IT governance for small business: what it is and why it matters

The question was on page three of the cyber insurance renewal: Name the person responsible for your organization’s information security program. The owner of a 35-person engineering firm read it twice, wrote down the name of the firm’s IT provider, and sent the form back.

A few weeks later the underwriter called with follow-up questions, and the owner passed them along to the provider. The provider pointed out, politely, that its contract covered running the firm’s laptops, backups, and Microsoft 365. It didn’t cover deciding what the firm’s security rules should be, who got access to which project files, or whether a new app was safe to use. Those were the firm’s decisions.

So who had been making them? Mostly the office manager, because people asked her. She’d approved software requests for six years, set up new hires from a checklist she wrote herself, and tracked which subscriptions renewed when in a spreadsheet only she ever opened. Which technology projects got done was whatever the two principals had mentioned most recently. Nothing had gone badly wrong. But nobody could answer the insurer’s question, and when the owner went looking, nobody could say who had decided most of the rest, either.

The name for what was missing is IT governance. At a firm this size, it means knowing who decides what about technology, what rules people follow, who answers for the result, and how you’d notice if any of it stopped working. If you run or help run a business of roughly 10 to 150 people, you can set it up in a few weeks without adding red tape.

Short answer

IT governance for a small business is the set of policies, decision rights, accountability, and oversight that decides how technology gets chosen, used, and protected. At 10 to 150 people, it comes down to a one-page table of who decides what, six short written policies, a named owner for each area, and a few checks on the calendar. The four areas small businesses most often leave ungoverned are data, vendors and software, security, and which projects come first. You can add governance without bureaucracy by deciding ahead of time who makes each common decision, setting spending and risk limits so small things stay fast, and reviewing it at your quarterly technology review. It’s also what insurers, compliance rules, and client security questionnaires are asking about when they want a responsible person and evidence. A virtual CIO can do most of the legwork, but the decisions stay with leadership.

IT governance at a glance

Question	Short version
What is IT governance?	Who decides what about technology, the rules people follow, who answers for the result, and how you check.
Isn’t that what our IT provider does?	Your provider runs the technology. It can help you govern it, but most of the decisions are business decisions and belong to you.
Where are the usual gaps?	Data, vendors and software, security, and project priorities.
How much paperwork is involved?	A decision table, six short policies, and a few lists that someone keeps current.
How much time does it take?	A few weeks of part-time work to set up, then a couple of hours a month plus your quarterly review.
How does it connect to compliance?	HIPAA, the FTC Safeguards Rule, CMMC, and most cyber insurance applications all ask for a named responsible person, written policies, and proof.
Who runs it?	Leadership owns it. A virtual CIO or a capable IT partner can do most of the work around it.

What IT governance means at small business scale

The textbook definitions come from frