our [AI Readiness Assessment](/ai-consulting-inland-empire/) is a fixed-fee review that shows you what your team is actually using, where the data is going, and what to do about it — findings, a prioritized roadmap, and a draft acceptable-use policy you keep either way. --- # Business Email Compromise: The $50 Billion Scam That Targets Small Businesses URL: https://etoptechnology.com/blog/business-email-compromise-smb/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-04-22 Ransomware gets all the news coverage. Hospitals shut down. Pipelines frozen. Big numbers and dramatic headlines. But the cybercrime that's actually been emptying small business bank accounts in the Inland Empire isn't ransomware. It's Business Email Compromise. The FBI's IC3 unit tracks complaint data on every type of internet crime. Business Email Compromise, BEC for short, has caused over $50 billion in reported losses since the FBI started tracking it, and the [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) puts BEC at $3.05 billion in reported losses for that year alone — the second-largest crime category they track. And the businesses getting hit aren't Fortune 500 companies with sophisticated finance teams. They're 30, 50, 100-person companies in industries you'd never think of as targets. Construction firms wiring funds to a vendor. Law firms moving client trust money. Dental practices paying a supplier. Most of them never see a dime back. ## What BEC Actually Is Business Email Compromise is a fraud scheme where an attacker either takes over a real business email account or convincingly impersonates one to trick someone into sending money or sensitive data. There's no malware. There's no ransomware payload. There's just an email that looks like it came from someone you trust, asking you to do something that seems normal. The reason it works is that BEC attacks don't fight your security tools. They go around them. Your firewall, your antivirus, your [EDR](/blog/what-is-edr/), they're all looking for malicious code and unusual network behavior. A BEC email is just text. It looks like a thousand other emails you got that day. ## The Five Plays Attackers Run Nearly every BEC attack runs one of five plays. Knowing them is the first step to spotting them. ### 1. The CEO Wire Request The owner is traveling. An email goes to the controller from what looks like the owner's address, marked urgent, asking for a wire transfer to a new vendor. The attacker has done their homework. They know the controller's name, they know the owner is at a conference because LinkedIn told them so, and the email signature looks right. The controller, trying to be responsive, processes the wire. Sometimes hundreds of thousands of dollars. By the time anyone calls to verify, the money has been routed through three accounts and converted to crypto. Gone. ### 2. The Vendor Account Change A vendor you've been paying for years emails to say their banking information changed. New routing number, new account. Could you update it on your end? Their next invoice goes out the next day, and you pay it. To the attacker. This one is brutal because the email comes from what looks like the vendor's real domain, sometimes from an actually compromised vendor mailbox. By the time the real vendor calls asking why they haven't been paid, three or four invoices have already been wired to the wrong place. ### 3. The Payroll Diversion An HR or payroll person gets an email from what looks like an employee asking to update their direct deposit information for the next pay run. New bank, new routing number. The change goes through. The employee's paycheck lands in the attacker's account. Sometimes the employee doesn't notice for two weeks. ### 4. The Invoice Scam A real invoice from a real client gets intercepted. The attacker, who has compromised someone's mailbox somewhere along the chain, modifies the wire instructions on the PDF and forwards it on. Your client pays the modified invoice to the wrong account. They're now down the money, and they think you got paid. Awkward conversations follow. ### 5. The Data Pull This one doesn't always involve money directly. An attacker, posing as the CEO or a senior partner, asks HR for "a copy of all W-2s for tax planning purposes" or "a list of all employees with SSNs for an audit." HR sends it. Now the attacker has filing-grade identity data on every person at your company. ## Why Small Businesses Are the Sweet Spot Big companies have whole teams that exist to verify wire transfers. They have payment authorization workflows. They have fraud analytics on the bank side. Small businesses usually have one person who does everything, no separation of duties, and a culture of "just take care of it." That's exactly the environment BEC thrives in. Picture a 35-person construction company hit with a single fake vendor change request. The owner is on a job site. The bookkeeper gets an email that looks legitimate. The change goes through, the next progress payment — say $180,000 — gets wired to the attacker, and the real vendor calls three days later asking when they're getting paid. Whether cyber insurance covers any of it usually comes down to whether the company can prove it had baseline controls in place. Without that, they eat the whole loss. That's the part that never makes the news. The post-incident reality is small businesses absorbing six-figure losses out of operating cash. Most don't survive it twice. ## The Controls That Actually Stop BEC You can't buy a BEC-prevention product because BEC isn't a single technical problem. It's part technology, part process, part training. Here's what actually works. ### Lock Down the Mailbox Most BEC starts with a compromised mailbox somewhere, either yours or a vendor's. The same controls that stop initial account takeover stop most BEC at the source. - **MFA on every Microsoft 365 account.** Not just executives. Everyone. Phishing-resistant MFA where possible, meaning hardware keys or authenticator app push, not SMS. - **Conditional access policies** that block sign-ins from countries you don't operate in, require compliant devices, and flag impossible-travel scenarios. We covered the [zero trust mechanics](/blog/zero-trust-security-explained/) of this in detail. - **Disable legacy authentication.** Older protocols like POP, IMAP, and basic SMTP authentication can bypass MFA. Microsoft has been pushing customers off these for years. If they're still on, turn them off. - **Monitor mailbox forwarding rules.** Attackers love to set up auto-forward rules so they can quietly read every email even after they lose access. Defender for Office 365 catches most of these. Audit them quarterly anyway. ### Build a Verification Process for Money Movement This is the part most companies skip. Technology can only do so much. Process is what stops the wire from going out. The rule we put in place for every client: **any change to payment instructions, any wire request, any banking change, gets verified by a phone call to a known number, not the number in the email.** Not a return email. Not a text to a number listed in the request. A phone call to the number you already had on file. Yes, it adds a step. Yes, the bookkeeper might roll their eyes the first few times. The first time it catches a $40,000 fake wire, nobody complains again. If you can't do that, at minimum: - Two-person approval on any wire over a set threshold. - Written authorization for any banking change, signed by an officer of the requesting company. - A 24-hour cooling-off period on first-time payments to a new account, so an emergency request gets daylight before it goes out. ### Train Specifically for BEC Generic security awareness training is not enough. Most of it teaches people to look for misspelled URLs and bad grammar. Modern BEC has neither. The training that actually moves the needle teaches the patterns above and runs simulated BEC tests, not just generic phishing tests. We run simulations against client finance teams that mimic real wire requests. The industry data on this is striking: [KnowBe4's 2025 Phishing by Industry Benchmarking Report](https://www.knowbe4.com/resources/reports/phishing-by-industry-benchmarking-report) found untrained users fail phishing tests at a 33.1% baseline rate, dropping to 4.1% after 12 months of consistent training. The point isn't to embarrass anyone. The point is muscle memory. When the real one shows up, the controller has seen it before. ### Configure Microsoft 365 to Catch the Spoofs Microsoft 365 has anti-spoofing tools that most businesses never turn on or tune. - **Set up SPF, DKIM, and DMARC** on your sending domain, with DMARC enforcement set to quarantine or reject. This makes it dramatically harder for attackers to send mail that appears to come from your domain. - **Enable anti-impersonation protection** in Defender for Office 365 for your executives and finance team. The system learns which display names match which addresses and flags mismatches. - **Tag external senders.** A simple banner that says "[EXTERNAL]" on every email from outside your domain is one of the highest-ROI controls available. Attackers spoofing internal addresses get caught instantly. ## What to Do If You Get Hit If a wire goes out and you realize within hours, every minute matters. Here is the order of operations. 1. **Call your bank immediately.** Ask them to initiate a SWIFT recall on the wire if it has cleared, or freeze it if it hasn't. The first 24 to 72 hours are when recovery is still possible. 2. **File an IC3 complaint with the FBI** at ic3.gov. Reference the Financial Fraud Kill Chain. The FBI has working relationships with major correspondent banks and can sometimes claw back funds the bank can't. 3. **Notify your cyber insurance carrier** within whatever window your policy requires. Late notice is one of the most common reasons claims are denied. We covered this in the [cyber insurance requirements post](/blog/cyber-insurance-requirements-2026/). 4. **Trigger your [incident response plan](/blog/incident-response-planning/).** Even if you "just lost money," there's almost always a compromised mailbox or vendor relationship somewhere in the chain. Find it before the attacker hits you again. 5. **Reset credentials and review forwarding rules** on every mailbox in the affected workflow. Vendor, internal, anyone copied on the original chain. ## The Bottom Line BEC is the cybercrime that costs small businesses the most and gets the least attention. It doesn't use exotic malware. It uses your trust, your processes, and your hurry. The defenses are not glamorous. Lock down mailboxes. Build a verification process for money movement. Train specifically for BEC patterns. Tune the email security tools you're already paying for. We do this work for [businesses across the Inland Empire](/cybersecurity-services-inland-empire/) every day. If you want a clear-eyed look at where your gaps are, [reach out](/contact/) — qualifying businesses receive our IT Risk Assessment complimentary. We'll walk through your real BEC exposure, the controls you have versus the ones you need, and what it takes to close the gap before the wire goes out. --- # Cyber Insurance Requirements 2026: What Your Policy Actually Demands URL: https://etoptechnology.com/blog/cyber-insurance-requirements-2026/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-03-03 **Short answer:** in 2026, most cyber insurers expect a small business to have multi-factor authentication, endpoint detection and response (EDR) on every device, immutable backups with documented restore tests, controlled admin access, timely patching, security awareness training and a written incident response plan. You need to be able to prove those controls were in place at the time of an incident. If you can't, a claim can be denied. Here's something that keeps me up at night on behalf of our clients. Businesses paying $15,000 to $50,000 a year for cyber insurance, thinking they're covered, and then finding out after an incident that their claim is denied because they weren't actually meeting the policy requirements. This is not theoretical. It's happening right now. Cyber insurers got burned badly in 2020 and 2021 paying out massive ransomware claims. They responded by getting extremely specific about what security controls you need to have in place. And in 2026, they're enforcing those requirements aggressively. ## What Changed with Cyber Insurance Five years ago, getting cyber insurance was like getting any other business policy. Fill out an application, answer some basic questions, write a check. The application might ask "Do you have antivirus?" and you'd check yes and move on. Those days are gone. Today's cyber insurance applications look more like security audits. They're 10 to 15 pages long, and they ask very specific technical questions. And here's the critical part: your answers become warranties. If you say you have MFA on all remote access and you don't, that's not an oversight. That's grounds to deny your claim. Insurers have hired cybersecurity experts. When you file a claim, they don't just take your word for it. They bring in forensic investigators who will check exactly what controls were in place at the time of the incident. If reality doesn't match what you attested to on your application, you're on your own. ## What Security Controls Do You Need to Qualify for Cyber Insurance? While every insurer is slightly different, here's what nearly all of them are requiring this year. ### Multi-Factor Authentication (MFA) This is the number one item. Every major cyber insurer requires MFA on: - All remote access (VPN, remote desktop, cloud applications) - All email access - All privileged/administrative accounts - Any system accessible from the internet Note what they're saying here. Not "we recommend MFA." Not "MFA on some systems." They want MFA on all remote access and all admin accounts. If your domain admin account doesn't require MFA, you have a gap that could sink a claim. This isn't theoretical. In 2022, Travelers went to court to rescind a policy entirely after a policyholder attested to MFA on its application but didn't actually have it everywhere — the now-well-known [Travelers v. International Control Services case](https://www.insurancejournal.com/news/national/2022/08/30/682564.htm). The pattern is simple: you attest to "MFA on all remote access points," an attacker comes in through the one system that didn't have it, and the application you signed becomes the insurer's exhibit A. ### Endpoint Detection and Response (EDR) Traditional antivirus is no longer sufficient for most policies. Insurers are specifically asking whether you have [EDR](/blog/what-is-edr/) deployed across all endpoints and servers. Some are even asking which EDR product you use, because they know certain products are more effective than others. EDR requirements typically include: - Deployed on all workstations and servers - Managed by a qualified team (not just installed and ignored) - Connected to a monitoring service or SOC (Security Operations Center) - Capable of automated isolation and response If your "endpoint protection" is Windows Defender or an outdated Norton subscription, that will not satisfy a 2026 cyber insurance policy. ### Backup and Recovery Insurers know that good backups are the difference between a business surviving ransomware and a business paying the ransom (or closing). Requirements typically include: - **Regular backups** of all critical systems and data (daily minimum) - **Offsite or cloud backups** that are physically separate from your network - **Immutable backups** that can't be modified or deleted by ransomware (this is newer and increasingly required) - **Tested recovery** with documented proof that you've actually restored from backup successfully That last point trips up a lot of companies. You have backups running. Great. Have you ever tested a full restore? Can you prove it? Insurers want documentation showing regular recovery testing, not just backup job success logs. ### Privileged Access Management Insurers are asking how you control administrative access. They want to see: - Separate admin accounts (not using your regular email account as a domain admin) - Limited number of people with elevated access - Regular access reviews - No shared credentials or generic admin accounts ### Patch Management You need to demonstrate a consistent process for applying security patches. Most policies require: - Critical and high-severity patches applied within 14 to 30 days - A documented patch management policy - Evidence of patch compliance across your environment ### Security Awareness Training Nearly all policies now require employee security awareness training. This means: - Regular training (at least annually, quarterly preferred) - Phishing simulation testing - Documented completion records ### Incident Response Plan This is the one most small businesses don't have, and it's a requirement. You need a written incident response plan that covers: - Who to call and in what order - How to contain an active breach - Communication protocols (internal and external) - Regulatory notification requirements - Your insurance carrier's notification requirements (there's usually a specific hotline and a time limit) We have a full breakdown of how to build one in our [incident response planning guide](/blog/incident-response-planning/). ## Why Do Cyber Insurance Claims Get Denied? These are the three denial patterns that come up again and again in coverage disputes. Picture each one happening to your business, because each one starts with an application that looked fine on the day it was signed. **Pattern 1: The MFA Gap.** A company has MFA on email but not on their VPN. Attackers come in through the VPN, deploy ransomware, and encrypt everything. The insurer reviews the application where the company attested to "MFA on all remote access" — and the gap between the attestation and the reality becomes the basis for denial. This is exactly the fact pattern from the Travelers case above. **Pattern 2: The Unmanaged EDR.** A business purchases an EDR product but never configures it properly, and no one monitors the alerts. The EDR detects the early stages of the attack and dutifully generates alerts that nobody sees. The insurer argues that EDR deployed but unmonitored doesn't satisfy a policy requiring "managed endpoint detection and response." **Pattern 3: The Untested Backup.** The backups exist on paper. When ransomware hits and it's time to restore, the backup jobs turn out to have been failing quietly for months. The insurer's forensic team finds this during their investigation, and the payout shrinks — "failure to maintain adequate backup systems as attested." ## What You Should Do Right Now ### Step 1: Read Your Actual Policy Not the summary. Not the certificate. The actual policy document with the security requirements and warranties. If you don't have it, call your broker and get it. Specifically look for the "Security Controls" or "Minimum Requirements" section. ### Step 2: Do a Gap Analysis Take every requirement in your policy and honestly assess whether you meet it. Not "we're working on it." Not "we plan to." Do you meet it today, right now, in a way that would survive a forensic investigation? Common gaps we find: - MFA not enforced on all admin accounts - EDR not deployed on servers (only on workstations) - Backups not immutable or not tested - No written incident response plan - Security training done once and never repeated - Patches more than 30 days behind ### Step 3: Fix the Gaps Before Renewal If you find gaps, fix them before your policy renews. If you're mid-policy and discover you attested to something you're not actually doing, get it in place immediately. The worst outcome is filing a claim and discovering the gap during the investigation. ### Step 4: Document Everything Insurers want proof. Keep records of: - MFA enrollment status for all users - EDR deployment reports showing coverage across all endpoints - Backup job logs and recovery test results - Patch compliance reports - Training completion certificates - Your incident response plan with a revision date ### Step 5: Partner with an IT Provider Who Understands Insurance Requirements This is where a good [managed IT services](/managed-it-services/) partner makes a massive difference. We align our security stack and documentation to what insurers require because we've been through enough claim investigations to know exactly what they look for. The goal is simple: if you ever have to file a claim, the evidence that the controls were in place is already sitting there, ready to hand over. ## The Cost of Getting This Wrong Let me put some numbers on it. A mid-size business might pay $20,000 a year for cyber insurance. A ransomware incident could easily cost $500,000 to $1 million in ransom, recovery, lost revenue, legal fees, and regulatory fines. If your claim gets denied because you weren't meeting the policy requirements, you just spent $20,000 a year on a policy that gave you nothing when you needed it most. That's not insurance. That's an expensive piece of paper. The security controls insurers require aren't arbitrary. They're the same controls that actually prevent and limit breaches. Meeting your insurance requirements and having genuinely good [cybersecurity](/cybersecurity-services-inland-empire/) aren't two different things. They're the same thing. ## Get Ahead of This If you're not sure whether your current security posture meets your cyber insurance requirements, we can help. Our [security assessment](/contact/) maps directly to the controls insurers require and shows you exactly where you stand. No guessing, no surprises. [Book an intro call today](/contact/). Your future self, and your insurance carrier, will thank you. --- # WISP for California Businesses: Who Needs One and How to Build It URL: https://etoptechnology.com/blog/wisp-california-businesses/ Type: Article Category: Compliance Author: William “BJ” Pote Published: 2026-03-01 **Short answer:** a WISP (Written Information Security Program) is the written document that says how your business protects personal data, who is responsible, and what happens when something goes wrong. In California, most businesses that hold personal information should have one. Tax preparers are required to by the IRS, FTC-covered businesses by the Safeguards Rule, and everyone else needs one to show the "reasonable security" that California law expects. To create one, start with a risk assessment, then document your safeguards and review it every year. Here's something most California business owners don't know: if your company collects personal information from customers, employees, or clients, you almost certainly need a WISP. That's a Written Information Security Program. It's a document that spells out exactly how your business protects sensitive data, who's responsible for what, and what happens when something goes wrong. Most businesses don't have one. The ones that do often have a template they downloaded from the internet five years ago and never updated. Neither of those is a good situation, and both can cost you real money when something goes sideways. ## What Is a WISP? A WISP is a comprehensive, written document that describes your organization's information security practices. It covers the administrative, technical, and physical safeguards you have in place to protect personal information. Think of it as the master plan for how your business handles data security. It's not a one-page policy you stick in a binder. A proper WISP includes your security policies, your procedures for implementing them, the roles and responsibilities of your team, how you assess and manage risk, and how you respond to incidents. It's a living document that should be reviewed and updated at least annually. ## Does My Business Need a WISP? The short answer is: more businesses than you think. **California Consumer Privacy Act (CCPA/CPRA).** If your business meets the CCPA thresholds, you're expected to implement "reasonable security procedures and practices." While the CCPA doesn't explicitly use the word "WISP," courts and regulators interpret this to mean you need documented security policies. If you get breached and you don't have a written program, good luck arguing you had "reasonable" security. **FTC Safeguards Rule.** If you're a financial institution (which the FTC defines very broadly to include tax preparers, auto dealers arranging financing, insurance agencies, and more), you need a comprehensive information security program. In writing. We go deeper on this in our post on [cybersecurity for accounting firms](/blog/accounting-firm-cybersecurity/), since CPA firms are squarely in the crosshairs. **HIPAA.** Healthcare providers and their business associates need documented security policies as part of HIPAA compliance. A WISP covers the administrative safeguard requirements. **IRS Publications 4557 and 5708.** If you're a tax preparer, the IRS explicitly requires a WISP. Publication 4557, Safeguarding Taxpayer Data, lays out the requirement, and Publication 5708 provides the IRS's own WISP template. The IRS has made it clear that firms without one are out of compliance. **Industry contracts.** Even if no law explicitly requires you to have a WISP, your clients might. Procurement teams increasingly ask vendors to produce a written security program during due diligence, and contract bids are won and lost on whether you can hand one over. That's happening more and more. **California Civil Code Section 1798.81.5.** This is the one most people miss. It requires any business that owns, licenses, or maintains personal information about California residents to "implement and maintain reasonable security procedures and practices." Regulators and plaintiff attorneys are increasingly interpreting "reasonable" to require written documentation. The bottom line: if your California business handles personal data of any kind, names, Social Security numbers, financial account information, health information, email addresses with passwords, you should have a WISP. ## What Goes Into a WISP? A solid WISP isn't vague. It's specific to your business. Here's what it should cover: ### Purpose and Scope Define what the WISP covers, what types of data you're protecting, and which systems and people are in scope. A dental office with two locations has a very different scope than a regional accounting firm with remote employees. ### Designated Security Coordinator Someone has to own it. Name a specific person (or role) responsible for implementing and maintaining the program. For small businesses, this is often the owner or office manager. For businesses with a [managed IT partner](/managed-it-services/), it can be your MSP's designated contact, but internal accountability still matters. ### Risk Assessment Document the threats and vulnerabilities your business faces. What data do you collect? Where is it stored? Who has access? What could go wrong? This section should be updated at least annually or whenever your business makes significant changes to its technology or operations. ### Administrative Safeguards These are the people and process controls: - Employee background checks for staff with access to sensitive data - Security awareness training (regular, not one-time) - Acceptable use policies for company devices and systems - Procedures for onboarding and offboarding employees (especially revoking access immediately when someone leaves) - Vendor management policies for third parties that handle your data ### Technical Safeguards This is the IT side of the house: - Access controls (role-based, least privilege, unique user accounts) - Multi-factor authentication on all systems containing personal data - Encryption of data at rest and in transit - Firewalls, endpoint protection, and network monitoring - Regular patching and vulnerability management - Secure backup and disaster recovery procedures - Audit logging of access to sensitive data ### Physical Safeguards Don't overlook the basics: - Locked server rooms or closets - Clean desk policies - Secure disposal of paper records and old hard drives - Visitor access controls for areas where sensitive data is accessible ### Incident Response Plan What happens when you discover a breach or security incident? (We have a full guide on [how to build an incident response plan](/blog/incident-response-planning/) if you want the detailed version.) Your WISP needs to include: - How incidents are reported internally - Who makes decisions about containment and response - How you assess the scope and impact - Notification procedures (California law requires breach notification to affected individuals and, in some cases, the Attorney General) - Post-incident review to prevent recurrence ### Data Retention and Disposal How long do you keep personal data? How do you securely destroy it when you're done? This is an area where businesses get tripped up because they never actually delete anything. That data you're hoarding is a liability if you don't have a legitimate business reason to keep it. ### Review and Update Schedule Your WISP should specify how often it's reviewed (at minimum annually) and who's responsible for updates. Document every review, even if nothing changes. ## How Do I Create a Written Information Security Program? Here's the practical, step-by-step approach we use with clients: **Step 1: Inventory your data.** Before you can protect it, you need to know what you have. Map out what personal information you collect, where it lives, how it flows through your systems, and who has access. This is the foundation. **Step 2: Assess your current security posture.** Look at what controls you already have in place. Most businesses have some security measures. They're just not documented. A [cybersecurity assessment](/cybersecurity-services-inland-empire/) gives you a clear picture of what's working and what's missing. **Step 3: Identify the gaps.** Compare your current state to what a complete WISP requires. This gap analysis tells you exactly what you need to build, implement, or document. **Step 4: Write the policies and procedures.** This is the actual document. Keep it specific to your business. Generic templates are a starting point, not a finish line. Your WISP should reflect how your business actually operates, not how a hypothetical business in a different industry operates. **Step 5: Implement the technical controls.** If your gap analysis reveals missing safeguards, like MFA or encryption, implement them before you finalize the WISP. The document should describe what you actually do, not what you plan to do someday. **Step 6: Train your team.** A WISP that lives in a drawer is useless. Every employee who handles personal data needs to understand their role in the program. Annual training at minimum, with refreshers when policies change. **Step 7: Review and update annually.** Set a calendar reminder. Your business changes, your technology changes, the threats you face change. Your WISP needs to keep pace. ## Why This Matters for Your Business When a breach happens and you file a cyber insurance claim, one of the first things the carrier asks for is your written security program. A business with a current WISP, documented policies, and evidence of implementation moves through the claims process smoothly. A business without one faces pushback: claims delayed for months, and significantly higher legal exposure because it can't demonstrate "reasonable security." Ask any insurance broker what the claims conversation looks like for a business that can't produce a written program. It isn't pretty. A WISP is your proof that you take data protection seriously. It's your defense in a lawsuit. It's what your insurance company wants to see. And it's what increasingly sophisticated clients and partners are asking for before they'll do business with you. ## What Should You Do Next? If you don't have a WISP, start building one. If you have one but it's stale or generic, update it to reflect your actual environment. If you want help, we specialize in building [compliance programs](/compliance-it-services/) for California businesses. We'll assess your environment, identify the gaps, help you build the technical controls, and produce a WISP that's thorough, practical, and specific to your business. Not a template. A real program that protects you. Reach out for a compliance assessment. We'll tell you where you stand and what it takes to get where you need to be. --- # Why Your Accounting Firm Needs More Than Antivirus in 2026 URL: https://etoptechnology.com/blog/accounting-firm-cybersecurity/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-02-28 There's a line that comes up in some version of almost every first conversation with an accounting firm: "We've been doing this for 20 years and we've never had a cyber incident. I think we're fine." The problem with that logic is that every firm that *has* been hit said the same thing right up until the day it happened. And the timing is rarely kind — picture three compromised staff mailboxes in March, and six weeks of incident response stacked on top of filing deadlines. If your firm is relying on antivirus software and the assumption that it won't happen to you, you're not fine. You're unexamined. ## The FTC Safeguards Rule Changed Everything If you're a CPA firm, EA (Enrolled Agent) practice, bookkeeping service, or any business that handles consumer financial data, the FTC Safeguards Rule applies to you. Full stop. This isn't optional guidance. It's federal law, and the FTC has been enforcing it with increasing aggression since the updated requirements took effect in June 2023. Here's what the Safeguards Rule actually requires: - **A designated Qualified Individual** responsible for your information security program (this can be outsourced, but someone has to own it) - **A written risk assessment** that identifies threats to customer information - **Access controls** limiting who can see what data based on their role - **Encryption** of customer data both at rest and in transit - **Multi-factor authentication (MFA)** for anyone accessing customer information - **Continuous monitoring** or annual penetration testing of your systems - **An incident response plan** that's documented and tested - **Security awareness training** for all employees - **Vendor management** ensuring your third-party service providers also protect customer data Read that list again. Now ask yourself how many of those boxes your firm actually checks. The Safeguards Rule essentially requires a Written Information Security Program - we cover [WISP requirements in detail](/blog/wisp-california-businesses/) if you want the full breakdown. If the answer to most of these is "a few," you've got work to do. And the penalty for non-compliance isn't just a fine. It's up to $100,000 per violation, personal liability for firm leadership, and the kind of public enforcement action that destroys client trust overnight. Antivirus handles one narrow threat vector. The Safeguards Rule covers your entire security posture. They're not even in the same conversation. ## Tax Season Is Open Season for Hackers Attackers aren't stupid. They know that accounting firms handle the most sensitive financial data that exists: Social Security numbers, bank account information, income details, tax returns, investment portfolios. And they know exactly when that data is flowing at the highest volume. Tax season is the Super Bowl for cybercriminals targeting accounting firms. Here's what the attacks look like from January through April: **IRS impersonation phishing.** Your staff gets emails that look exactly like IRS correspondence. New e-file requirements, account verification requests, "urgent" notices about client EINs. These emails carry credential-harvesting links or malware payloads, and they're designed to exploit the urgency and high volume that tax season creates. **Client impersonation.** An attacker compromises a client's email account and sends your firm a message: "Here are my updated W-2s and bank information for this year's return." The attachment is malware. Or worse, the bank information is real but redirects the client's refund to the attacker. Your staff processes hundreds of similar requests during tax season. One mistake is all it takes. **Ransomware timed for maximum impact.** Imagine getting locked out of your entire system on March 28th. Every client file encrypted. Every tax return in progress, gone. The attackers know you can't afford to wait. They know the filing deadline creates leverage. They set their ransom accordingly. **Data exfiltration.** Some attacks aren't about locking you out. They're about quietly copying your data and selling it. Client tax returns contain everything an identity thief needs. A single compromised firm can expose thousands of individuals. You might not even know it happened for months. This isn't hypothetical. The IRS and state tax agencies report a significant increase in attacks against tax professionals every single year. The IRS Security Summit has an entire program dedicated to this problem because it's that widespread. ## What a Breach Means for Your Firm's Reputation Let's set aside the technical and regulatory consequences for a moment and talk about what actually kills accounting firms after a breach: lost trust. Your clients give you their most sensitive financial information. They trust you with data they wouldn't share with their closest friends. When that trust is violated, even if it's not your fault in any direct sense, the relationship is over for a significant percentage of your client base. Here's what the aftermath typically looks like: **Mandatory notification.** You have to tell every affected client that their data was compromised. Depending on your state, that notification has to include specific details about what was exposed and what you're doing about it. In California, that means complying with the CCPA (California Consumer Privacy Act) notification requirements on top of federal obligations. **Client exodus.** Some meaningful share of your clients will leave after a breach — they trusted you with data they wouldn't share with their closest friends. Run the math on your own book: if even one client in five walks, a firm billing $2 million annually loses $400,000 in recurring revenue. And those clients are going to your competitors and telling them why they left. **Professional liability.** Your E&O (Errors and Omissions) insurance may or may not cover a cyber incident. Many policies have specific exclusions for cybersecurity failures, especially if you can't demonstrate you had reasonable safeguards in place. [Cyber insurance requirements have gotten much stricter](/blog/cyber-insurance-requirements-2026/) - and after a claim, plan for a painful premium increase at renewal, assuming you can get coverage at all. **Regulatory scrutiny.** Beyond the FTC, your state board of accountancy may take an interest. If the breach resulted from negligence in protecting client data, you could face professional discipline up to and including license revocation. A firm can survive a bad tax season. A firm can survive losing a key partner. Surviving a major data breach that hits the local news and triggers an FTC investigation? That's a much harder road. ## What "More Than Antivirus" Actually Looks Like So what does a modern cybersecurity posture look like for an accounting firm? Here's the stack, in plain English: **Endpoint Detection and Response (EDR).** This replaces traditional antivirus. Instead of just matching known virus signatures, EDR watches behavior on every device. If a program starts encrypting files or a process starts sending data to a suspicious server, EDR catches it and stops it in real time. This is the difference between catching a known threat and catching a new one. **Email security.** A dedicated email filtering solution that goes beyond what Microsoft or Google provides by default. Advanced phishing detection, attachment sandboxing (opening suspicious files in a safe environment to see what they do), and impersonation protection that flags emails pretending to be from partners or clients. **MFA on everything.** Every system that touches client data. Email, practice management software, cloud storage, tax preparation platforms, client portals. No exceptions. SMS-based MFA is better than nothing, but app-based or hardware key MFA is significantly more secure. **Encrypted file sharing.** Stop emailing tax returns as PDF attachments. Use a secure client portal with encryption, access controls, and audit logging. Your clients need a secure way to send you documents and receive completed returns. If you're still using email for this, you're violating the Safeguards Rule. **Security awareness training.** Monthly or quarterly phishing simulations and training modules. Your team is your first line of defense and your biggest vulnerability. Train them like it matters, because it does. **24/7 monitoring.** Someone or something needs to be watching your systems around the clock. Attacks don't wait for business hours. A SOC (Security Operations Center) service, either in-house or outsourced, monitors your environment and responds to threats in real time. **Documented incident response plan.** Not a template you downloaded. An actual plan specific to your firm that identifies who does what when something goes wrong. Tested annually through a tabletop exercise at minimum. ## What Should You Do Right Now? If you've read this far and you're thinking "we need to fix this," here's your prioritized action list: 1. **Get a Safeguards Rule gap assessment.** Find out where you stand against the actual FTC requirements. Not a self-assessment. A real evaluation by someone who knows the rule and knows accounting firm workflows. 2. **Deploy EDR and retire traditional antivirus.** This is the single biggest security upgrade most firms can make. It's the difference between a security guard checking IDs at the door and a security team monitoring cameras throughout the building. 3. **Implement MFA across the board.** Start with email and practice management software. Then expand to every system that accesses client data. Yes, it adds a step. No, your team won't quit over it. They'll adjust in a week. 4. **Set up a secure client portal.** Stop the email attachment exchange. Give clients a safe, encrypted way to send and receive documents. Most clients will actually appreciate the professionalism. 5. **Start phishing simulations.** You'll be shocked at the click rates in the first round. That's normal. The point is to improve over time and build the habit of skepticism. 6. **Get your incident response plan written and tested.** If an attack happened tomorrow morning, does everyone in your firm know their role? If not, that's the gap that turns a minor incident into a catastrophe. We help Southern California businesses navigate exactly these requirements through our [compliance practice](/compliance-it-services/). The firms that take this seriously aren't just checking a compliance box. They're building a competitive advantage, because clients are starting to ask about data security before they sign engagement letters, and the firms that can answer confidently win the business. The FTC Safeguards Rule made cybersecurity a legal obligation for your firm. But even without the regulation, the threat landscape alone should be enough to move you past antivirus and good intentions. The question isn't whether your firm will be targeted. It's whether you'll be ready when it happens. If you want to know where your firm stands, we'll do a [no-obligation assessment of your security posture](/managed-it-services/) against the Safeguards Rule requirements. Straightforward, no jargon, just a clear picture of your gaps and what it takes to close them. --- # IT Provider Evaluation Guide: 20 Questions Every Organization Should Ask URL: https://etoptechnology.com/blog/it-provider-evaluation-guide/ Type: Article Category: White Paper Author: William “BJ” Pote Published: 2026-02-28 Switching IT providers is a significant decision. The monthly rate matters, but it's often the least important number. What matters more is what's included, what's excluded, and what costs show up later that weren't in the original quote. This guide gives you 20 questions to ask any IT provider you're evaluating. Each question includes context on why it matters, what a strong answer looks like, and what should concern you. We encourage you to send these questions to every vendor you're considering and compare the answers side by side. --- ## Section 1: Pricing & Billing Model The monthly number on a proposal is a starting point, not the finish line. The real question is: what does that number actually cover? ### Q1. Is your monthly rate per user, per device, or per asset? What happens to my bill when I add a laptop, a monitor, or a phone? **Why this matters:** Per-device billing means every new piece of hardware increases your monthly cost. If your organization grows or refreshes equipment, your bill grows with it, even if no additional support is needed. **What a strong answer sounds like:** Per-user or governance-based pricing that doesn't penalize you for adding devices. Your cost should scale with your team, not your hardware inventory. **Red flag:** If the answer is per-device or per-asset, ask for a projection of what your bill looks like at different device counts as you grow. The difference can be significant. ### Q2. What is NOT included in the monthly rate? Specifically: Are there per-incident charges, after-hours fees, onsite visit fees, or project charges for routine tasks like laptop setups or user changes? **Why this matters:** Many providers advertise a low monthly rate but bill separately for tasks you assume are included. Laptop swaps, new user setups, and onsite visits are common areas where costs hide. **What a strong answer sounds like:** Unlimited remote and onsite support included in the monthly rate. Routine tasks like new hires, offboarding, and laptop swaps (using existing inventory) are part of the service, not billable projects. If a net-new device needs to be purchased, the hardware cost is separate, but the labor to configure and deploy it should be included. **Red flag:** If "laptop swap" or "new user setup" appears on a separate project quote with labor charges, you're paying twice: once for the monthly service, and again every time you need it. ### Q3. Is Microsoft 365 licensing included in your monthly rate, or billed separately? At what price per user? **Why this matters:** Microsoft 365 is the backbone of most modern IT environments. If licensing isn't included or standardized, you end up with fragmented access, staff purchasing their own licenses, and no central visibility. **What a strong answer sounds like:** Microsoft 365 Business Premium included at a transparent per-user cost. Nonprofit organizations should be paying dramatically less than commercial rates ($5-10/user vs. $22/user). **Red flag:** If the provider doesn't manage licensing centrally, or if staff are buying their own Microsoft or Adobe subscriptions, that's a visibility and compliance gap. ### Q4. Does the monthly rate include all your locations, or is multi-site support an add-on? **Why this matters:** Organizations with more than one office often discover that the second location is billed as a separate line item, sometimes at a significant premium. **What a strong answer sounds like:** All locations are covered under a single monthly rate. Support quality and response time should be consistent regardless of which office calls. **Red flag:** If one site is a separate add-on, ask what happens if you open a third. Per-location billing compounds quickly. ### Q5. What does your pricing look like on a 3-year effective cost basis? Include all recurring fees, anticipated hardware events, license renewals, and project work. **Why this matters:** A 3-year view exposes the true cost of ownership. Providers with low monthly rates often have higher total costs when server replacements, network license renewals, and project fees are included. **What a strong answer sounds like:** A transparent 3-year total that includes all monthly fees, project costs, hardware, licensing, and renewals. No surprises at year 2 or 3. **Red flag:** If the provider can't or won't give you a 3-year number, keep asking. The point is to surface the costs that don't appear in month one — server replacements, license renewals, project fees — so you can compare proposals on total cost, not the first invoice. --- ## Section 2: Infrastructure & Architecture How your IT environment is designed determines what you'll pay to maintain it for years to come. ### Q6. Does your proposed solution require an on-premises file server? If so, who pays for the replacement when it reaches end of life? **Why this matters:** File servers cost $15,000-$30,000 to replace and create VPN dependency for file access. They also require ongoing backup, patching, and monitoring. A server-dependent model guarantees a future capital event. **What a strong answer sounds like:** No on-premises file server required. Files live in SharePoint and OneDrive, accessible from anywhere without VPN. Server decommissioning should be part of the transition plan. **Red flag:** If the provider's model still depends on a server, ask who pays for the next one. If the answer is you, ask how that's reflected in the proposal. ### Q7. Does daily work require a VPN connection? What happens if the VPN goes down? **Why this matters:** VPN-dependent environments create single points of failure. When the VPN drops, staff can't access files, and leadership loses productivity. This is especially problematic for organizations with remote or multi-site staff. **What a strong answer sounds like:** No VPN required for daily workflows. Files, email, and applications are cloud-hosted and accessible from any device with an internet connection. VPN is retained only for rare edge cases, if at all. **Red flag:** If the answer is "yes, VPN is required for file access," that means every VPN outage is a productivity outage for your entire team. ### Q8. What networking hardware are you proposing, and does it require recurring license renewals? What do those renewals cost and when do they expire? **Why this matters:** Some enterprise networking vendors require license renewals every 1-5 years. These renewals can cost $5,000-$10,000+ and are easy to miss in a proposal because they don't show up on month one. **What a strong answer sounds like:** Networking hardware with zero recurring license fees. Equipment should be business-class but shouldn't come with renewal cliffs that create budget surprises. **Red flag:** If the proposal includes hardware with 3- or 5-year license subscriptions, add up what those renewals cost over 10 years and compare. ### Q9. What is your approach to endpoint management? If a laptop fails tomorrow, what happens and how long does it take? **Why this matters:** In legacy environments, a laptop failure can mean days of downtime while the device is rebuilt and data is restored. Modern endpoint management makes devices replaceable -- a user can be back to work in under an hour. **What a strong answer sounds like:** Endpoints are Entra ID-joined with automatic data backup (Known Folder Move to OneDrive). A failed device is swapped, the user logs in, and their data and applications restore automatically. The labor to configure and deploy is included. If a replacement device needs to be purchased, that hardware cost is separate, but the turnaround should be measured in hours, not days. **Red flag:** If the answer involves "we'd need to image a new machine and restore from backup" or if a laptop swap comes with a project quote for labor, the endpoint management model isn't modern. --- ## Section 3: Security & Compliance ### Q10. What security tools are included in the monthly rate? Is antivirus, email security, malware detection, and endpoint protection included or billed separately? **Why this matters:** Security is non-negotiable, but it's also an area where providers layer on add-on costs. You need to know what's included so you can compare apples to apples. **What a strong answer sounds like:** A full security stack included in the monthly rate: managed antivirus, email security, 24/7 malware detection, endpoint protection (Microsoft Defender for Business), and managed firewall. No surprise add-ons. **Red flag:** If security is quoted as a separate line item or "available as an add-on," your base monthly rate doesn't actually protect you. ### Q11. Do you enforce multi-factor authentication (MFA) for all users? Is this configured as part of onboarding or left to us? **Why this matters:** MFA is the single most effective control against account compromise. It should be non-negotiable and enforced from day one, not offered as an optional add-on. **What a strong answer sounds like:** MFA is enforced for all users through Entra ID as a baseline security policy. It's configured during onboarding and not optional. **Red flag:** If MFA is described as "available if you want it" or "we can set it up later," that's a provider who doesn't own your security posture. ### Q12. How do you handle software license compliance? Can you tell me right now exactly what Microsoft and Adobe licenses are deployed across our environment? **Why this matters:** License chaos creates compliance risk and cost leakage. Staff buying their own licenses, unlicensed copies floating around, and no central visibility are all signs of a provider that isn't managing the full picture. **What a strong answer sounds like:** Full software license compliance tracking included. Every license is centrally managed, and we can show you exactly what's deployed, to whom, and whether it's compliant -- at any time. **Red flag:** If the provider says they "don't manage licensing" or can't tell you where your Adobe licenses are, you're carrying compliance risk they're not addressing. --- ## Section 4: Support & Responsiveness ### Q13. What are your response time commitments? Is there a published SLA (service level agreement), and what are the consequences if you miss it? **Why this matters:** Response time promises are only meaningful if they're documented and enforceable. Ask for the actual SLA -- not a verbal promise. **What a strong answer sounds like:** Published SLAs with defined response and resolution targets by severity level. Regular reporting against those targets so you can see whether they're being met. **Red flag:** If the answer is "we respond as quickly as we can" without a written SLA, there's no accountability. ### Q14. Is onsite support included, or does every onsite visit generate a separate invoice? **Why this matters:** Some providers include remote support but charge for every onsite visit. If your organization has multiple locations and regular hands-on needs, per-visit billing adds up fast. **What a strong answer sounds like:** Onsite support is included in the monthly rate for all locations within a reasonable use model. No trip charges, no per-visit fees for standard support needs. **Red flag:** If onsite visits are billed hourly or per-trip, ask what happens during a week where you need three visits across two locations. Per-visit billing adds up fast for multi-site organizations. ### Q15. What does your onboarding process look like for new hires? How quickly is a new employee fully productive? **Why this matters:** New hire onboarding is one of the most common IT tasks and one of the most revealing. It shows whether the provider has built systems for efficiency or is still doing everything manually. **What a strong answer sounds like:** New hires receive a preconfigured device. They log in, and their applications, email, files, and security policies deploy automatically. Productive on day one. The setup and configuration labor is included in the monthly service. If a new device needs to be purchased, that's a separate hardware cost, but it shouldn't come with a labor project quote on top. **Red flag:** If new hire setup takes days, requires billable project hours for configuration, or involves manual imaging, the provider hasn't invested in automation. --- ## Section 5: Strategic Partnership ### Q16. Do you provide regular business reviews (quarterly or biannually)? What do those include? **Why this matters:** A provider who only talks to you when something breaks is a vendor, not a partner. Regular business reviews demonstrate a commitment to proactive planning and strategic alignment. **What a strong answer sounds like:** Quarterly or biannual strategic reviews that cover system health, security posture, budget planning, hardware lifecycle, and recommendations. These are included in the service, not billed as consulting hours. **Red flag:** If the provider doesn't offer regular reviews, or if they're only available as a paid add-on, your IT strategy is on autopilot. ### Q17. Do you provide hardware lifecycle planning? How do you handle equipment that needs replacement -- is that a capital expense we budget for, or is it managed within the service? **Why this matters:** Aging hardware is one of the biggest sources of unplanned IT cost. A provider who tracks hardware age and plans replacements proactively prevents budget surprises. **What a strong answer sounds like:** Hardware lifecycle planning and tracking included. The provider monitors the age and condition of all managed devices, provides advance notice when replacements are needed, and helps you budget for them. Hardware procurement is typically a separate cost, but the planning, coordination, and deployment labor should be part of the service. **Red flag:** If the provider doesn't track hardware age, can't tell you which devices are approaching end of life, or if every replacement is a surprise quote with no advance warning, you'll be reacting instead of planning. ### Q18. Who is our primary point of contact? Do we have a dedicated account manager, or are we calling a general helpdesk? **Why this matters:** Knowing who to call and having someone who understands your environment makes a material difference in support quality. A dedicated relationship means less time re-explaining your setup on every call. **What a strong answer sounds like:** A named account manager who knows your environment, your staff, and your priorities. Escalation paths are clear and documented. **Red flag:** If the answer is "you call the helpdesk and whoever is available takes it," there's no continuity and no one owns your experience. --- ## Section 6: Transition & Risk ### Q19. What does your transition/onboarding project include? Is it a phased approach or a single cutover? What's the timeline? **Why this matters:** Transitions that try to do everything at once create unnecessary risk. A phased approach with clear milestones reduces disruption and gives staff time to adapt. **What a strong answer sounds like:** A phased project plan with defined scopes, timelines, and outcomes for each phase. Typically includes licensing, cloud migration, endpoint standardization, network modernization, and stabilization -- each as a distinct phase. **Red flag:** If the answer is "we install our agents and you're good to go," ask what the migration strategy is. A good transition leaves your environment better than it found it — licensing cleaned up, endpoints standardized, the underlying problems actually solved. ### Q20. If we decide to leave your service in the future, what happens? Do you own our data, our domain, our licenses? **Why this matters:** Some providers hold customer domains, Microsoft tenants, or licensing agreements in their own accounts. This creates lock-in and makes transitions painful and expensive. **What a strong answer sounds like:** You own everything: your domain, your Microsoft tenant, your data. If you leave, we provide a complete handoff with documentation. No hostage situations. **Red flag:** If the provider registers your domain in their name, holds your Microsoft licenses in their CSP account (Cloud Solution Provider — the Microsoft program your licenses live in) without transfer provisions, or doesn't mention exit terms at all -- that's a lock-in risk. --- ## Evaluation Scoring Matrix Use this matrix to compare providers side by side. Score each area from 1 (weak/missing) to 5 (strong/fully addressed). | Evaluation Category | Provider A | Provider B | Provider C | |---|---|---|---| | All-inclusive pricing (no per-device/per-incident) | | | | | Microsoft 365 licensing included & standardized | | | | | Multi-site support included in base rate | | | | | 3-year total cost transparency | | | | | No on-premises server dependency | | | | | No VPN required for daily work | | | | | Network hardware with zero renewal licensing | | | | | Modern endpoint management (auto-recovery) | | | | | Full security stack included | | | | | MFA enforced for all users | | | | | License compliance tracking | | | | | Published SLA with accountability | | | | | Onsite support included | | | | | Same-day new hire productivity | | | | | Regular strategic business reviews | | | | | Hardware lifecycle planning | | | | | Dedicated account manager | | | | | Phased transition plan | | | | | Data & domain ownership guaranteed | | | | | Clean exit provisions documented | | | | | **TOTAL SCORE** | **/100** | **/100** | **/100** | --- The best IT partner isn't the one with the lowest invoice. It's the one whose invoice is the only invoice. We welcome the opportunity to answer every one of these questions -- in writing, in person, or both. [Contact us](/contact/) to start the conversation. --- # State of Cybersecurity for Inland Empire Businesses (2026) URL: https://etoptechnology.com/blog/state-of-cybersecurity-inland-empire-2026/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-02-25 The Inland Empire is one of the fastest-growing business regions in the country. Logistics, healthcare, legal, manufacturing, professional services. The economic engine here is real, and it's accelerating. But growth brings attention, and not all of it is welcome. Cybercriminals don't just target Fortune 500 companies in major metros. They target opportunity. And a region full of growing mid-size businesses, many of which are still building out their security posture, represents a very large opportunity. I've spent over a decade protecting businesses in this region. Here's what the cybersecurity landscape looks like for Inland Empire businesses heading into 2026, and what you should be doing about it. ## The IE Threat Landscape Right Now ### Ransomware Is Not Slowing Down Nationally, ransomware attacks against small and mid-size businesses increased significantly through 2025 and show no signs of slowing in 2026. But the nature of these attacks has shifted in a way that hits businesses in our region particularly hard. Attackers used to go after big targets with big ransom demands. Now they've shifted to volume. They're hitting smaller businesses with ransom demands in the $50,000 to $500,000 range. Not big enough to make national news, but big enough to cripple a 40-person law firm or a medical practice or a logistics company in Ontario or Riverside. The reason is economics. A Fortune 500 company has a dedicated security team that makes attacks harder. A 75-person company in Rancho Cucamonga running basic antivirus and no EDR (endpoint detection and response) is a much easier payday. The attackers have done the math, and the math says go after the mid-market. The attacker playbook has changed too. The pattern now is to sit in the network for weeks before deploying the ransomware, exfiltrating data first — which adds a data breach notification requirement on top of the operational disruption. Picture a 55-employee firm working through that: recovery, legal fees, and lost revenue stack up past $300,000 fast. And this is squarely a mid-market problem — the [Verizon 2025 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) found ransomware involved in 88% of breaches at small and mid-size organizations, versus 39% at large ones. ### Business Email Compromise Is the Quiet Epidemic Ransomware gets the headlines, but BEC (business email compromise) is causing more aggregate financial damage to businesses in our region. BEC attacks are simple and devastatingly effective. An attacker compromises or impersonates a legitimate email account and tricks someone into wiring money, changing payment details, or sharing sensitive information. We see this constantly in the IE business community. A real estate transaction gets intercepted with fraudulent wire instructions. An accounts payable clerk receives what looks like a legitimate email from the CEO requesting an urgent wire transfer. A vendor's email gets compromised and sends fake invoices to all their clients. These attacks work because they exploit trust, not technology. Your firewall won't stop them. Your antivirus won't catch them. The only defenses are email security tools, MFA (multi-factor authentication) on every account, and training your people to verify requests through a second channel before sending money. ### Phishing Has Gone AI-Powered The phishing emails of 2026 are not the poorly written Nigerian prince scams of 2010. Attackers are using AI tools to generate highly convincing phishing emails that are grammatically perfect, contextually relevant, and personalized to the recipient. They reference real projects, real colleagues, and real business details scraped from LinkedIn and company websites. For IE businesses with public-facing operations, like law firms listing their attorneys online, medical practices with provider directories, or logistics companies with public contract announcements, attackers have rich material to craft targeted phishing campaigns. The more information you make available about your organization and your people, the more ammunition attackers have. We're seeing phishing success rates increase even among employees who have gone through security awareness training. The old advice of "look for typos and weird email addresses" is no longer sufficient. Modern phishing requires modern defenses: AI-powered email filtering, link analysis, and continuous training that adapts to current attack patterns. ## The Compliance Pressure Is Intensifying Regulatory requirements have tightened significantly, and this directly impacts IE businesses. ### FTC Safeguards Rule The expanded FTC Safeguards Rule now requires financial institutions, which includes a broad range of businesses beyond banks, to implement specific cybersecurity controls. Auto dealers, mortgage brokers, tax preparers, financial advisors, and many others fall under this rule. The Inland Empire has thousands of businesses in these categories. The requirements include encryption, access controls, MFA, continuous monitoring, incident response plans, and regular risk assessments. Non-compliance carries real penalties, and the FTC has been actively enforcing. ### HIPAA and Healthcare With the IE's growing healthcare sector, HIPAA compliance is a major factor. The Department of Health and Human Services has increased enforcement and raised penalty amounts. The proposed updates to the HIPAA Security Rule add more specific technical requirements around network segmentation, patch management, and vulnerability scanning. For the medical practices, dental offices, behavioral health providers, and healthcare-adjacent businesses throughout Riverside and San Bernardino counties, this means cybersecurity is no longer optional. It's a regulatory requirement with teeth. ### California Privacy Rights Act (CPRA) California's privacy regulations continue to evolve and add requirements for businesses handling consumer data. For IE businesses serving California consumers, which is most of them, this means data protection, breach notification procedures, and privacy impact assessments are compliance obligations, not just best practices. If you haven't already, you should also have a [Written Information Security Program (WISP)](/blog/wisp-california-businesses/) documenting how your business protects personal data. ## What IE Businesses Should Prioritize in 2026 I'm going to be direct about what I think matters most, based on what we're actually seeing in the field. Not theoretical best practices from a textbook, but the things that will make the biggest practical difference for a typical IE business. ### Priority 1: MFA on Everything If you do nothing else from this list, do this. Multi-factor authentication on every account that supports it. Email, VPN, cloud applications, admin consoles. Everything. MFA stops the majority of account compromise attacks dead. It's the single highest-impact security control you can implement, and for most cloud services, it's free. There is no excuse for not having MFA enabled across your organization in 2026. We still encounter businesses where the owner's Microsoft 365 account, with global admin privileges, has no MFA. That's a skeleton key sitting on the front porch. ### Priority 2: Replace Antivirus with EDR Traditional antivirus compares files against known threats. [EDR monitors behavior](/blog/what-is-edr/) and catches the fileless attacks, living-off-the-land techniques, and zero-days that antivirus misses. For a mid-size business, it's the most important endpoint security upgrade you can make. ### Priority 3: Email Security Beyond the Defaults Microsoft 365 and Google Workspace include basic email filtering. It's not enough. You need a dedicated email security layer that provides advanced phishing detection, link sandboxing, attachment scanning, and impersonation protection. Given that email is the primary attack vector for both ransomware and BEC, this is where your defense needs to be strongest. A dedicated [cybersecurity](/cybersecurity-services-inland-empire/) solution for email catches threats that the default filters miss. ### Priority 4: Backup and Recovery That Actually Works Having backups is not enough. Your backups need to be: - **Immutable** (so ransomware can't encrypt them) - **Offsite** (so a physical disaster doesn't take out your backups too) - **Tested regularly** (so you know recovery actually works) - **Fast enough** to meet your [business continuity](/business-continuity-disaster-recovery/) requirements We test backups for every client on a regular schedule. The number of businesses we've onboarded that had backup systems running but not actually producing recoverable backups is alarming. If you haven't tested a restore recently, you don't know if your backups work. Full stop. ### Priority 5: Security Awareness Training Your employees are your last line of defense. When a phishing email gets past the filters, and some inevitably will, the only thing standing between your business and a breach is whether your employee clicks the link or reports it. Security awareness training needs to be continuous, not annual. Monthly simulated phishing tests, short training modules on current threats, and a culture where reporting suspicious emails is encouraged, not punished. The goal isn't to shame people who click. It's to build the muscle memory to pause and verify. ## The Bottom Line for IE Businesses The Inland Empire is a great place to build a business. I've been doing it here for over a decade and I wouldn't want to be anywhere else. But the growth that makes this region exciting also makes it a target. The businesses that will thrive here are the ones that treat cybersecurity as a business function, not an IT expense. The ones that invest in prevention because they understand that the cost of a breach is orders of magnitude higher than the cost of protection - and because their [cyber insurance policies now demand it](/blog/cyber-insurance-requirements-2026/). The ones that work with partners who understand the local landscape and the specific challenges IE businesses face. If you want to know where your business stands, qualifying businesses receive our IT Risk Assessment complimentary — a clear picture of your current posture and specific recommendations for improvement. No sales pitch, just an honest evaluation from a team that's been protecting IE businesses for over 12 years. [Let's talk](/contact/). --- # How to Protect Your Law Firm From Ransomware URL: https://etoptechnology.com/blog/law-firm-ransomware-protection/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-02-22 Law firms sit on a goldmine of sensitive data. Client communications protected by attorney-client privilege. Financial records. Medical information from personal injury cases. Intellectual property. Trade secrets. If you wanted to design the perfect ransomware target, a law firm would be pretty close to the blueprint. And attackers know it. According to the American Bar Association's 2025 TechReport, 29% of law firms reported experiencing a security breach at some point, with ransomware being the fastest-growing category. The firms getting hit aren't just the big players, either. Small and mid-size firms are increasingly in the crosshairs because attackers know they often have weaker defenses and are more likely to pay. ## Why Law Firms Are Prime Targets There are a few reasons law firms attract ransomware operators more than other types of businesses: **The data is incredibly valuable.** Attorney-client privileged communications, case strategies, settlement details, M&A documents. This isn't just sensitive information. It's information that could be weaponized if leaked. That makes law firms more likely to pay to keep it contained. **Ethical obligations create urgency.** Lawyers have a professional duty to protect client confidentiality. A data breach isn't just an IT problem. It's a potential bar complaint, a malpractice claim, and a client relationship disaster. That urgency is leverage for attackers. **Many firms are under-protected.** The legal industry has historically been slow to adopt modern cybersecurity practices. Some firms are still running on-premises servers with minimal security, using shared passwords, and treating technology as an overhead expense rather than a critical business function. **The attack surface is larger than you think.** Between lawyers working from home, court filings being submitted electronically, client communications over email, and third-party legal software platforms, there are a lot of entry points for an attacker. ## The Real Impact of a Ransomware Attack Let's talk about what actually happens when a law firm gets hit with ransomware, because the technical disruption is only part of the story. **Operations grind to a halt.** Your document management system is encrypted. Email is down. You can't access case files, court deadlines, or client information. For a firm that bills by the hour, every minute of downtime is lost revenue. **Client notification obligations.** Depending on your jurisdiction and the data involved, you may be required to notify clients, the state bar, and regulatory agencies. Those conversations are never fun. **Ethical and malpractice exposure.** If client data is compromised and you didn't have reasonable security measures in place, you could be looking at bar disciplinary proceedings and malpractice claims. The ABA's Model Rules require lawyers to make "reasonable efforts" to prevent unauthorized access to client information. **Reputation damage.** Legal work is built on trust. When clients learn their confidential information may have been exposed, rebuilding that trust is a long road. Some clients will leave. Prospective clients who hear about the breach may never come in the door. **Financial costs.** The average ransomware recovery cost for a professional services firm is well over $1 million. That includes the ransom itself (which we generally advise against paying), forensic investigation, system rebuilding, legal fees, notification costs, and lost billable hours. ## Essential Security Layers for Law Firms Protecting your firm doesn't require a Fortune 500 security budget. It requires a layered approach where multiple defenses work together. If one layer fails, the next one catches the threat. ### Email Security Email is how most ransomware gets in. A lawyer clicks a link in what looks like a court notification or opposing counsel's document. That click downloads malware that spreads across the network. You need more than basic spam filtering. Modern email security should include: - Advanced threat protection that scans links and attachments in a sandbox before delivery - Impersonation protection to catch emails spoofing partners, judges, or clients - URL rewriting that checks links at the time of click, not just at delivery - DMARC, DKIM, and SPF records configured properly on your domain ### Endpoint Detection and Response (EDR) Traditional antivirus is dead for any business handling sensitive data. You need EDR on every workstation and laptop. EDR doesn't just look for known malware signatures. It watches for suspicious behavior patterns and can isolate a compromised device from the network automatically. When an attorney's laptop starts encrypting files at 2 AM, EDR catches it within seconds and quarantines the device before it can spread to your file server. ### Multi-Factor Authentication (MFA) This is non-negotiable. Every account that touches client data needs MFA. That means email, your document management system, your practice management software, VPN access, and cloud storage. If an attacker steals a password (which happens more often than anyone likes to admit), MFA is the wall that stops them. ### Network Segmentation If ransomware gets into one part of your network, segmentation prevents it from spreading everywhere. Your billing system shouldn't be on the same network segment as your guest Wi-Fi. Your server with client documents shouldn't be directly accessible from every workstation. ### Backup and Recovery This is your last line of defense and arguably the most important one. If ransomware encrypts your files, your backups are what get you back in business. But not all backups are created equal. For a law firm, you need: - **Immutable backups** that ransomware can't encrypt or delete - **Offsite or cloud backups** that are air-gapped from your production network - **Regular backup testing** to confirm you can actually restore from them (we've seen firms discover their backups were failing silently for months) - **Recovery time objectives** that match your business needs. Can you afford to be down for a day? An hour? That determines your backup architecture. ## Employee Training and Phishing Prevention Technology alone won't save you. Your people are both your greatest vulnerability and your strongest defense, depending on how well they're trained. Regular security awareness training should cover: - How to spot phishing emails, especially ones crafted to look like legal correspondence - What to do when something looks suspicious (report it, don't just delete it) - Safe handling of email attachments and links from unknown senders - The dangers of public Wi-Fi when working remotely (courthouses, coffee shops, airports) - Password hygiene and why credential reuse is dangerous We recommend phishing simulations alongside training. Send your team realistic phishing emails and track who clicks. Not to punish anyone, but to identify who needs additional coaching. The data backs this up: [KnowBe4's 2025 Phishing by Industry Benchmarking Report](https://www.knowbe4.com/resources/reports/phishing-by-industry-benchmarking-report) found untrained users fail phishing tests at a 33.1% baseline rate, dropping to 4.1% after 12 months of consistent training. ## Incident Response Planning Every law firm needs a documented incident response plan. Not a binder on a shelf, but a practical playbook your team has actually rehearsed. Your plan should cover: - **Who to contact** immediately (your IT provider, your cyber insurance carrier, legal counsel for the firm itself) - **Containment steps** to stop the spread (disconnect affected systems, preserve evidence) - **Client notification procedures** including who makes the calls and what to say - **Bar notification requirements** for your jurisdiction - **Communication protocols** for managing media inquiries and client questions - **Recovery procedures** including restore from backup, system rebuilding, and verification We run tabletop exercises with our law firm clients where we walk through a simulated ransomware scenario. These exercises consistently reveal gaps that nobody thought about until they were in the middle of it. Running through the scenario when the stakes are low is infinitely better than figuring it out during an actual attack. ## Taking the First Step If you're reading this and thinking your firm has some gaps, you're not alone. Most firms do. The question isn't whether you're perfect. It's whether you're making meaningful progress toward a defensible security posture. The best first step is understanding where you stand right now. As part of our [IT services for law firms](/it-services-law-firms-inland-empire/), we do security assessments specifically designed for law firms that evaluate your environment against the ABA's cybersecurity guidelines and current threat patterns. It takes a couple of hours, qualifying firms receive our IT Risk Assessment complimentary, and you'll walk away with a clear picture of your risks and a prioritized action plan. Your clients trust you with their most sensitive information. Making sure that trust is well-placed is both an ethical obligation and a business imperative. --- # CMMC 2.0 for Inland Empire Manufacturers: What You Need to Know URL: https://etoptechnology.com/blog/cmmc-inland-empire-manufacturers/ Type: Article Category: Compliance Author: William “BJ” Pote Published: 2026-02-21 If you're a manufacturer in the Inland Empire and any of your revenue comes from Department of Defense contracts, CMMC 2.0 (Cybersecurity Maturity Model Certification) is coming for you. Not eventually. Now. And the businesses that wait until a prime contractor demands proof of compliance are going to be scrambling. The Inland Empire has a massive defense and aerospace corridor. From logistics hubs in Riverside and San Bernardino to precision machining shops in Ontario and Rancho Cucamonga, there are hundreds of small and mid-size manufacturers feeding into the DoD supply chain. Talk to a few of them and the pattern is remarkably consistent: they know CMMC is a thing, they've heard it mentioned at industry events, but they don't know exactly what it means for their shop floor and their IT environment. Let's fix that. ## What Is CMMC 2.0? CMMC stands for Cybersecurity Maturity Model Certification. It's a framework the Department of Defense created to make sure that every company in the defense supply chain is protecting sensitive information. The original version (CMMC 1.0) was overly complicated, so the DoD streamlined it into CMMC 2.0 with three levels instead of five. **Level 1: Foundational.** This covers businesses that handle FCI (Federal Contract Information), which is basically any information the government gives you as part of a contract that isn't public. Level 1 requires 17 basic security practices. Think things like using antivirus, limiting who can access systems, and locking computers when people walk away. You can self-assess for Level 1. **Level 2: Advanced.** This is where most Inland Empire manufacturers will land. If you handle CUI (Controlled Unclassified Information), things like technical drawings, specifications, or performance data related to defense projects, you need Level 2. It maps directly to NIST SP 800-171, which is 110 security controls. For critical contracts, you'll need a third-party assessment from a C3PAO (CMMC Third-Party Assessment Organization). For non-critical CUI, you can self-assess annually. **Level 3: Expert.** This is for companies dealing with the most sensitive programs. It adds controls from NIST SP 800-172 and requires a government-led assessment. Most small and mid-size manufacturers won't need this level. ## Who Actually Needs CMMC Compliance? If any of these describe your business, you need to pay attention: - You have a direct contract with the DoD (even a small one) - You're a subcontractor to a prime defense contractor - You manufacture components that end up in defense systems - You receive technical data packages, drawings, or specifications marked as CUI - Your contracts include DFARS (Defense Federal Acquisition Regulation Supplement) clauses 252.204-7012, 7019, 7020, or 7021 Here's what catches people off guard: it doesn't matter how small your piece of the puzzle is. If a prime contractor sends you a technical drawing for a bracket that goes on a military vehicle, and that drawing is marked CUI, you need Level 2 compliance. Period. ## The Timeline Is Not Hypothetical CMMC 2.0 rulemaking finalized in late 2024, and the DoD began including CMMC requirements in contracts through a phased rollout starting in 2025. By 2026, it's showing up in new solicitations regularly. If you're bidding on contracts this year or next, you should expect to see CMMC requirements. More importantly, prime contractors are already asking their subs about compliance posture. Picture the letter: your prime wants a self-assessment score and a Plan of Action and Milestones (POA&M) within 60 days, and you haven't started. That's a bad position to be in, and it's exactly the position a lot of shops are going to find themselves in this year. ## What IT Changes Does CMMC Actually Require? This is where it gets real. For Level 2, which most manufacturers need, you're looking at 110 controls across 14 families. Here are the ones that hit hardest for a typical manufacturing environment: **Access Control.** Every user needs unique credentials. No shared logins on the shop floor CNC computers. No sticky notes with passwords. Role-based access so people only see what they need to see. **Multi-Factor Authentication.** MFA (Multi-Factor Authentication) on every account that accesses CUI. That includes email, file shares, remote access, and any cloud applications where CUI lives. **Encryption.** CUI must be encrypted at rest and in transit. If you're emailing technical drawings as unencrypted PDF attachments, that's a problem. If your file server isn't encrypted, that's a problem. **Endpoint Protection.** Every device that touches CUI needs managed antivirus, EDR (Endpoint Detection and Response), and regular patching. That includes the workstation running your CAD software and the laptop your engineer takes home. **Audit Logging.** You need to log who accesses what, when, and from where. And you need to actually review those logs. This is where a lot of manufacturers fall short because they've never had a reason to track this before. **Network Segmentation.** Your CUI environment should be separated from your general business network. The computer your receptionist uses to browse the internet should not be on the same network segment as the systems storing defense project data. This is where a [zero trust security model](/blog/zero-trust-security-explained/) pays off - it assumes no user or device should be trusted by default, which maps directly to what CMMC assessors want to see. **Incident Response.** You need a documented plan for what happens when something goes wrong. Who do you call? How do you contain a breach? How do you report it to the DoD? You're required to report cyber incidents to the DoD within 72 hours. **Security Awareness Training.** Every employee with access to CUI needs regular training. Not just once. Ongoing. Phishing simulations, policy refreshers, the works. ## The Biggest Mistake Manufacturers Make The number one mistake manufacturers make is assuming their current IT setup is "close enough." Decent IT by normal business standards — firewalls, antivirus, Office 365 — covers only a fraction of the 110 NIST 800-171 controls. The rest are things a typical small business has never had a reason to build: documented policies, audit logging with actual review, CUI-scoped network segmentation, formal incident response. When shops map their environment against the full control list for the first time, the gap is usually measured in months of work, not weeks. The second biggest mistake is trying to DIY the compliance work with internal staff who don't have security expertise. CMMC isn't something you can Google your way through. The controls are specific, the documentation requirements are rigorous, and the assessors know what to look for. ## What Should You Do Right Now? If you're an Inland Empire manufacturer with DoD work, here's your action plan: **1. Figure out what data you handle.** Do you receive FCI? CUI? Both? Check your contract clauses and talk to your prime contractors. This determines which CMMC level you need. **2. Get a gap assessment.** Have someone who understands NIST 800-171 evaluate your current environment against the controls. You need to know your starting point before you can build a plan. For the formal CMMC path, that means a Registered Provider Organization (RPO) for readiness work or a C3PAO for the assessment itself — the CMMC ecosystem has specific accredited roles for a reason. **3. Scope your CUI environment.** One of the smartest things you can do is limit where CUI lives. The smaller your CUI boundary, the fewer systems you need to bring into compliance. This can save you significant time and money. **4. Build a remediation plan.** Based on your gaps, create a prioritized plan to implement the missing controls. Focus on the high-impact items first: MFA, encryption, access controls, and endpoint protection. **5. Document everything.** CMMC assessors want to see written policies, procedures, and evidence that you're following them. A System Security Plan (SSP) and POA&M are required documents. Start writing them now. **6. Get the right partners in the right roles.** The certification work — readiness prep and the formal assessment — runs through the CMMC ecosystem: RPOs and C3PAOs. Your day-to-day [managed IT provider](/managed-it-services/) plays a different but essential role: running the MFA, patching, monitoring, backups, and access controls that most of those 110 controls depend on. Be clear about which partner owns which piece, and [ask the right questions](/blog/it-provider-evaluation-guide/) before you sign anything. ## The Business Case Is Simple Losing a defense contract because you can't prove compliance is an existential risk for a lot of shops. The manufacturers who invest in CMMC compliance now are the ones who will keep their contracts and win new ones. The ones who wait are going to find themselves locked out of bids. And here's the upside that nobody talks about: the same security controls that make you CMMC compliant also make your business dramatically harder to attack. Ransomware, phishing, data theft. You're building real [cybersecurity](/cybersecurity-services-inland-empire/) resilience, not just checking boxes for an auditor. A quick note on where we fit: eTop is not a C3PAO or an RPO, and we don't run CMMC certifications. What we do is the security fundamentals underneath them — MFA, encryption, endpoint protection, patching, backups, network segmentation — the same controls that make up the bulk of NIST 800-171. If you're not sure where you stand, reach out. We'll help you get the fundamentals in order, tell you honestly what's outside our lane, and point you toward accredited CMMC partners for the certification work itself. No scare tactics. Just a practical starting point for protecting your contracts and your business. --- # Cybersecurity & Compliance Guide for Inland Empire Law Firms URL: https://etoptechnology.com/blog/cybersecurity-compliance-guide-law-firms/ Type: Article Category: White Paper Author: William “BJ” Pote Published: 2026-02-17 **[Download the full PDF guide](/downloads/cybersecurity-compliance-guide-law-firms.pdf)** for a printable reference you can share with your firm's partners and staff. --- Law firms in the Inland Empire face a unique intersection of challenges. You're handling some of the most sensitive data in any profession, operating under strict ethical obligations from the California State Bar, and competing in a market where clients increasingly want to know that their information is protected. This guide is designed to give you a clear picture of what's required, what's at stake, and what practical steps you can take. We work with law firms across Riverside and San Bernardino counties, and the patterns we see are consistent. Most firms know they should be doing more about cybersecurity but aren't sure where to start or what the priorities should be. This guide answers those questions. ## Your Ethical Obligations Around Data Security Let's start with the professional obligations, because this is what separates law firms from other businesses when it comes to cybersecurity. ### ABA Model Rules The American Bar Association's Model Rules of Professional Conduct establish the baseline for what's expected: **Rule 1.1 (Competence)** requires lawyers to keep abreast of changes in technology relevant to their practice. The comments to this rule explicitly state that competence includes understanding the benefits and risks of technology. You can't claim ignorance about cybersecurity threats. **Rule 1.6 (Confidentiality)** requires lawyers to make "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." The key phrase is "reasonable efforts." What's reasonable evolves as threats evolve. **Rule 5.1 and 5.3 (Supervision)** require partners and supervisory lawyers to ensure that the firm has measures in place to ensure compliance with the rules, including by non-lawyer staff and third-party service providers. ### California-Specific Obligations California adds additional layers: **California Rules of Professional Conduct Rule 1.6** mirrors the ABA's confidentiality requirements but is interpreted in the context of California's broader privacy-focused legal landscape. **California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)** may apply to your firm depending on your revenue, the amount of personal information you process, and whether you handle data on behalf of business clients who are themselves subject to the CCPA. If your firm's gross annual revenue exceeds $25 million, you likely have CCPA obligations. **California's data breach notification law (Civil Code 1798.82)** requires notification to affected individuals when unencrypted personal information is compromised. The notification requirements are specific about timing and content. ### What "Reasonable Efforts" Actually Means The ABA's formal opinions provide guidance on what constitutes reasonable efforts: - Conducting a risk assessment of your firm's data and technology - Implementing appropriate security measures based on that assessment - Training lawyers and staff on cybersecurity - Having an incident response plan - Vetting third-party service providers for adequate security - Using encryption for sensitive client communications when warranted - Monitoring for unauthorized access to client files None of this requires perfection. But it does require demonstrable, documented effort. A firm that does nothing and gets breached is in a very different position than a firm that had reasonable security measures in place and still got hit. ## The Threat Landscape for Law Firms Understanding what you're defending against helps you prioritize your investments. ### Ransomware Ransomware is the top threat for law firms by a wide margin. Attackers encrypt your files and demand payment, often in the hundreds of thousands of dollars. The leverage they hold over law firms is unique because of the sensitivity of the data and the ethical obligations around it. Some ransomware groups now practice "double extortion," where they steal data before encrypting it and threaten to publish it if you don't pay. ### Business Email Compromise (BEC) BEC attacks target law firms because of the large financial transactions they handle. An attacker compromises or spoofs a partner's email and sends wire transfer instructions to a client, real estate escrow company, or the firm's own accounting department. Single BEC incidents routinely run into six figures — the FBI's Internet Crime Complaint Center consistently ranks BEC among the costliest cybercrime categories, with reported losses in the billions of dollars every year, and law firms are a favorite target because of the wire transfers they touch. ### Phishing Phishing remains the primary delivery mechanism for both ransomware and BEC. Attackers craft emails that look like court notifications, opposing counsel correspondence, client documents, or even internal firm communications. Legal-specific phishing campaigns are increasingly sophisticated. ### Insider Threats Not all threats come from outside. Departing attorneys taking client files, staff accessing data they shouldn't, or simple negligence like leaving a laptop unlocked in a courthouse. These internal risks need the same attention as external threats. ## Compliance Frameworks That Apply Beyond ethical obligations, several compliance frameworks may apply to your firm depending on your practice areas and clients. ### FTC Safeguards Rule (by way of your clients) Here's a misconception worth clearing up: the FTC Safeguards Rule generally does not apply to law firms directly. A federal appeals court settled that in 2005 (American Bar Association v. FTC), holding that practicing law doesn't make a firm a "financial institution" under the Gramm-Leach-Bliley Act. But that's not the end of the story. If you represent banks, lenders, mortgage companies, auto dealers, or other covered financial institutions, those clients are on the hook for the rule — and their outside counsel guidelines and engagement agreements increasingly pass their security obligations down to you contractually. Expect requirements like encryption, MFA (multi-factor authentication), access controls, and continuous monitoring to show up in your engagement terms even though the regulation never names you. The rule may not apply to you. Your engagement letter might. ### HIPAA Personal injury firms, medical malpractice practices, and any firm that receives protected health information (PHI) from healthcare clients may have HIPAA obligations as a business associate. This requires a BAA with the covered entity and compliance with HIPAA's security and privacy rules. ### PCI-DSS If your firm accepts credit card payments for fees (many do through online portals), PCI-DSS requirements apply to how you process and store cardholder data. ## A Practical Security Roadmap for Your Firm Based on our experience working with Inland Empire law firms, here's a prioritized roadmap that addresses both the biggest risks and the compliance requirements. ### Phase 1: The Non-Negotiables (Weeks 1-4) These items address the most critical vulnerabilities and are required by virtually every compliance framework: **Deploy multi-factor authentication everywhere.** Email, document management systems, practice management software, VPN, cloud storage. Every account that touches client data needs MFA. This single step eliminates the majority of credential-based attacks. **Implement endpoint detection and response (EDR).** Replace basic antivirus with EDR on every workstation and laptop. EDR monitors for suspicious behavior patterns and can automatically isolate a compromised device. This is your primary defense against ransomware. **Encrypt all devices.** Full disk encryption on every laptop, desktop, and mobile device. If a device is lost or stolen, encryption is the difference between an inconvenience and a reportable data breach. **Establish immutable backups.** Configure backups that cannot be modified or deleted by ransomware. Test them immediately. Know your recovery time and make sure it's acceptable for your firm's operations. ### Phase 2: Building the Foundation (Weeks 5-12) **Email security hardening.** Advanced threat protection, impersonation detection, DMARC/DKIM/SPF configuration, and external email tagging. This dramatically reduces the effectiveness of phishing and BEC attacks. **Network segmentation.** Separate your network into zones: servers, workstations, guest Wi-Fi, and any IoT devices. This contains the blast radius if a device is compromised. **Security awareness training.** Implement ongoing training with monthly phishing simulations. Focus on legal-specific scenarios: fake court notices, spoofed opposing counsel emails, fraudulent wire transfer requests. **Document your policies.** Create or update your information security policy, acceptable use policy, incident response plan, and data handling procedures. These are required for compliance and essential for demonstrating "reasonable efforts." ### Phase 3: Maturity and Monitoring (Weeks 13-24) **Continuous monitoring.** Implement SIEM (Security Information and Event Management) or equivalent monitoring that provides 24/7 visibility into your network and alerts on suspicious activity. **Vulnerability management.** Regular vulnerability scans and annual penetration testing to identify and fix weaknesses before attackers find them. **Vendor security assessments.** Review the security practices of your cloud providers, legal software vendors, and any other third parties with access to client data. Ensure contracts include appropriate security requirements. **Incident response rehearsal.** Conduct a tabletop exercise walking through a ransomware scenario. Include partners, IT staff, and key administrative personnel. Document lessons learned and update your plan. **Cyber insurance review.** Ensure your coverage is adequate and aligned with your actual security posture. Work with a broker who specializes in professional services or law firm coverage. ## Managing Client Expectations Increasingly, sophisticated clients (especially corporate clients) are asking about their law firm's cybersecurity practices before engaging them. Some are including security requirements in their outside counsel guidelines. Being able to demonstrate a mature security posture is becoming a competitive advantage. Firms that can point to documented policies, regular assessments, employee training, and technical controls are winning business over firms that can't. Consider proactively communicating your security practices to clients. You don't need to share technical details, but a statement that your firm takes information security seriously and maintains specific programs around training, monitoring, and incident response goes a long way. ## The Cost Question The number one concern we hear from managing partners is "what does this cost?" Here's the straightforward answer: it depends on your environment, mainly the size of the firm and the complexity of its systems. [Book an intro call](/contact/) and we will give you exact pricing after an assessment. Whatever the number, compare it to the alternatives: - IBM's Cost of a Data Breach report puts the global average cost of a breach at $4.9 million (2024 edition) — and breaches involving regulated data tend to run higher - Ransomware recovery for a professional services firm — downtime, forensics, rebuilding, legal exposure — routinely runs well into seven figures - Cost of a malpractice claim stemming from a security breach: variable, but potentially career-ending - Cost of losing clients due to a publicized breach: unquantifiable The math is pretty clear. And many firms find that modernizing their IT environment actually reduces other costs through better efficiency, fewer support issues, and elimination of redundant tools and licenses. ## Getting Started The right first step is understanding where your firm stands today. We offer a security and compliance assessment specifically designed for law firms that evaluates your environment against ABA guidelines, applicable regulations, and current threat patterns. It's part of how we run [IT for law firms across the Inland Empire](/it-services-law-firms-inland-empire/). The assessment takes a few hours, covers everything in this guide, and produces a prioritized report you can share with your partners. There's no cost and no obligation. If you want to engage us to help close the gaps, great. If you want to take the report and handle it internally or with another provider, that's fine too. Your clients trust you with their most consequential legal matters. That trust extends to how you protect their information. A proactive approach to cybersecurity isn't just risk management. It's the right thing to do. **[Download the full PDF guide](/downloads/cybersecurity-compliance-guide-law-firms.pdf)** and share it with your firm's leadership team. --- # Managed IT vs. Break-Fix: The True Cost Comparison URL: https://etoptechnology.com/blog/managed-it-vs-break-fix/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-02-15 "Why would I pay a monthly fee when I can just call someone when something breaks?" It's a fair question. On the surface, break-fix IT looks like the cheaper option. You only pay when you need help. No monthly overhead. Simple. Except it's not simple. And when you actually run the numbers, it's usually not cheaper either. Let me walk you through why. ## What Are We Actually Comparing? **Break-fix IT** is exactly what it sounds like. Something breaks, you call someone, they fix it, you get a bill. There's no ongoing relationship, no monitoring, no proactive maintenance. Your IT person or company is essentially an on-call mechanic. **Managed IT** is a fundamentally different model. You pay a predictable monthly fee, and in return you get continuous monitoring, proactive maintenance, security management, help desk support, and strategic guidance. Your IT partner is watching the dashboard 24/7 and fixing problems before you even know they exist. The difference isn't just about how you pay. It's about what you get. ## The Hidden Costs of Break-Fix Break-fix looks cheaper because you only see the direct costs: the invoices when something goes wrong. But the real cost is everything that happens between those invoices. ### Downtime Is Expensive When a server goes down or a critical application stops working, your team can't work. The average cost of IT downtime for a mid-size business runs between $10,000 and $50,000 per hour, depending on your industry and the systems affected. With break-fix, you're calling someone after the problem has already started. They need to diagnose the issue, figure out a fix, and implement it. That takes time. And the whole time they're working on it, your team is either sitting idle or scrambling to work around the problem. With managed IT, the monitoring system often catches issues before they cause downtime. A hard drive showing early signs of failure gets replaced during a maintenance window. A server running low on resources gets scaled up before it crashes. The problems you never experience are the ones that save you the most money. ### Security Gaps Are Real Here's the thing about break-fix: nobody is watching your security between service calls. Patches aren't being applied. Endpoints aren't being monitored. Nobody is looking at your firewall logs or checking for suspicious activity. The average time to detect a breach for businesses without continuous monitoring is 197 days. That's over six months of an attacker living in your network before anyone notices. With managed IT, you have security tools and eyes on your systems continuously. Threats get detected and contained in hours or days, not months. A single ransomware incident can cost a mid-size business $1.5 million or more when you factor in downtime, recovery costs, legal fees, and reputation damage. That makes your monthly managed IT fee look like a rounding error. ### No Strategic Value A break-fix provider doesn't know your business. They show up, fix the immediate problem, and leave. They're not thinking about how your technology environment supports your business goals, because that's not what they're paid to do. This means you're making technology decisions on your own, or not making them at all. You're keeping aging equipment running past its useful life because nobody told you it was time to replace it. You're paying for software licenses you don't use because nobody audited them. You're missing efficiency gains because nobody is looking at how your team actually works. The opportunity cost of not having strategic IT guidance is hard to quantify, but it's real. Businesses with strategic IT planning grow faster, operate more efficiently, and adapt to change more easily than businesses that treat IT as a necessary expense. ## The Real Cost Comparison Let's put some numbers on this. These are based on what we typically see for a business with 50 employees in the Inland Empire. ### Break-Fix Model - Average monthly spend on break-fix calls: $2,000 to $5,000 (highly variable) - One major incident per year (server failure, ransomware, etc.): $15,000 to $100,000+ - Downtime costs: $5,000 to $20,000 per incident - Employee productivity loss from slow, unreliable systems: hard to measure, but real - No cybersecurity monitoring: risk accumulates silently - **Effective annual cost: $40,000 to $150,000+** (wildly unpredictable) ### Managed IT Model - One flat monthly fee, priced to your environment (predictable) - Includes: 24/7 monitoring, help desk, security, patching, backups, strategic planning - Major incidents prevented or mitigated: cost avoided - Employee productivity gains from reliable, optimized systems - **Effective annual cost: fixed and known up front** (predictable) The managed IT fee might look similar or slightly higher on paper. But look at the range. Break-fix costs swing wildly depending on what goes wrong. One bad year with a ransomware incident or a major server failure, and you've blown well past what a flat managed IT fee would have cost. Pricing depends on your environment; [book an intro call](/contact/) to get yours. Managed IT gives you predictability. You know what you're spending, you know what you're getting, and you're not one bad day away from a budget-busting disaster. ## When Does Managed IT Make Sense? Managed IT isn't the right fit for every business. If you're a five-person office with minimal technology needs and no compliance requirements, break-fix might be perfectly adequate. But managed IT starts making a lot of sense when: - **You have 20+ employees** and technology is central to how your team works - **You handle sensitive data** (client records, financial information, health data) - **You have compliance requirements** (FTC Safeguards, HIPAA, CMMC, state privacy laws) - **Downtime directly impacts revenue** (most businesses, honestly) - **You're growing** and need IT that scales with you - **You don't have internal IT staff** and need someone to own the whole technology function For most businesses we work with in the 30 to 200 employee range, managed IT is clearly the better value. The predictability alone is worth it. Business owners tell us they sleep better knowing someone is watching the systems around the clock. ## How to Evaluate the Switch If you're currently on a break-fix model and thinking about making the move to managed IT, here's how to approach it: **Add up what you're actually spending.** Gather 12 months of IT invoices, including emergency calls, hardware replacements, and any project work. Most business owners are surprised by the total. **Estimate your downtime costs.** Think about the incidents you've had in the past year. How long was your team impacted? What did that cost in lost productivity and revenue? **Consider what you're not getting.** Are your systems being patched regularly? Do you have security monitoring? When was your last backup test? These gaps represent risks that don't show up on an invoice until something goes wrong. **Talk to a managed IT provider.** Get a real quote based on your environment. A good provider will do a discovery assessment to understand your needs before they give you a number. If someone quotes you a price without understanding your environment, that's a red flag. The switch from break-fix to managed IT is one of the most impactful operational decisions a growing business can make. It's not about spending more on IT. It's about spending smarter and eliminating the uncertainty that comes with the alternative. If you want to see what managed IT would actually cost for your business, we're happy to do the analysis. No obligation, just real numbers so you can make an informed decision. --- # SOC 2 vs SOC 1: Which Compliance Framework Do You Actually Need? URL: https://etoptechnology.com/blog/soc-2-vs-soc-1/ Type: Article Category: Compliance Author: William “BJ” Pote Published: 2026-02-12 At least once a month, a business owner or executive tells us they need to "get SOC 2 compliant" and then describes a situation where they actually need a SOC 1. Or vice versa. Sometimes they don't need either, and sometimes they need both. The confusion is understandable because the names are almost identical, and most of the content written about them online is either too technical or too vague to be useful. Let's clear it up. ## The Fundamental Difference Both SOC 1 and SOC 2 are audit frameworks developed by the AICPA (American Institute of Certified Public Accountants). They both result in an auditor's report about your organization's controls. But they cover completely different things. **SOC 1** is about financial reporting controls. If your business provides a service that affects your clients' financial statements, a SOC 1 report tells those clients (and their auditors) that your controls over financial data are sound. **SOC 2** is about security, availability, processing integrity, confidentiality, and privacy controls. If your business handles client data and your clients want assurance that you're protecting it properly, SOC 2 is the report that demonstrates that. Think of it this way: SOC 1 asks "Can we trust this company with our financial data for accounting purposes?" SOC 2 asks "Can we trust this company to keep our data secure and available?" ## Who Needs a SOC 1? SOC 1 reports are relevant when your services directly impact your clients' financial reporting. Common examples: - **Payroll processing companies.** You're calculating wages, withholding taxes, and generating financial records that flow into your clients' books. - **Claims processing firms.** Insurance claims processors handle financial transactions that end up in their clients' financial statements. - **Accounting and bookkeeping service providers.** If you manage accounting functions for other businesses, your controls directly affect their financial reporting. - **Trust and custody service providers.** Companies that hold or manage financial assets on behalf of clients. - **Payment processing companies.** Transaction data flows directly into clients' revenue recognition and financial reporting. The key question is: does your service create, process, or materially affect financial transactions or data that shows up in your clients' financial statements? If yes, you likely need a SOC 1. Your clients' external auditors are usually the ones driving the request. When they're auditing your client's financial statements, they need to understand the controls at service organizations like yours. A SOC 1 report gives them that assurance without having to audit your operations directly. ## Who Needs a SOC 2? SOC 2 is broader and has become the de facto standard for demonstrating that you take data security seriously. You likely need a SOC 2 if: - **You're a SaaS (Software as a Service) provider.** Your clients' data lives on your infrastructure. They want proof you're protecting it. - **You provide managed IT, hosting, or cloud services.** You have access to client systems and data. SOC 2 proves your controls are adequate. - **You process, store, or transmit client data.** Broadly, if clients trust you with their information and they care about security (and increasingly, all of them do), SOC 2 is what they'll ask for. - **Your clients are in regulated industries.** Healthcare companies, financial services firms, and government contractors are increasingly requiring SOC 2 reports from all their vendors. (Defense contractors have their own framework too. If you work with the DoD, see our [CMMC compliance guide](/blog/cmmc-inland-empire-manufacturers/).) - **You want to win enterprise deals.** For many mid-market and enterprise buyers, "Do you have a SOC 2?" is a qualifying question. No report means you don't make it past procurement. SOC 2 is organized around five Trust Services Criteria: 1. **Security** (required for every SOC 2). Protection against unauthorized access. 2. **Availability.** Systems are available for operation as committed. 3. **Processing Integrity.** System processing is complete, valid, accurate, and timely. 4. **Confidentiality.** Information designated as confidential is protected. 5. **Privacy.** Personal information is collected, used, retained, and disclosed appropriately. You don't have to include all five. Security is mandatory, and then you choose additional criteria based on what's relevant to your business and what your clients care about. Most businesses start with Security and Availability. ## Type I vs Type II Both SOC 1 and SOC 2 come in two types, and this trips people up: **Type I** is a point-in-time assessment. The auditor evaluates whether your controls are properly designed as of a specific date. It's a snapshot. "As of March 1, 2026, these controls were in place and designed appropriately." **Type II** covers a period of time, typically 6 to 12 months. The auditor not only evaluates the design of your controls but also tests whether they operated effectively throughout the entire period. "From March 1, 2025 through February 28, 2026, these controls were in place and working." Type II is significantly more valuable because it proves consistency, not just intent. Most clients and prospects who are serious about vendor security will want a Type II report. A Type I is sometimes used as a stepping stone when a company is getting its first SOC report, but plan to move to Type II as quickly as possible. ## What the Audit Process Looks Like Here's what to expect, whether you're going through SOC 1 or SOC 2: **Phase 1: Readiness Assessment (2-4 weeks).** Before the formal audit, you (or your IT partner) should do a readiness assessment. This means mapping your current controls against the SOC criteria, identifying gaps, and fixing them. Going into an audit without a readiness assessment is like taking a test without studying. You might pass, but you probably won't. **Phase 2: Remediation (4-12 weeks, varies widely).** Address the gaps found in the readiness assessment. This might mean implementing new security tools, writing policies, setting up monitoring, or changing processes. The timeline depends entirely on how many gaps you have. **Phase 3: Observation Period (Type II only, 6-12 months).** For a Type II report, the auditor needs to see your controls operating over time. This means you need to maintain consistent, documented adherence to your controls for the full audit period. No shortcuts. **Phase 4: Formal Audit (4-8 weeks).** A CPA firm that specializes in SOC audits performs the examination. They'll request evidence, interview staff, review documentation, and test controls. For Type II, they'll sample evidence from across the entire observation period. **Phase 5: Report Issuance.** The auditor delivers the final report. If there are exceptions (controls that weren't operating effectively), they'll be noted. Some exceptions are manageable, but too many, or critical ones, will undermine the value of the report. ## How Your MSP Should Support You This is where we see a big gap in the market. A lot of businesses go into a SOC audit and realize their IT provider hasn't been setting them up for success. (If you're evaluating providers, our guide on [how to evaluate an IT provider](/blog/it-provider-evaluation-guide/) covers the right questions to ask.) Here's what your [managed IT partner](/managed-it-services/) should be doing: **Implementing and managing the technical controls.** Access management, encryption, monitoring, endpoint protection, backup and recovery, vulnerability management, patch management. These are the technical controls auditors will evaluate, and your MSP should be managing them consistently. **Maintaining evidence and documentation.** Auditors want proof. That means logs, reports, screenshots, and records showing controls operated effectively over time. Your MSP should be generating and retaining this evidence as part of normal operations, not scrambling to produce it when the auditor comes knocking. **Supporting the readiness assessment.** Your MSP should be able to map your technical environment against SOC criteria and identify gaps proactively. If your IT provider can't tell you where you stand relative to SOC requirements, that's a problem. **Participating in the audit.** During the formal examination, auditors will have questions about your technical environment. Your MSP should be available to answer those questions, provide evidence, and demonstrate that controls are functioning. **Continuous compliance.** SOC compliance isn't a one-time event. Your controls need to operate effectively every day, not just during audit season. Your MSP should be treating every month as if the auditor could walk in tomorrow. ## Common Mistakes to Avoid **Confusing the two frameworks.** We covered this, but it bears repeating. Make sure you're pursuing the right report. Talk to your clients and their auditors to confirm what they're actually asking for. **Starting too late.** A SOC 2 Type II takes a minimum of 6 months for the observation period alone, plus readiness and remediation time before that. If a prospect tells you they need a SOC 2 before signing a contract, and you haven't started, you're 9 to 15 months away. Plan ahead. **Treating it as a checkbox.** The businesses that get the most value from SOC compliance are the ones that internalize the controls as part of how they operate, not as a burden they endure once a year. The same controls that satisfy an auditor also make your business genuinely more secure and resilient. **Going it alone on the technical side.** If your IT environment isn't built and managed with auditability in mind, the audit process will be painful and expensive. Partner with a [cybersecurity-focused MSP](/cybersecurity-services-inland-empire/) that has experience supporting SOC audits. ## What Should You Do Next? First, figure out which report you need. Talk to your clients, their auditors, and your prospects. Understand what they're asking for and why. Then get a readiness assessment. Whether you're pursuing SOC 1 or SOC 2, you need to know where you stand before you engage an audit firm. We offer a [compliance assessment](/compliance-it-services/) that maps your environment against the relevant criteria and gives you a clear, prioritized remediation plan. The businesses that invest in compliance infrastructure early are the ones that close bigger deals, retain demanding clients, and sleep better at night knowing their operations can withstand scrutiny. The ones that treat it as an afterthought end up overpaying for rushed audits and explaining exceptions to their clients. Start early. Get the right help. Build it into how you operate. That's the playbook. --- # The Complete IT Security Assessment Checklist for Mid-Size Businesses URL: https://etoptechnology.com/blog/it-security-assessment-checklist/ Type: Article Category: White Paper Author: William “BJ” Pote Published: 2026-02-10 **[Download the PDF version of this checklist](/downloads/it-security-assessment-checklist.pdf)** to use as a reference during your own security review. --- If you're running a business with 30 to 200 employees, you're in a tough spot when it comes to cybersecurity. You're big enough to be a real target but probably don't have a dedicated security team to deal with it. The good news is that you don't need a Fortune 500 budget to get your security right. You need a clear picture of where you stand and a plan to close the gaps. This checklist is what we use internally at eTop Technology when we onboard new clients and run annual security reviews. It's organized by category, and each item is something you can evaluate without deep technical expertise. If you can't confidently say "yes" to an item, that's a gap worth investigating. ## 1. Identity and Access Management Access controls are the foundation of your security posture. If the wrong people can get to the wrong data, nothing else matters. - [ ] Multi-factor authentication (MFA) is enabled on all business email accounts - [ ] MFA is enabled on all cloud applications that support it (Microsoft 365, Google Workspace, CRM, accounting software) - [ ] VPN or remote access connections require MFA - [ ] Administrative accounts use separate credentials from daily-use accounts - [ ] Former employees are deprovisioned within 24 hours of departure - [ ] User access is reviewed quarterly to ensure least-privilege principles - [ ] Password policies require a minimum of 14 characters - [ ] Shared accounts and generic logins have been eliminated - [ ] Privileged access (admin rights) is limited to personnel who genuinely need it - [ ] Single sign-on (SSO) is implemented where possible to reduce credential sprawl **Why it matters:** Compromised credentials are involved in over 80% of data breaches. MFA alone blocks 99.9% of automated attacks. If you do nothing else on this list, get MFA deployed everywhere. ## 2. Endpoint Security Every laptop, desktop, and mobile device that connects to your network is a potential entry point for attackers. - [ ] All workstations and laptops run Endpoint Detection and Response (EDR), not just basic antivirus - [ ] EDR is centrally managed with alerts going to a monitored dashboard - [ ] Operating systems are patched within 14 days of critical security updates - [ ] Third-party applications (browsers, PDF readers, Java) are patched regularly - [ ] Full disk encryption is enabled on all laptops and mobile devices - [ ] USB storage devices are restricted or disabled via policy - [ ] Mobile device management (MDM) is in place for phones and tablets that access company data - [ ] Auto-lock is configured on all devices (5 minutes or less) - [ ] Local admin rights are removed from standard user accounts **Why it matters:** Endpoints are where attacks land. EDR catches the threats that antivirus misses by monitoring behavior patterns, not just known signatures. Encryption means a stolen laptop doesn't become a data breach. ## 3. Email Security Email remains the number one attack vector. If your email security is weak, the rest barely matters. - [ ] Advanced threat protection scans attachments and links before delivery - [ ] Impersonation protection is configured for executives and key personnel - [ ] DMARC, DKIM, and SPF records are properly configured on your domain - [ ] External email tagging (banner warnings) is enabled for emails from outside the organization - [ ] Automatic forwarding to external addresses is disabled or restricted - [ ] Email retention and archiving policies are in place - [ ] Users receive regular phishing simulation tests - [ ] Phishing click rates are tracked and users who click receive additional training **Why it matters:** Over 90% of successful cyberattacks start with a phishing email. Your email security configuration is the difference between an attack that gets caught and one that compromises your entire network. ## 4. Network Security Your network is the highway that connects everything. If it's not properly segmented and monitored, a single compromised device can lead to a full-network breach. - [ ] Firewall is enterprise-grade with active threat intelligence subscriptions - [ ] Firewall rules are reviewed at least annually - [ ] Network is segmented (servers, workstations, guest Wi-Fi, IoT on separate VLANs) - [ ] Guest Wi-Fi is isolated from the corporate network - [ ] DNS filtering blocks known malicious domains - [ ] Remote access uses a modern VPN or zero-trust network access (ZTNA) solution - [ ] Wireless networks use WPA3 or WPA2-Enterprise authentication - [ ] Network traffic is monitored for anomalous behavior - [ ] Intrusion detection or prevention system (IDS/IPS) is active **Why it matters:** Network segmentation is what prevents a ransomware infection on one workstation from spreading to your file server, backups, and every other system on the network. Without it, one compromised device can take down everything. ## 5. Data Backup and Recovery Backups are your last line of defense against ransomware and data loss. But only if they actually work. - [ ] All critical data is backed up at least daily - [ ] Backups follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite - [ ] At least one backup copy is immutable (cannot be modified or deleted by ransomware) - [ ] Backup integrity is verified automatically - [ ] Full restore tests are performed at least quarterly - [ ] Recovery time objectives (RTO) are defined and achievable - [ ] Recovery point objectives (RPO) are defined and acceptable to the business - [ ] Backup encryption is enabled for data at rest and in transit - [ ] Backup access is restricted to authorized personnel only **Why it matters:** We've seen businesses that thought they had backups discover during a crisis that their backups had been failing for weeks. Regular testing is the only way to know for sure. Immutable backups are what save you when ransomware tries to encrypt your backup data along with everything else. ## 6. Security Awareness and Training Your employees are the last line of defense, and often the first point of failure. Training turns them from a vulnerability into an asset. - [ ] All employees complete security awareness training during onboarding - [ ] Ongoing training is conducted at least quarterly - [ ] Training covers phishing, social engineering, password hygiene, and data handling - [ ] Phishing simulations are conducted monthly - [ ] Simulation results are tracked and used to target additional training - [ ] Employees know how to report suspicious emails and activity - [ ] There is a clear, no-blame policy for reporting potential security incidents **Why it matters:** Even with perfect technical controls, a well-crafted phishing email can trick someone into handing over credentials or installing malware. Regular training and simulations reduce click rates dramatically. The no-blame reporting policy is critical because you want people to speak up immediately, not hide a mistake out of fear. ## 7. Policies and Documentation If it's not written down, it doesn't exist from a compliance and audit perspective. - [ ] Information security policy exists and is reviewed annually - [ ] Acceptable use policy covers employee technology use - [ ] Incident response plan is documented and has been rehearsed in the past year - [ ] Business continuity and disaster recovery plans are documented - [ ] Data classification policy defines how different types of data should be handled - [ ] Vendor management policy addresses third-party security requirements - [ ] All policies are accessible to employees and acknowledged in writing **Why it matters:** Documentation isn't just about compliance. It's about making sure everyone knows the rules and there's no ambiguity when an incident happens. The incident response plan in particular needs to be rehearsed, not just written. ## 8. Compliance and Regulatory Depending on your industry, you may have specific regulatory obligations. Even if you don't think you do, it's worth checking. - [ ] You've identified which regulations apply to your business (FTC Safeguards, HIPAA, CMMC, PCI-DSS, state privacy laws) - [ ] A designated individual is responsible for your information security program - [ ] Risk assessments are conducted at least annually - [ ] Penetration testing or vulnerability assessments are performed annually - [ ] Cyber insurance policy is in place and covers ransomware, business interruption, and regulatory fines - [ ] Insurance requirements are aligned with your actual security controls **Why it matters:** Regulatory fines are increasing, and cyber insurance carriers are getting pickier about what they'll cover. If your security controls don't match what you told your insurer, a claim could be denied. ## How to Use This Checklist Don't try to fix everything at once. Here's a practical approach: 1. **Score yourself honestly.** Go through each item and mark it yes, no, or partial. 2. **Identify the critical gaps.** MFA, EDR, and backups are the big three. If any of those are missing, start there. 3. **Build a 90-day plan.** Pick the highest-impact items and commit to addressing them in the next quarter. 4. **Get outside eyes.** An internal review is a great start, but an external assessment will catch things you missed. If you'd like help running through this assessment for your specific environment, we do this for businesses across the Inland Empire every week. It takes a couple of hours and you'll walk away with a prioritized action plan. No cost, no obligation. **[Download the PDF checklist](/downloads/it-security-assessment-checklist.pdf)** and share it with your team. --- # 5 Signs It's Time to Switch IT Providers URL: https://etoptechnology.com/blog/signs-time-to-switch-it-providers/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-02-08 Here's a conversation I have at least once a month. A business owner calls us and says something like: "I'm not even sure if our IT company is doing a good job. I don't know what questions to ask." That uncertainty? That's already a red flag. A good IT provider should make technology feel like it's working for you, not something you're constantly worried about. If you're spending mental energy wondering whether your IT is solid, something is off. Here are five signs it might be time to make a change. ## Sign 1: You Only Hear From Them When Something Breaks This is the biggest one, and it's surprisingly common. Your IT provider shows up (or logs in) when there's a problem, fixes it, and disappears until the next fire. That's not managed IT. That's break-fix with a monthly invoice. A real managed IT partner should be proactively monitoring your systems, patching vulnerabilities before they become problems, and reaching out to you with recommendations. You should be hearing from them about upcoming changes, security updates, and strategic planning, not just when the server goes down. If your relationship with your IT provider is purely reactive, you're not getting what managed IT is supposed to deliver. The whole point is that someone is watching the dashboard so you don't have to. ## Sign 2: Security Feels Like an Afterthought Ask your current provider these questions: - When was our last security assessment? - Do all our users have multi-factor authentication enabled? - What's our backup and recovery plan, and when was it last tested? - Are our endpoints running EDR (endpoint detection and response) or just basic antivirus? - Do we have a documented incident response plan? If they can't answer these clearly and confidently, that's a problem. Cybersecurity isn't a nice-to-have anymore. [Verizon's 2025 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) found ransomware involved in 88% of breaches at small and mid-size businesses, and [IBM puts the average breach](https://www.ibm.com/reports/data-breach) at $4.44 million globally — over $10 million in the United States. Your IT provider should be talking to you about security regularly, not waiting for you to bring it up. The standard has moved well past basic antivirus — and these questions are a fair, friendly way to find out where your environment actually stands. ## Sign 3: No Strategic Guidance or Technology Roadmap Your IT provider should be more than a help desk. They should understand your business goals and help you use technology to get there. That means regular strategic conversations, at least quarterly, about things like: - Where are we spending too much on legacy systems? - What tools could help our team work more efficiently? - How is our IT environment positioned to support growth? - Are we taking advantage of the licenses and tools we're already paying for? We call this a technology roadmap, and it's one of the most valuable things a good IT partner provides. Without it, you're just maintaining the status quo. Technology should be an accelerator for your business, not just something that keeps the lights on. If your IT provider never talks to you about strategy and all conversations are about tickets and problems, they're functioning as a vendor, not a partner. There's a big difference. ## Sign 4: Slow Response Times and Poor Communication When something goes wrong with your technology, minutes matter. If your employees are sitting around waiting for a response to a support ticket, that's money walking out the door. Here's what you should expect from a decent IT provider: - Every request triaged and dispatched based on urgency and business impact, so critical issues get immediate attention - Clear communication about what's happening and when it will be resolved - A ticketing system where you can see the status of your requests - Regular updates during outages or major incidents But it's not just about speed. It's about communication quality. Your IT provider should explain things in language your team understands. If every interaction leaves you more confused than when you started, that's a communication problem, and it usually points to deeper organizational issues on their end. For a business that depends on technology to operate, waiting days for help on issues that block someone's work isn't acceptable. Your IT partner's response should match the urgency of your business needs — and you should know what that looks like before anything goes wrong, not after. ## Sign 5: You've Outgrown Their Capabilities This one is tough because it's not always the provider's fault. Maybe they were great when you were a 15-person office with simple needs. But now you're at 60 employees, you've added a second location, you're dealing with compliance requirements, and you need cloud strategy guidance. Not every IT provider scales well. Signs you've outgrown yours include: - They can't support the compliance frameworks your industry requires (HIPAA, FTC Safeguards, state privacy laws) - They don't have experience with your line-of-business applications - They're recommending consumer-grade solutions for enterprise problems - They seem overwhelmed by your ticket volume - They push back on projects that feel straightforward to you Growth is good. Your IT provider should be growing with you, or telling you honestly when something is outside their wheelhouse — that honesty is a mark of a good provider, not a failure. If the gaps are showing and the conversation isn't happening, it's time to start it yourself. ## What to Look For in a New IT Partner If you recognized your current provider in a few of those signs, here's what to look for when evaluating alternatives: **Proactive monitoring and maintenance.** They should be watching your systems 24/7, not waiting for you to report problems. **Security-first mindset.** Ask about their security stack. You want to hear things like EDR, SIEM, MFA, security awareness training, and incident response planning. If they lead with "we install antivirus," keep looking. **Strategic alignment.** Look for a provider that asks about your business goals before they start talking about technology. The best IT partners start with "where is your business going?" not "what servers do you have?" **Transparent pricing.** You should know exactly what you're paying for and what's included. If you're getting surprise invoices for things you thought were covered, that's a pricing transparency problem. **Local presence with enterprise capability.** Especially here in the Inland Empire, having a partner who understands the local business landscape matters. But they also need the technical depth to handle complex projects. ## How to Transition Without the Headache Switching IT providers feels scary. We get it. You're worried about downtime, about things falling through the cracks, about the "what if" scenarios. But a good IT partner will make the transition smooth because onboarding is a practiced, structured process for them — not an improvisation. Here's what a well-managed transition looks like: 1. **Discovery and documentation** of your current environment 2. **Parallel operation** where the new provider gets up to speed while the old one is still active 3. **Credential transfer and access changeover** handled methodically 4. **Employee communication** so your team knows who to call and how to submit tickets 5. **30-day stabilization period** with extra attention and faster response times Staying with a provider that's not meeting your needs out of fear of change is usually the most expensive option on the table — the cost just doesn't show up as a line item. If any of these signs hit close to home, let's have a conversation about what better IT support looks like for your business. --- # IT Challenges for Construction Companies: Jobsite to Back Office URL: https://etoptechnology.com/blog/it-challenges-construction-companies/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-02-07 I've been in enough construction trailers to know what the technology situation actually looks like. There's a dusty laptop running Procore on satellite internet, a foreman trying to pull up blueprints on a phone with a cracked screen, and a project manager back at the main office who can't figure out why the file server is running slow again. That's the reality of IT for construction companies, and most IT providers don't understand it because they've never had to support a business where half the workforce moves to a new location every few months. Construction is not a desk job. Your technology can't pretend it is. ## Field Device Management Is a Nightmare (If You Let It Be) Here's the first thing that trips up construction companies: you've got devices everywhere. iPads on jobsites, laptops in trailers, personal phones accessing company email, and that one superintendent who refuses to use anything but his 2019 Android phone. Every one of those devices is a door into your company data. The question isn't whether your field crews need mobile devices. They do. The question is whether those devices are managed, secured, and replaceable when someone drops a tablet into wet concrete. (It happens more than you'd think.) What you actually need is a Mobile Device Management (MDM) solution that lets you: - **Push apps and updates** to every device without physically touching them - **Wipe a lost or stolen device** remotely before someone accesses your bid documents - **Enforce security policies** like screen locks and encryption without making the devices unusable in the field - **Separate personal and work data** on phones so your superintendent's fishing photos and your project files don't mix This isn't optional anymore. If you're bidding government projects or working with general contractors who have security requirements in their subcontracts, they're going to ask about this. Get ahead of it. ## Connectivity Across Multiple Jobsites Every active project is essentially a temporary branch office. And unlike a real branch office, you can't call Spectrum and get a fiber line run to a foundation pour that'll be done in four months. The connectivity challenge is real. Your options on most jobsites are: - **Cellular hotspots and boosters** for short-term projects - **Fixed wireless or point-to-point links** for longer builds where you need reliable bandwidth - **Starlink** for remote sites where cell service is spotty (we've been deploying these more and more in the IE and high desert) - **Bonded connections** that combine multiple cellular signals for better reliability Whatever you use, you need a VPN (Virtual Private Network) back to your main office so your field teams can access shared drives, accounting systems, and project management platforms securely. This is where a lot of construction companies get it wrong. They set up internet at the trailer but don't secure the connection. That means project data, payroll information, and bid numbers are floating across an open connection. A properly configured site-to-site VPN with failover takes about an hour to set up per location and costs next to nothing compared to what you're spending on that project. There's no excuse for not doing it. ## Project Management Software Needs Real IT Support Procore, PlanGrid, Bluebeam, Sage, Viewpoint. These aren't simple apps. They're the operational backbone of your business, and when they go down or run slow, your entire team feels it. The problem we see constantly is that construction companies buy these platforms but never properly integrate them. They're running Procore in the cloud but their accounting is still on an on-premise Sage server that hasn't been updated in two years. When these systems go down, the [cost of that downtime](/blog/cost-of-it-downtime/) hits harder than most owners realize. Field crews submit daily logs in PlanGrid, but the data doesn't flow anywhere useful because nobody set up the integrations. Your project management stack should work as a system, not as a collection of standalone tools. That means: - **Single sign-on** so your team isn't managing 15 different passwords (they're not managing them, they're reusing the same password, which is worse) - **Cloud-hosted or properly replicated** so field and office teams access the same data in real time - **Integrated with your accounting platform** so job costing doesn't require someone to manually re-enter data - **Backed up independently** even if the vendor says they handle backups. Trust but verify. If your IT person doesn't understand how Procore talks to Sage or how Bluebeam workflows actually function on a construction project, they're going to struggle to support you. This is specialized knowledge, and it matters. ## Document Control Can Make or Break a Project Construction generates an absurd volume of documents. RFIs (Requests for Information), submittals, change orders, daily logs, safety reports, as-builts, inspection records. Every one of these has to be stored, versioned, and retrievable, sometimes years after the project closes out. I've seen construction companies lose bids because they couldn't produce documentation from a previous project fast enough. I've seen disputes go sideways because the version of the drawing on the jobsite didn't match what was in the office. These aren't IT problems in the traditional sense, but they're absolutely problems that IT solves. A proper document management approach for construction includes: - **Cloud storage with version control** so everyone is always looking at the current document - **Permissions by role** so subcontractors see what they need to see and nothing else - **Retention policies** that keep project files accessible for the legally required period (varies by contract but often 5 to 10 years) - **Offline access** because your superintendent in a basement two floors below grade doesn't have WiFi This ties directly into your project management platform. If you're already in Procore, use its document management. If you're using a mix of tools, make sure they're connected and that nothing falls through the cracks. ## Bonding, Insurance, and the IT Requirements Nobody Talks About Here's something that catches construction companies off guard: your bonding company and insurance carrier are starting to ask about your cybersecurity posture. It's not universal yet, but the trend is clear. If you're bidding projects that require payment and performance bonds, the surety company wants to know you're not going to get hit with ransomware in the middle of a $10 million project. We've had clients come to us because their insurance renewal included a cybersecurity questionnaire for the first time. Questions like: - Do you use multi-factor authentication (MFA)? - Do you have endpoint detection and response (EDR) on all devices? - When was your last backup test? - Do you have an incident response plan? If you answer "no" to these, you're looking at higher premiums, reduced coverage, or flat-out denial. And if you answer "yes" but you're lying, that's a whole different problem when you actually need to file a claim. Getting your cybersecurity basics right keeps your bonding capacity intact, your insurance premiums manageable, and your ability to bid on projects that require these protections. ## What Should You Do About It? If you're running a construction company and your IT feels like it's held together with zip ties and good intentions, here's where to start: 1. **Audit your devices.** Know what's out there, who has it, and whether it's managed. If you can't wipe a device remotely, it's a risk. 2. **Secure your jobsite connections.** Every trailer with internet access should be on a VPN. Every one. No exceptions. 3. **Integrate your software stack.** Your project management, accounting, and document control should talk to each other. If they don't, you're paying people to move data manually, and that's where errors happen. 4. **Get your cybersecurity questionnaire answers to "yes."** MFA, EDR, backups, incident response plan. These are table stakes now, not nice-to-haves. 5. **Work with an IT provider who understands construction.** A provider who only knows how to support office workers in a single building is going to struggle with your multi-site, mobile-heavy, project-based environment. If you're thinking about making a switch, here's what [the first 90 days with a new IT provider](/blog/first-90-days-switching-it-providers/) should look like. We work with [construction companies across the Inland Empire](/it-services-construction-inland-empire/) who deal with exactly these challenges. The companies that treat IT as part of their operational infrastructure, not an afterthought, are the ones winning bigger projects and running tighter margins. If your technology is slowing you down instead of keeping up, that's a solvable problem. But it starts with understanding that construction IT is its own discipline, and treating it that way. Want to know where your gaps are? We'll do a straight-up assessment of your current setup, no fluff, no sales pitch. Just an honest look at what's working, what's not, and what it would take to fix it. [Start with a managed IT conversation](/managed-it-services/) and go from there. --- # What Happens in the First 90 Days After Switching IT Providers URL: https://etoptechnology.com/blog/first-90-days-switching-it-providers/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-02-03 The number one reason businesses stay with an IT provider that's no longer the right fit is fear. Fear of the transition. Fear of downtime. Fear that switching will somehow be worse than what they're dealing with now. I get it. Your technology environment is critical to your operations. The idea of someone new coming in and touching everything is uncomfortable. (If you're still in the evaluation phase, we put together [20 questions to ask before signing with any IT provider](/blog/it-provider-evaluation-guide/) that might help.) But here's what I tell every prospective client: provider transitions are a practiced, structured process — steps, checklists, checkpoints. And when you see the process laid out, the fear goes away. Let me walk you through exactly what happens in the first 90 days after you decide to switch. ## Days 1-14: Discovery and Documentation This is the most important phase, and it's the one most IT providers rush through. We don't. During the first two weeks, our engineering team does a comprehensive audit of your entire technology environment. We're documenting everything: - Network architecture: firewalls, switches, access points, VLANs, VPN configurations - Server inventory: what's running, what operating systems, what's the hardware age - Cloud services: Microsoft 365 configuration, Azure resources, AWS instances, SaaS applications - User accounts and access: who has access to what, admin accounts, service accounts - Security posture: current antivirus/EDR, MFA status, backup configuration, firewall rules - Licensing: what you're paying for, what you're actually using, what's redundant - Line-of-business applications: the specific software your team depends on daily - Existing documentation: whatever already exists, so nothing institutional gets lost in the move We also sit down with department heads and key users. Not to talk about technology, but to understand how they work. What frustrates them. Where they lose time. What tools they wish worked better. This context shapes everything we do going forward. The discovery phase usually uncovers things that surprise business owners. Expired SSL certificates. Admin accounts that belong to employees who left two years ago. Backup jobs that have been failing silently for months. It's not unusual, and it's exactly why we do this before we change anything. ## Days 14-21: The Credential Handoff This is the part that makes people nervous, so let me be direct about how it works. We work with your previous provider to transfer all credentials, administrative access, and vendor relationships. Domain registrar logins. Microsoft 365 global admin. Firewall admin access. Everything. Here's the reality: a professional IT provider, even one you're leaving, will cooperate with this process. It's industry standard, and in our experience the handoff is almost always cordial — everyone in this business understands that clients and providers sometimes outgrow each other. We handle this methodically. We have a credential transfer checklist that covers over 50 common access points. We verify each one. We change passwords and secure admin accounts as they're transferred. Nothing gets missed because we don't rely on memory. We rely on a process. During this overlap period, both providers are available. If something breaks, there's no gap in coverage. We're not asking you to jump from one trapeze to another with nothing below. There's a net. ## Days 21-45: Migration and Deployment Once we have full documentation and access, we start deploying our management and security tools. This is where the real work happens. **Monitoring agents** go on every endpoint and server. These give us real-time visibility into the health of every device in your environment. CPU usage, disk space, patch status, security alerts. If something starts going sideways at 3 AM on a Sunday, we know about it immediately. **Security stack deployment.** We roll out EDR (endpoint detection and response), configure email security policies, enable MFA where it isn't already active, and set up security awareness training for your team. This is usually the biggest immediate improvement clients notice. Going from basic antivirus to a real [cybersecurity](/cybersecurity-services-inland-empire/) stack is a significant jump in protection. **Backup verification.** We don't just check that backups are configured. We test them. We run recovery drills to make sure that if something goes down tomorrow, we can actually restore it. You'd be alarmed at how many businesses discover their backups don't work only when they need them. **Help desk onboarding.** We set up your team with our ticketing system, introduce them to the support process, and make sure everyone knows how to reach us. Phone, email, portal. We publish a simple one-page guide for your employees so there's no confusion about how to get help. This phase is where we also address the quick wins. Things we found during discovery that are easy to fix and have immediate impact. Maybe it's cleaning up a messy shared drive structure. Maybe it's finally enabling that Microsoft 365 feature you're paying for but not using. Maybe it's replacing a ten-year-old switch that's been causing intermittent network issues for months. ## Days 45-75: Stabilization This is the phase most IT providers skip, and it's the one that matters most for your team's experience. During stabilization, we're running at full speed but with extra attention. Response times are faster than normal. We're watching ticket patterns closely to identify recurring issues. We're meeting with your team weekly to check in and make sure nothing is falling through the cracks. This is also when we calibrate. Every business is different. Your team has preferences, habits, and workflows that we need to understand and adapt to. Maybe your accounting department needs extra hand-holding during month-end close. Maybe your sales team works weird hours and needs support at 7 AM. We learn this stuff during stabilization so that by the time we hit steady state, we already know your business. We also use this phase to address the medium-priority items from discovery. The server that needs to be replaced in the next six months. The firewall that's approaching end of life. The license audit that will save you $800 a month. These aren't emergencies, but they're important, and we start planning for them now. ## Days 75-90: Optimization and Roadmap By day 75, the reactive stuff is handled. Your systems are monitored, your security is deployed, your team knows how to get help, and the fires are out. Now we shift to strategic mode. We present you with a technology roadmap. This is a prioritized plan for the next 12 months that covers: - Infrastructure improvements that need to happen (aging hardware, network upgrades) - Security enhancements beyond the baseline we've already deployed - Efficiency opportunities (automation, better use of existing tools, workflow improvements) - Budget planning so there are no surprises - Compliance readiness if your industry requires it This roadmap is built on everything we learned during the first 90 days. It's not a generic template. It's specific to your business, your goals, and your current state. We also do a formal 90-day review with your leadership team. Here's what we found. Here's what we fixed. Here's where you stand now compared to where you were. Here's what we recommend going forward. Full transparency. ## What Your Team Actually Experiences I've described the process from our side. But what does your team experience during all this? Honestly? Not much disruption. That's the goal. The monitoring agents install silently. The security tools deploy in the background. Your employees get a brief intro to the new ticketing system. They might notice their computers running a little faster once accumulated clutter gets cleaned up — old software, forgotten agents, startup programs nobody remembers installing. And they'll notice that when they submit a ticket, the response comes quickly and the loop actually gets closed. That's the real measure of the first 90 days from your team's perspective: not what changed, but how little they had to think about it. ## The Fear vs. The Reality Let me be blunt: the fear of switching is almost always worse than the actual switch. Because the switch is a process. It has steps, timelines, and checkpoints. If the problems that got you thinking about a change are real — response times that don't match your needs, security gaps you can see, no strategic guidance — then those problems are the actual risk. They're the thing that doesn't have a plan. If you already have an internal IT person and you're not sure you need to fully outsource, [co-managed IT](/blog/co-managed-it-when-internal-needs-backup/) might be the right fit. The onboarding process is similar but scoped to the gaps your team needs filled. If you're considering a change, here's what I'd suggest. [Talk to us](/contact/). Let us do a discovery assessment of your current environment. We'll tell you honestly what we find, where the gaps are, and what a transition would look like for your specific situation. If we're a good fit, great. If not, at least you'll have a clear picture of where your IT stands. The first 90 days aren't something to fear. They're something to look forward to. Because at the end of them, your technology finally works the way it should. --- # What the FTC Safeguards Rule Means for Your Business in 2026 URL: https://etoptechnology.com/blog/ftc-safeguards-rule-2026/ Type: Article Category: Compliance Author: William “BJ” Pote Published: 2026-02-01 **Short answer:** the FTC Safeguards Rule requires any business the FTC treats as a "financial institution" (a list that includes tax preparers, accountants, auto dealers that arrange financing, mortgage brokers and insurance agencies) to run a written information security program. That means a named Qualified Individual, a written risk assessment, MFA and encryption for customer data, staff training, an incident response plan and oversight of vendors. To comply, assess your gaps, fix the technical controls, then document everything. If you run a business that handles any kind of financial information, there's a good chance the FTC Safeguards Rule applies to you. And if you haven't taken a hard look at your IT security posture recently, 2026 is the year to do it. We talk to business owners across the Inland Empire every week, and the most common reaction we get when we bring up the Safeguards Rule is something like: "Wait, that applies to us?" The short answer is probably yes, and the penalties for non-compliance aren't theoretical anymore. ## What Is the FTC Safeguards Rule? The FTC Safeguards Rule is part of the Gramm-Leach-Bliley Act, and it requires "financial institutions" to develop, implement, and maintain a comprehensive information security program. Now, before you tune out because you're not a bank, here's the thing: the FTC defines "financial institution" way more broadly than you'd expect. If your business is involved in any of the following, you're likely covered: - Tax preparation or accounting services - Auto dealerships that arrange financing - Mortgage brokers and real estate settlement services - Investment advisory firms - Insurance agencies - Payday lenders and check cashing services - Businesses that wire money or provide financial data processing - Collection agencies That's a lot of businesses that don't think of themselves as "financial institutions." But the FTC does. ## What Does the FTC Safeguards Rule Require? The updated rule, which went into full effect in 2023 and continues to be actively enforced, lays out specific technical and administrative requirements. This isn't a "do your best" situation. There are concrete things you need to have in place. **Designate a Qualified Individual.** Someone needs to be responsible for your information security program. This can be an internal employee or an outsourced provider like a managed IT partner. But there has to be a named person accountable. **Conduct a Risk Assessment.** You need a written risk assessment that identifies internal and external threats to customer information. This needs to be updated regularly, not just done once and filed away. **Implement Specific Safeguards.** This is where it gets technical. The rule requires: - Access controls to limit who can view customer information - Encryption of customer data both in transit and at rest - Multi-factor authentication for anyone accessing customer information - Inventory of all systems and devices that store or process customer data - Continuous monitoring or annual penetration testing and vulnerability assessments - Secure disposal procedures for customer data - Change management processes for your information systems **Employee Training.** Your team needs regular security awareness training. Not a one-time video they click through during onboarding, but ongoing education about phishing, social engineering, and data handling procedures. **Incident Response Plan.** You need a documented plan for what happens when (not if) a security incident occurs. Who do you call? How do you contain the damage? How do you notify affected customers? **Vendor Management.** If you share customer data with service providers, you need to assess their security practices and contractually require them to maintain appropriate safeguards. ## Common Compliance Gaps We See After working with dozens of businesses on compliance, we see the same gaps over and over: **No MFA on critical systems.** Multi-factor authentication is non-negotiable under the Safeguards Rule, but we still find businesses where email, accounting software, and even network access are protected by passwords alone. **No encryption on laptops and mobile devices.** If an employee's laptop gets stolen from their car, is the data on it encrypted? For a surprising number of businesses, the answer is no. **No documented policies.** Many businesses have decent security practices in place informally but nothing written down. The FTC wants to see documentation. If it's not documented, it didn't happen. **Stale risk assessments.** A risk assessment from 2022 doesn't cut it. Your business has changed, the threat landscape has changed, and your assessment needs to reflect current reality. **No incident response plan.** This is one of the most commonly missing pieces. Businesses assume they'll figure it out if something happens. That's not a plan, and it's not compliant. ## How Do I Make My Business Compliant With the FTC Safeguards Rule? Getting compliant doesn't have to be overwhelming, but it does require a systematic approach. Here's how we walk businesses through it: **Step 1: Assess where you stand.** We do a gap analysis comparing your current security posture against the Safeguards Rule requirements. This gives you a clear picture of what's missing. **Step 2: Prioritize by risk.** Not everything needs to happen at once. We help you prioritize based on what poses the greatest risk to customer data and what the FTC is most likely to look for. **Step 3: Implement the technical controls.** This is where we deploy MFA, encryption, monitoring tools, access controls, and backup systems. For most businesses, this takes 4 to 8 weeks. **Step 4: Build the documentation.** Policies, procedures, risk assessments, incident response plans. We help you create these so they're thorough but practical, not 200-page documents nobody reads. **Step 5: Train your team.** We set up ongoing security awareness training that keeps your employees sharp without eating up their entire workday. **Step 6: Monitor and maintain.** Compliance isn't a one-time project. We provide continuous monitoring, regular assessments, and policy updates so you stay compliant as things change. ## The Cost of Getting It Wrong The FTC has been increasingly aggressive about enforcement. Fines can reach into the millions, and that's before you factor in the reputational damage of a breach. For businesses in the Inland Empire competing for local trust and relationships, a compliance failure can be devastating. But here's what we tell clients: the cost of compliance is a fraction of the cost of a breach. The same controls that make you compliant also make you significantly harder to attack. It's not just a checkbox exercise. It's genuinely better security for your business. ## Let's Figure Out Where You Stand If you're not sure whether the Safeguards Rule applies to your business, or you know it does and you're not sure where you stand, we can help. We offer a free compliance assessment that gives you a clear picture of your gaps and a practical roadmap to close them. No pressure, no scare tactics. Just a straightforward look at where you are and what it takes to get compliant. --- # Incident Response Planning: The 6-Step Playbook for SMBs URL: https://etoptechnology.com/blog/incident-response-planning/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-01-29 It's 6:47 AM on a Tuesday. You get a call from your office manager. Nobody can open their files. Every computer is showing a red screen with a bitcoin address and a countdown timer. Your phone starts blowing up. Employees are texting, clients are emailing, and you have no idea what to do first. That's what a ransomware attack feels like without an incident response plan. Now let me tell you what it feels like with one: you pull up the plan, you call the first number on the list, the containment steps start immediately, and everyone knows their role. Still stressful. But controlled. An incident response plan (IRP) is a documented playbook that tells your organization exactly what to do when a security incident happens. Not if. When. And if you have [cyber insurance](/blog/cyber-insurance-requirements-2026/), your policy almost certainly requires you to have one. Here are the six steps. ## Step 1: Prepare This is everything you do before an incident happens. It's the most important step because it determines how the other five go. ### Build Your Response Team Even at a 30-person company, you need defined roles. Not a full-time security team, just people who know their responsibilities: - **Incident Commander**: Usually the business owner or operations leader. Makes the big decisions during an incident (do we shut down operations, do we notify clients, do we pay the ransom). - **IT Lead**: Your internal IT person or your managed IT provider. They run the technical response. - **Communications Lead**: Handles internal and external communications. Employees, clients, vendors, media if it comes to that. - **Legal Contact**: Your attorney, ideally one with data breach experience. You'll need them for regulatory obligations. - **Insurance Contact**: Your cyber insurance carrier's breach hotline number. This needs to be called early, not after you've already made decisions they should have been involved in. ### Document Your Critical Systems Make a list of every system your business needs to operate, ranked by priority. When you're deciding what to restore first, this list eliminates arguments and guesswork. Your list should include: - System name and function - Where it's hosted (on-premises, cloud, vendor) - Who's responsible for it - Recovery time objective (how long can you be without it) - Dependencies (what else breaks if this system is down) ### Have the Right Tools in Place Your ability to respond depends on what tools are already deployed. If you don't have [EDR](/blog/what-is-edr/) (Endpoint Detection and Response) on your machines when an incident starts, you can't magically deploy it in the middle of a crisis. Preparation means having: - EDR on all endpoints and servers - Tested, immutable backups - Network monitoring and logging enabled - An offline copy of your incident response plan (if your network is down, a plan stored only on your file server is useless) ### Run Tabletop Exercises Once a year, gather your response team and walk through a scenario. "It's Tuesday morning and ransomware has encrypted all our file shares. What do we do?" Talk through each step. Find out where the plan breaks down. Fix those gaps. A tabletop exercise costs you two hours. Figuring out your plan doesn't work during an actual incident costs you everything. ## Step 2: Identify You can't respond to what you don't know about. Identification is the process of detecting that an incident is happening, determining what type of incident it is, and assessing the scope. ### Detection Sources Incidents get detected through multiple channels: - **EDR/security alerts**: Your endpoint protection flags suspicious behavior - **Employee reports**: Someone notices something weird, like unexpected password reset prompts or files they can't open - **Vendor notifications**: Your IT provider, your bank, or a business partner tells you something looks off - **External notification**: Law enforcement or a security researcher contacts you (this happens more than you'd think) ### Initial Assessment Questions When you think you have an incident, you need to quickly answer: - **What type of incident is it?** Ransomware, data theft, business email compromise, unauthorized access? - **How widespread is it?** One machine, one department, the entire network? - **Is it still active?** Is the attack ongoing or has the damage already been done? - **What data is potentially affected?** Client data, employee records, financial information, intellectual property? The answers to these questions determine how aggressive your containment needs to be. A single phishing email on one workstation is a different response than active ransomware spreading across your network. ## Step 3: Contain Containment is about stopping the bleeding. You're not fixing anything yet. You're making sure it doesn't get worse. There are two types of containment: ### Short-Term Containment (First Hour) This is the "stop the bleeding" phase. Actions include: - **Isolate affected machines** from the network. Don't power them off (you'll lose forensic data). Disconnect the network cable or disable the Wi-Fi. If you have EDR, use it to isolate the endpoint remotely. - **Disable compromised accounts.** If credentials were stolen, disable those accounts immediately. All of them, including service accounts. - **Block attacker access.** If you can identify how they got in (a specific IP, a compromised VPN account, a malicious email rule), block it now. - **Preserve evidence.** Do not wipe machines, do not reinstall, do not delete logs. Your forensic investigators and your insurance company will need this data. ### Long-Term Containment Once the immediate bleeding has stopped, you set up temporary measures to keep operating while you work the problem: - Stand up clean systems from known-good backups for critical business functions - Implement additional monitoring on unaffected systems - Change all passwords, starting with administrative and privileged accounts - Apply any patches that address the vulnerability the attacker exploited ### The First Hour Checklist Tape this to the wall next to your server room. Seriously. 1. Call your IT provider/incident commander 2. Call your cyber insurance breach hotline 3. Isolate affected systems (network disconnect, NOT power off) 4. Disable compromised user accounts 5. Preserve all logs and evidence 6. Do NOT communicate externally until legal is consulted 7. Document everything with timestamps That sixth point is important. Do not send an email to clients saying "we've been hacked" before your attorney reviews it. What you say in the first hours of an incident can have legal and regulatory consequences. ## Step 4: Eradicate Now that the incident is contained, you find and remove the root cause. This is where you figure out exactly how the attacker got in and make sure that door is closed. Eradication typically involves: - **Identifying the attack vector.** Was it a phishing email? An unpatched vulnerability? A compromised vendor? Stolen credentials from a previous breach? - **Removing malware and attacker tools.** Every backdoor, every persistent access mechanism, every piece of malicious software. - **Patching the vulnerability** that was exploited. - **Scanning all systems** to make sure the attacker didn't leave anything else behind. This is where forensic investigation happens. A skilled investigator will trace the attacker's path through your environment, identify everything they touched, and determine what data they may have accessed or stolen. Do not skip this step. We've seen businesses rush to recovery without proper eradication, only to have the attacker come back in through the same door a week later. ## Step 5: Recover Recovery is getting back to normal operations, and every hour matters. We've broken down [what downtime actually costs a mid-size business](/blog/cost-of-it-downtime/), and the numbers are sobering. This is where your preparation in Step 1 pays off, specifically your system priority list and your backups. ### Recovery Priorities Bring systems back in order of business criticality: 1. **Core infrastructure**: Active Directory, DNS, networking 2. **Communication**: Email, phones, messaging 3. **Revenue-critical applications**: ERP, billing, client-facing systems 4. **Everything else**: Brought back systematically with verification ### Recovery Best Practices - **Rebuild from clean images or known-good backups.** Do not try to "clean" a compromised machine. Wipe it and rebuild. - **Verify before reconnecting.** Every system that comes back online should be scanned and verified clean before it touches the production network. - **Monitor intensively.** For the first 30 days after recovery, increase monitoring. Watch for any signs the attacker maintained access. - **Reset all credentials.** Every password, every API key, every service account. Assume everything was compromised. - **Communicate with stakeholders.** Your employees need to know what happened and what's different. Your clients may need to be notified depending on the type of data involved and your regulatory obligations. ## Step 6: Learn This is the step everyone skips, and it's the step that prevents the next incident from being just as bad. Within two weeks of recovery, hold a post-incident review. No blame. Just facts and improvements. ### Review Questions - How did the attacker get in, and why did our defenses miss it? - How quickly did we detect the incident? Can we detect faster? - Did the incident response plan work? What broke? - Were roles and responsibilities clear? - What tools or capabilities were we missing? - What would we do differently? ### Update Everything Based on the review, update: - Your incident response plan - Your security controls and policies - Your employee training (address the specific attack vector) - Your backup and recovery procedures - Your [cybersecurity services](/cybersecurity-services-inland-empire/) and monitoring Document the lessons learned and share them with the team. The incident already happened. The only way to get value from it is to make sure it doesn't happen the same way twice. ## You Need This Plan Before You Need It The worst time to write an incident response plan is during an incident. The best time is right now. You don't need a 50-page document. You need a clear, practical playbook that your team can follow under pressure. Contact list, role assignments, containment steps, communication templates, recovery priorities. Keep it to 10 pages or less and make sure it's accessible even when your network is down (print it out, put it in a shared cloud drive outside your corporate environment, or both). If you're not sure where to start, or if you have a plan that hasn't been updated since it was written, we can help. Our [managed IT services](/managed-it-services/) include incident response planning, tabletop exercises, and the security infrastructure that makes the plan work when you need it. [Reach out for a security assessment](/contact/) and we'll help you build a plan that actually holds up when it matters. --- # Zero Trust Security: What It Actually Means for a 50-Person Company URL: https://etoptechnology.com/blog/zero-trust-security-explained/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-01-24 Every cybersecurity vendor on the planet is throwing around "zero trust" like it's a magic button you press to become secure. It's not. Zero trust is not a product. You can't buy it in a box. It's a framework, a way of thinking about who gets access to what and under what conditions. And here's the thing. It's not just for Fortune 500 companies with massive security budgets. A 50-person company can, and should, implement zero trust principles. You're probably already using some of them without realizing it. ## What Zero Trust Actually Means The old way of doing security was like a castle with a moat. Everything inside the castle walls was trusted. Everything outside was not. Once you got past the firewall, you were "in" and could access pretty much anything. Zero trust throws that model out. The core idea is simple: never trust, always verify. Every user, every device, every connection has to prove it should have access, every single time. Being "inside the network" doesn't automatically mean you're trusted. Think of it this way. The castle-and-moat approach is like a building where you show your ID at the front door and then have free run of the entire building. Zero trust is like a building where every room has its own lock, every door checks your badge, and the system knows whether you should be in that room at that time of day from that device. ## The Three Pillars That Actually Matter for Your Business You can make zero trust really complicated. Vendors love to do that because complicated means more products to sell. But for a 50-person company, there are three things that deliver 90% of the value. ### 1. Multi-Factor Authentication (MFA) on Everything MFA means requiring a second form of verification beyond just a password. Usually a push notification to your phone or a code from an authenticator app. You've probably already set this up for your bank. Here's why this is the single most impactful thing you can do. Over 80% of breaches involve compromised credentials. Someone gets your password through phishing, a data breach, or just guessing. With MFA, that stolen password is useless by itself. But here's where most businesses fall short. They turn on MFA for email and call it done. Zero trust means MFA on everything. Your VPN, your cloud applications, your file shares, your line-of-business apps. If it holds company data, it needs a second factor. Walk through a typical 45-person accounting firm. MFA on email, but not on the remote desktop connections. An attacker gets an employee's password from a phishing email and logs straight into the remote desktop server. From there, they have access to every client tax return on the network. MFA on that one connection point stops the entire attack. ### 2. Conditional Access Policies This is where zero trust gets really powerful, and it's built right into Microsoft 365, which most businesses are already paying for. Conditional access lets you set rules about when and how people can access company resources. Instead of just "do you have the right password and MFA code," you can ask: - **Where are you?** If someone is logging in from a country you don't do business in, block it or require extra verification. - **What device are you using?** If it's a personal laptop that isn't managed by your company, maybe they only get web access to email, not the ability to download attachments. - **Is your device healthy?** If the machine doesn't have current security patches or doesn't have [EDR](/blog/what-is-edr/) installed, deny access until it's fixed. - **What are you trying to access?** Your HR system with salary data might require stricter conditions than your general company intranet. - **What's the risk level?** If Microsoft's AI detects a risky sign-in (impossible travel, anonymous IP, leaked credentials), require step-up authentication or block entirely. Here's what that looks like in practice. Set up conditional access so the finance team can only access the accounting system from company-managed devices, during business hours, from the United States. An attacker who compromises a finance employee's credentials from overseas at 11 PM can't get in, even with the right password and MFA code. The conditional access policy stops it cold. ### 3. Least Privilege Access This one sounds obvious but almost nobody does it well. Least privilege means people only get access to what they need to do their job. Nothing more. In most 50-person companies, the access situation looks something like this: everyone is a local admin on their laptop, half the company has access to the shared drive with HR files, three people still have the credentials of an employee who left two years ago, and the owner's account is a domain admin because "it's easier." Zero trust says every one of those is a risk. And it's right. Implementing least privilege doesn't mean making everyone's life difficult. It means being intentional about access: - **Remove local admin rights** from standard user accounts. If someone needs to install software, it goes through IT. - **Segment your file shares.** Finance sees finance files. HR sees HR files. Not everyone sees everything. - **Review access quarterly.** When someone changes roles or leaves, their access should change the same day. - **Use separate admin accounts.** Your IT admin shouldn't browse the web and check email with the same account that has domain admin rights. ## What This Costs a 50-Person Company Here's the part that surprises people. Most of the zero trust fundamentals are either free or included in licensing you're already paying for. If you're on Microsoft 365 Business Premium (which most of our clients are because it includes security features worth the upgrade), you already have: - MFA through Microsoft Entra ID (formerly Azure AD) - Conditional access policies - Device compliance policies through Intune - Microsoft Defender for Business (an EDR solution) The licensing cost difference between Business Basic and Business Premium is roughly $16 per user per month (Basic runs about $6, Premium about $22). For 50 users, that's about $800 a month. What you get for that $800 is a security stack that would have cost tens of thousands of dollars just five years ago. The real cost is in the implementation and management. Setting up conditional access policies correctly takes expertise. Getting least privilege right without breaking workflows takes someone who understands both security and your business operations. That's where a [managed IT services](/managed-it-services/) provider earns their keep. ## Common Pushback and Real Answers **"This is going to slow everyone down."** Done right, zero trust is nearly invisible to users. They tap a notification on their phone for MFA. Their device is already compliant because IT manages it. The conditional access policies run in the background. The only time someone notices is when something unusual happens, and that's exactly the point. **"We're too small to be a target."** We covered this in our [EDR post](/blog/what-is-edr/), but it bears repeating. Attackers automate their scanning. They don't check your employee count before trying your credentials. Small businesses get hit because they assume they won't be. **"Our employees will complain."** Some will. Briefly. Then they'll get used to it. You know what employees complain about a lot more? When the company gets hit with ransomware and they can't work for two weeks. Or when their personal information gets leaked because the company didn't protect its systems. (And if you don't have an [incident response plan](/blog/incident-response-planning/) ready for that scenario, two weeks might be optimistic.) ## What You Should Do This Week 1. **Audit your MFA coverage.** Don't just check if it's "on." Check if it's enforced on every application that touches company data. Email, VPN, cloud apps, remote access, all of it. 2. **Look at your Microsoft 365 licensing.** If you're on Business Basic or Standard and not Business Premium, you're leaving critical security tools on the table. The upgrade pays for itself the first time it stops an attack. 3. **List who has admin access.** To your network, your cloud environment, your applications. If you can't produce that list in 10 minutes, that's a problem. 4. **Get a security assessment.** A proper assessment will map out where zero trust principles are already in place and where the gaps are. We do this for businesses across the [Inland Empire and Southern California](/cybersecurity-services-inland-empire/), and it's the fastest way to get a clear picture. ## The Bottom Line Zero trust isn't a product, and it's not just for big companies. It's a set of principles that, when implemented correctly, dramatically reduce your attack surface. The tools are available, the costs are reasonable, and the alternative is hoping you don't get hit. Hope is not a security strategy. If you want to see where your business stands on zero trust readiness, [book an intro call](/contact/). We'll show you exactly what's in place, what's missing, and what to prioritize first. --- # Co-Managed IT: When Your Internal IT Team Needs Backup URL: https://etoptechnology.com/blog/co-managed-it-when-internal-needs-backup/ Type: Article Category: Managed IT Author: William “BJ” Pote Published: 2026-01-20 Your internal IT person is probably good at their job. Maybe even great. But here's the reality: one person, or even a small team, cannot be an expert in networking, cybersecurity, cloud infrastructure, compliance, end-user support, and strategic planning all at the same time. Nobody can. The technology stack is too broad and moves too fast. That's not a knock on your IT team. That's just math. Co-managed IT exists to solve this problem. It's not about replacing your internal people. It's about giving them the backup, tools, and specialized expertise they need to actually succeed. ## What Co-Managed IT Actually Is Let me clear up a common misconception first. Co-managed IT is not the same as outsourcing your IT. With full [managed IT](/managed-it-services/), we take over the entire technology function. Your help desk, your monitoring, your security, your strategy. All of it. Co-managed IT is different. Your internal IT team stays in place. They keep doing what they're good at. We come alongside them and fill specific gaps. Maybe that's 24/7 monitoring and alerting. Maybe it's cybersecurity expertise. Maybe it's just having a help desk that can handle the routine password resets and printer issues so your IT person can focus on projects that actually move the business forward. The model is flexible. We design it around what your team needs, not around a one-size-fits-all package. ## When Co-Managed IT Makes Sense Over 12 years of doing this, I've seen the same patterns over and over. Here are the situations where co-managed IT is almost always the right call. ### Your IT Person Is Drowning This is the most common one. You hired a solid IT generalist. They were keeping up fine when you had 30 employees and a simple network. Now you're at 75 employees, you've added a second location, you're dealing with compliance requirements, and your IT person is spending all day putting out fires instead of working on the infrastructure improvements you both know are overdue. They're not underperforming. They're overwhelmed. There's a difference. Adding co-managed support takes the reactive stuff off their plate. We handle the monitoring, the alerts, the routine tickets. Your IT person gets to focus on projects, strategy, and the things that actually require knowledge of your specific business. ### You Need Security Expertise Cybersecurity is a full-time discipline. Expecting your generalist IT person to also be a security expert is like expecting your family doctor to perform brain surgery. They understand the fundamentals, but the specialized work requires specialized skills. With [co-managed IT](/co-managed-it-services/), we bring the security stack and the expertise to run it. EDR (endpoint detection and response), SIEM (security information and event management), vulnerability scanning, security awareness training, incident response planning. Your IT person gets the benefit of an entire security team without you having to hire one. Picture a 90-employee manufacturing company. The IT director is sharp but has zero bandwidth for security. He's patching when he can, running basic antivirus, and hoping for the best. That's exactly the environment where an early-stage credential compromise sits unnoticed for weeks. A proper security stack with 24/7 monitoring catches that suspicious activity in the first week. Basic antivirus never sees it. ### Vacation and Sick Coverage Here's a question I ask business owners: what happens when your IT person goes on vacation? Or gets sick? Or quits? If the answer is "we just hope nothing breaks," that's not a plan. That's a prayer. And when something does break, [the cost of that downtime](/blog/cost-of-it-downtime/) adds up fast. Co-managed IT gives you continuity. When your IT person is out, someone is still watching the systems, still answering tickets, still responding to emergencies. Your business doesn't have a single point of failure for an entire critical function. ### Compliance Requirements Showed Up If your industry now requires HIPAA, FTC Safeguards, CMMC, or SOC 2 compliance, your IT person just inherited a massive workload they may have never dealt with before. Compliance requires specific documentation, specific controls, specific monitoring, and often specific reporting that goes way beyond keeping systems running. A co-managed partner with compliance experience can handle the technical controls and documentation while your internal IT person keeps the day-to-day operations running smoothly. ## How It Works Day-to-Day People always ask me what the working relationship actually looks like. Here's a typical setup. **Monitoring and alerting:** We deploy our monitoring tools across your environment. Our NOC (network operations center) watches everything 24/7. If something triggers an alert at 2 AM, we handle it. Your IT person wakes up to a resolved ticket and a summary of what happened, not a 2 AM phone call. **Help desk support:** Depending on the arrangement, we handle some or all of your end-user support. Employee locked out of their account on a Saturday? We've got it. Printer won't connect? We've got it. Your IT person isn't spending half their day on password resets anymore. **Security operations:** We manage the security stack. Deploying EDR agents, reviewing alerts, running vulnerability scans, managing MFA (multi-factor authentication) policies. Your IT person has visibility into everything we're doing, but they don't have to be the one doing it. **Escalation and collaboration:** When your IT person hits something outside their expertise, they have a team to escalate to. Complex network issue? Our network engineers jump in. Cloud migration question? Our cloud team has done dozens of them. It's like having a full IT department on speed dial. **Regular syncs:** We meet with your IT person on a regular cadence, usually weekly or biweekly. We review ticket trends, discuss upcoming projects, and make sure we're aligned on priorities. This isn't a "vendor check-in." It's a working session between teammates. ## What Co-Managed IT Costs The honest answer: it depends on how much support you need. But it's almost always significantly less than hiring additional full-time IT staff. A decent systems administrator costs $75,000 to $95,000 per year in the Inland Empire when you factor in salary, benefits, and overhead. A security analyst? Even more. Co-managed IT gives you access to a team of specialists for a fraction of what a single additional hire would cost. Pricing depends on your environment: the number of users, the scope of services, and the complexity of what we are supporting. [Book an intro call](/contact/) and we will scope it with you. A co-managed arrangement buys you 24/7 monitoring, help desk support, security operations, and access to specialists across networking, cloud, and compliance. ## What You Should Do If any of this sounds familiar, here's my advice. **Talk to your IT person first.** Seriously. Most internal IT people are relieved when co-managed IT comes up. They know they're stretched thin. They know there are gaps. They've probably been wanting to ask for help but weren't sure how to frame it without sounding like they can't do their job. **Identify the gaps.** Where is your IT person spending the most time? Where are the biggest risks? What projects keep getting pushed to next quarter because there's no bandwidth? That tells you where co-managed support will have the most impact. **Look for a partner, not a vendor.** The co-managed relationship only works if there's genuine collaboration. You want a provider who respects your internal team's knowledge and works with them, not around them. If an MSP's pitch is "your IT person isn't doing a good job, let us take over," that's not co-managed. That's a sales tactic. We put together a list of [20 questions to ask when evaluating an IT provider](/blog/it-provider-evaluation-guide/) that applies whether you're going fully managed or co-managed. Your internal IT team is an asset. Co-managed IT makes them a more effective one. If you want to explore what that looks like for your specific situation, [let's talk](/contact/). --- # What Is EDR and Why Does Your Business Need It? URL: https://etoptechnology.com/blog/what-is-edr/ Type: Article Category: Cybersecurity Author: William “BJ” Pote Published: 2026-01-15 Let me be blunt. If your business is still relying on traditional antivirus to protect your computers and servers, you are running on borrowed time. That's not fear-mongering. That's what we see every single week when new clients come to us after something bad has already happened. EDR stands for Endpoint Detection and Response. Think of it as antivirus on steroids, with a brain. But that comparison doesn't quite do it justice, so let me break down what it actually does and why it matters for your business. ## Traditional Antivirus vs. EDR: What's the Difference? Traditional antivirus works like a bouncer with a list. It checks files against a known list of bad stuff. If the file matches something on the list, it blocks it. Simple enough. The problem? Attackers stopped using known bad files a long time ago. Modern attacks use "fileless" techniques. They hijack legitimate tools already on your computer, like PowerShell or Windows Management Instrumentation. They don't drop a virus file. They use your own operating system against you. Traditional antivirus just stands there holding its list, completely oblivious. EDR takes a fundamentally different approach. Instead of checking a list, it watches behavior. It monitors what every process on your computer is doing, in real time. If PowerShell suddenly starts encrypting files at 2 AM, EDR catches that because the behavior is suspicious, even though no "virus file" was involved. Here's what EDR actually does that antivirus doesn't: - **Behavioral analysis**: Watches what programs do, not just what they are - **Threat hunting**: Actively searches for signs of compromise across all your endpoints - **Automated response**: Can isolate a compromised machine from your network in seconds - **Forensic data**: Records everything so you can figure out exactly what happened and how - **Rollback capability**: Some EDR solutions can actually reverse the damage from ransomware ## How EDR Catches What Antivirus Misses Walk through how a modern attack actually unfolds — this is the standard playbook, and notice that no "virus" ever appears. An employee at a 55-person firm opens what looks like a normal PDF from a client. The PDF is clean; antivirus doesn't flag it, because there's nothing to flag. But it contains a link to a legitimate-looking SharePoint page that asks for credentials, and the employee enters their password. Within 20 minutes, the attacker uses those stolen credentials to log into the company's email. From there, they use built-in Windows tools to run scripts that start mapping the network and looking for file shares. No malware dropped. No virus file. Just legitimate tools being used in illegitimate ways — the industry calls this "living off the land," and it's precisely the gap traditional antivirus can't cover. EDR flags the behavior chain instead: credential entry on a suspicious site, followed by unusual login patterns, followed by network enumeration from a workstation that has never done that before. It isolates the machine from the network automatically and alerts the SOC — containment in minutes, not days. Without EDR, the same playbook runs silently all the way to ransomware deployment. ## Why This Matters Once You're an Established Team You might be thinking, "We're not a big target. We only have 30 people." I hear this constantly. Here's the reality. Attackers don't target companies by size. They target companies by vulnerability. Automated scanning tools hit millions of businesses every day looking for weak spots. They don't care if you have 15 employees or 4,000. If your door is open, they walk in. Once you're past the very early stage, you typically have enough complexity in your environment that traditional antivirus leaves real gaps. You probably have: - Remote workers connecting from home networks - Multiple office locations or cloud services - Employees with varying levels of tech savvy - Sensitive client data, financial records, or intellectual property - Enough revenue that a ransomware demand would be worth the attacker's time The sweet spot for attackers is actually mid-market companies — big enough to have valuable data and the ability to pay a ransom, small enough that they probably don't have sophisticated security in place. That's most of the businesses we work with. We break down the local threat data in our [State of Cybersecurity in the Inland Empire](/blog/state-of-cybersecurity-inland-empire-2026/) report if you want to see what's hitting businesses in this region specifically. ## What EDR Looks Like Day to Day One concern I hear from business owners is that EDR sounds complicated and expensive. Let me set expectations. When EDR is managed properly through a [managed IT services](/managed-it-services/) provider, your employees notice almost nothing. The agent runs quietly in the background. It doesn't slow machines down like old-school antivirus used to. There are no pop-ups asking users to make security decisions they aren't qualified to make. What happens behind the scenes is where the value lives. Your IT team or your managed security provider gets a dashboard showing the health of every endpoint in your environment. When something suspicious happens, they get an alert with full context. They can investigate, respond, and remediate without ever interrupting your team's work. The key word there is "managed." An EDR platform sitting on your machines with nobody watching the alerts is like having a security camera system that nobody monitors. The tool is only as good as the team behind it. This is why we pair EDR with 24/7 SOC (Security Operations Center) monitoring for our clients. The technology detects. The people respond. ## What You Should Do About This If you're reading this and wondering where your business stands, here's a quick gut check: **You need EDR if:** - You're still running traditional antivirus (Norton, McAfee, AVG, etc.) - You have no idea what's running on your endpoints right now - Your "IT security" is basically Windows Defender and hoping for the best - You have compliance requirements like HIPAA, CMMC, or FTC Safeguards - Your [cyber insurance](/blog/cyber-insurance-requirements-2026/) policy requires endpoint protection (most do now) **Steps to take this week:** 1. **Ask your IT provider what endpoint protection you're running.** If they say "antivirus," ask specifically whether it's an EDR solution with behavioral analysis. A good provider will welcome the question — it's exactly the conversation you should be having together. 2. **Check your cyber insurance policy.** Look at the security requirements section. Most 2026 policies explicitly require EDR, not just antivirus. Running the wrong solution could get a claim denied. 3. **Get a security assessment.** A proper assessment will show you where your gaps are, not just with endpoints but across your entire environment. [Book an intro call](/contact/) — qualifying Inland Empire businesses receive our IT Risk Assessment complimentary. ## The Bottom Line EDR isn't a nice-to-have anymore. It's table stakes. The threats businesses face today have evolved well past what traditional antivirus can handle, and the gap gets wider every month as attackers adopt AI tools to create more sophisticated attacks. The good news is that EDR, when properly managed, is straightforward to deploy and doesn't disrupt your business. The cost is a fraction of what a single ransomware incident would run you — [IBM's 2025 report](https://www.ibm.com/reports/data-breach) puts the average breach north of $4 million globally, and even scaled way down to a 50-person company, a year of managed EDR is a rounding error compared to one bad week. If you want to understand where your business stands today, [reach out for a security assessment](/contact/). We'll give you an honest picture, no sales pitch required. --- # The Real Cost of IT Downtime for a Mid-Size Business URL: https://etoptechnology.com/blog/cost-of-it-downtime/ Type: Article Category: IT Strategy Author: William “BJ” Pote Published: 2026-01-10 Picture a Tuesday morning. Your main file server crashed overnight. By the time anyone realizes it, your entire team of 65 people has been sitting at their desks for 45 minutes unable to access anything they need to work. No project files. No shared documents. No access to the line-of-business application that ran on that server. Say it takes four hours to get fully operational. In those four hours, 65 employees produce essentially nothing. Billable utilization for the day is destroyed. Client deadlines slip. The proposal someone spent a week on can't go out because the final version is sitting on the dead server. Run that scenario through the math below and the cost of that one incident lands comfortably in the tens of thousands of dollars. For one server failure. On one Tuesday. That's not a worst case. That's a mid-size business having an ordinary bad day. ## The Math Most Business Owners Don't Do Here's the calculation that keeps me up at night, and should keep you up too. Take your average employee's fully loaded cost. Salary, benefits, overhead. For a mid-size business in Southern California, that's usually somewhere between $35 and $75 per hour depending on the role. Now multiply that by the number of employees affected by the outage. Then multiply by the hours of downtime. That gives you the direct labor cost of people sitting around unable to work. **Example: 50 employees x $50/hour average x 4 hours of downtime = $10,000** But that's just the direct labor cost. That's the easy number. The real costs are the ones you don't see on a spreadsheet. ## The Costs You Don't See ### Lost Revenue If your team can't work, they can't generate revenue. For professional services firms, every hour of downtime is an hour of billable work that disappears forever. You can't make it up. You can work late, you can work weekends, but that capacity is gone. For businesses that process transactions, sell products, or serve customers in real time, downtime means lost sales. Period. An e-commerce company losing their systems for four hours during business hours could easily lose $50,000 to $200,000 in orders depending on their volume. A medical practice that can't access their scheduling system loses appointments and the revenue that comes with them. ### Missed Deadlines and Contract Penalties If you have SLAs (service level agreements) with your clients, downtime can trigger penalty clauses. Even without formal penalties, missing a deadline because "our systems were down" erodes client confidence. They start wondering if you're reliable enough to keep their business. Picture a construction company whose systems go down for a full day right before a major bid deadline. The estimating files, the takeoffs, the final bid package — all inaccessible. Whether the bid goes out on time now depends on luck and heroics instead of process. A single missed deadline on a seven-figure project can erase years' worth of what you "saved" by underinvesting in IT. ### Reputation Damage This one is hard to quantify but impossible to ignore. When clients can't reach you, when emails bounce, when your customer portal is down, they notice. They might not say anything the first time. But it registers. And when they're evaluating whether to renew that contract or take a meeting with your competitor, those moments of unreliability factor into the decision. In the age of online reviews and social media, a visible outage can become a public event. "Tried to reach Company X for three hours, couldn't get through." That kind of thing sticks. ### Compliance Penalties If you're in a regulated industry, downtime can trigger compliance violations. HIPAA requires healthcare organizations to maintain access to patient records. Financial institutions have regulatory requirements around system availability. The FTC Safeguards Rule requires documented [business continuity](/business-continuity-disaster-recovery/) plans. Compliance penalties range from thousands to millions of dollars depending on the regulation and the severity. And "our server crashed" is not a defense that regulators find compelling. ### Employee Morale and Productivity Ripple There's a morale cost to constant IT problems that nobody talks about. When your team can't trust their tools, it creates a low-grade frustration that compounds over time. They develop workarounds. They save files to their desktop instead of the server because they don't trust the server. They use personal devices because the company systems are unreliable. These workarounds create security risks, data silos, and inefficiency. And they persist long after the outage is resolved because the trust is broken. It takes consistent reliability to rebuild that trust. ## What the Data Says Let's put some industry numbers on this. Various industry surveys peg the average cost of IT downtime anywhere from a few thousand to hundreds of thousands per hour, depending on company size and industry. The exact number varies wildly, which is why generic stats are less useful than calculating your own. But even conservative estimates paint a clear picture. For companies in the 50-200 employee range, the numbers we typically see are: - **Minor outage** (email down, one application unavailable): $1,000 to $5,000 per hour - **Moderate outage** (file server, network, multiple systems): $5,000 to $25,000 per hour - **Major outage** (full network down, ransomware, complete loss of systems): $25,000 to $100,000+ per hour - **Extended outage** (multi-day recovery from disaster or ransomware): $100,000 to $1,000,000+ And here's the math that should get your attention: even a conservative assumption — say, a dozen hours of unplanned downtime spread across a year — works out to serious money at any of the rates above. Run it with your own numbers. It's not small. ## Why Downtime Keeps Happening Most downtime is preventable. I want to be really clear about that. Go back to the server in that opening scenario. Servers like that don't get hit by lightning. They're six-year-old machines with failing hard drives that nobody was monitoring. The signs are there for weeks. Nobody is looking. The most common causes of downtime we see: **Hardware failure on aging equipment.** Servers and network equipment have a useful life of 3-5 years. Running them past that is borrowing time. We regularly encounter businesses running critical systems on hardware that's 7-10 years old because replacing it feels expensive. It's less expensive than the downtime when it finally fails. **Ransomware and cyberattacks.** The average ransomware recovery takes 22 days. Twenty-two days of degraded or zero operations. Even with good backups, the recovery process is measured in days, not hours. Having a real [incident response plan](/blog/incident-response-planning/) makes the difference between a controlled recovery and total chaos. Prevention through proper [cybersecurity](/cybersecurity-services-inland-empire/) is orders of magnitude cheaper than recovery. **Failed backups nobody tested.** Having backups is not the same as having working backups. When we audit backup systems for businesses coming onboard, finding issues that would prevent a successful recovery is routine, not rare. Backups that haven't been tested are not backups. They're assumptions. **Misconfigurations and human error.** A firewall rule change that takes down the VPN. A software update that conflicts with a critical application. An accidental deletion of a shared drive. These happen less often with proper change management processes, but they still happen. **ISP and cloud provider outages.** These are outside your control, but they're not outside your ability to plan for. Redundant internet connections, failover configurations, and business continuity plans turn a cloud provider outage from a crisis into an inconvenience. ## What You Should Do About It If you've read this far, you're probably doing some math in your head. Good. Here's where to start. **Calculate your hourly downtime cost.** Use the formula above. Be honest about the numbers. Include lost productivity, lost revenue, and missed opportunities. Write that number down. That's what you're risking every day you operate without proactive IT management. **Audit your current infrastructure.** How old is your hardware? When were your backups last tested? Do you have redundant internet? Is anyone monitoring your systems 24/7? If the answer to any of these questions is "I don't know," you have a visibility problem that needs to be solved. **Invest in prevention, not reaction.** Proactive [managed IT](/managed-it-services/) costs a fraction of what downtime costs. Monthly monitoring, patching, backup verification, and security management are the insurance policy that actually pays off. And speaking of insurance, your [cyber insurance policy](/blog/cyber-insurance-requirements-2026/) may already require many of these controls. The businesses that spend the least on IT often spend the most when something goes wrong. **Build a business continuity plan.** Not a dusty binder on a shelf. An actual, tested plan that your team knows how to execute. What happens when the office floods? When ransomware encrypts everything? When your cloud provider has a multi-hour outage? If you don't have answers to these questions, you're gambling with your business. The cost of IT downtime is real, it's measurable, and it's almost always higher than business owners expect. The good news is that most of it is preventable with the right infrastructure, the right monitoring, and the right partner watching your back. If you want to know what your specific downtime risk looks like, we'll run the analysis for you. No charge, no obligation. Just clarity on what you're actually exposed to and what it would take to fix it. --- # Account Executive URL: https://etoptechnology.com/careers/account-executive/ Type: Job Posting Location: Redlands, CA (Hybrid) Employment type: Full-time **Are you the kind of salesperson who doesn't just fill a pipeline — you close it?** eTop Technology is looking for a driven, personable Account Executive to join our growing team. This isn't a lead-gen role. You'll own the full sales cycle — from the first cold call to the signed contract and a smooth handoff to our Projects and Support teams. ## What You'll Be Doing - Cold calling, emailing, LinkedIn and social media outreach, and door-knocking in the Inland Empire - Attending local networking events and building real relationships in the community - Running discovery calls, delivering sales presentations, and closing deals - Handing off new clients and staying involved through onboarding ## What Success Looks Like 10 qualified meetings per month, new MRR in the pipeline, and clients who are genuinely glad they said yes. ## The Details - **Location:** Hybrid — minimum 1 day/week in our Redlands office + significant local field time - **Travel:** Must be local and comfortable being out in the market ## You're a Great Fit If You… - Have 3+ years of B2B sales experience and a track record of hitting quota - Know how to run a full sales cycle, not just book meetings - Are organized, self-motivated, and don't need someone to manage your follow-ups - Love technology (or are genuinely curious about it) - Have an active LinkedIn presence and know how to use social media to sell *Bonus points if you've sold MSP or IT services before — but great salespeople learn fast, and we'll teach you the rest.* ## About eTop Technology We're a Redlands-based Managed Service Provider helping local businesses run their technology smoothly and securely. We're a tight-knit team that takes our work seriously and has fun doing it. --- # Tier 3 Engineer — Team Lead URL: https://etoptechnology.com/careers/tier-3-engineer-team-lead/ Type: Job Posting Location: Redlands, CA (Hybrid or In-Office) Employment type: Full-time ## Summary The Tier 3 Engineer — Team Lead is responsible for leading the technical team in delivering high-quality managed services, projects, and automation initiatives. This hybrid leadership role combines deep technical expertise with team mentorship, policy enforcement, escalation oversight, and cross-functional communication. The Team Lead serves as the primary technical authority for Tier 1 and Tier 2 escalations, drives automation strategy, and ensures team adherence to standards and processes. This can be a hybrid or in-office position. The successful candidate will have a passion for technology and automation, a natural ability to develop others, and the communication and planning skills to guide both people and projects from concept to completion. ## Key Responsibilities — Helpdesk Team Lead 1. Serve as the primary escalation point for Tier 1, 2, and 3 technicians; triage escalated tickets, advise on next steps, and ensure timely resolution. 2. Mentor and develop Tier 1 and Tier 2 team members through hands-on coaching, knowledge transfer, and structured training opportunities. 3. Monitor ticket queues for SLA compliance, workload balance, and resolution quality; provide real-time guidance and corrections as needed. 4. Enforce team policies, documentation standards, and operational procedures; ensure consistent adherence across all technicians. 5. Review resolution notes, knowledge base articles, and SOPs created by team members for accuracy and completeness; provide feedback. 6. Conduct regular one-on-one check-ins with technicians to assess skill development, identify gaps, and build individualized growth plans. 7. Display exemplary leadership behavior; serve as a role model for professionalism, technical excellence, and customer service. 8. Identify recurring issues or patterns across the team and drive root-cause resolution through documentation, training, or automation. 9. Perform assessments of client networks; evaluate operating practices to determine if controls and security measures are adequate. 10. Monitor and maintain performance and security of LANs, VPNs, and vLANs; oversee client servers, network infrastructure, peripheral devices, and workstations. 11. Implement, maintain, and update cloud infrastructure including Entra ID, Intune, Azure, and related platforms. 12. Implement disaster recovery systems and maintain procedures to ensure reliability of client data resources. 13. Ensure daily time entry accounting for at least 8 hours in the form of Resolution Notes in Service Tickets; hold team members to the same standard. 14. Monthly billing should be at least 85% or more of a typical month of approximately 160 available hours. ## Key Responsibilities — Project Team Lead 1. Plan, coordinate, and deliver concurrent technology projects; serve as the technical lead and primary point of accountability for project outcomes. 2. Mentor project team members, providing direction and guidance to meet objectives, quality standards, and client expectations. 3. Develop project scope statements, define deliverables, and establish timed implementation plans in collaboration with the Project Manager. 4. Track milestones, budgets, and scope; escalate risks or blockers with sufficient lead time for course correction. 5. Ensure strict quality of all project deliverables through peer review, testing, and documentation. 6. Manage client expectations proactively when targets require adjustment; communicate changes clearly and professionally. 7. Participate in team meetings and project review sessions with effective, structured communication and proactive status reporting. 8. Escalate unresolved technical or personnel issues to the Project Manager with recommended next steps. 9. Recommend, schedule, and perform hardware and software improvements, upgrades, patches, and reconfigurations. ## Key Responsibilities — Automation & Standards 1. Lead the team's automation strategy; identify opportunities across managed services, onboarding, and project workflows to reduce manual effort and increase consistency. 2. Build, maintain, and improve automation workflows using leading industry automation tools; serve as the team's subject matter expert for automation tooling. 3. Develop and document automation standards, naming conventions, and best practices; ensure team members follow established patterns. 4. Train and mentor technicians on automation concepts, scripting fundamentals, and workflows. 5. Conduct research on emerging automation tools, protocols, and practices; present recommendations to leadership. 6. Define and enforce team policies, procedural standards, and quality benchmarks across helpdesk and project work. 7. Own the team's knowledge base and SOP library; ensure documentation is current, accessible, and actionable. 8. Actively contribute to scripting, automation building, and implementation efforts as both a builder and a reviewer. ## Qualifications 1. Relevant industry certifications — Vendor, Microsoft, and/or CompTIA (e.g., MS-102, AZ-104, CCNA, Network+, Security+). 2. At least 6–10 years of experience in an IT Service Team or MSP/NOC environment, with demonstrated project leadership experience. 3. Prior experience in a formal or informal team lead, senior technician, or mentorship role. 4. Expert-level comprehension of network setups and configurations, Microsoft 365, and Azure administration. 5. Proficient use of a Service and Project Ticketing Platform (ConnectWise preferred). 6. Hands-on automation and scripting experience required. 7. Demonstrated ability to manage a large and evolving toolset; ability to evaluate and recommend updated technology. 8. Reliable transportation, active and current driver's license, valid insurance, and clean driving record. ## Skills and Knowledge 1. Natural leader with a coaching mindset; genuinely invested in the growth and success of team members. 2. Strong planning and organizational skills; able to manage multiple priorities across helpdesk operations and concurrent projects. 3. Excellent written and verbal communication skills, including the ability to translate technical concepts for non-technical audiences. 4. Skilled at structured decision-making under pressure; able to advise confidently on escalations and next steps. 5. Exhibits professional integrity, balanced business judgment, tact, and diplomacy. 6. Positive, solutions-first attitude toward both people and problems; models a can-do culture for the team. 7. Exceptional attention to detail in both technical work and documentation. 8. Ability to self-start, work independently, and hold others accountable to the same standard. ## Work Environment Expectations Work in this environment is considered low physical requirements, with sitting at a computer up to 8 hours per day. Must be able to: 1. Walk, sit, stand, and type for extended periods of time up to 8 hours. 2. Write and speak effectively in all languages required by the job. 3. Apply principles of logical or scientific thinking to define problems, collect data, establish facts, and draw valid conclusions. 4. Maintain effective working relationships with team members, leadership, vendors, and clients. 5. Perform under stress and adapt when confronted with high-priority situations. 6. Be sensitive to cultural differences among individuals and groups of people. ## Disclaimer The above statements are intended to describe the general nature and level of work being performed by employees assigned to this classification. They are not intended to be construed as an exhaustive list of all responsibilities, duties, and/or skills required of all employees within this class. ## Accommodations Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the position.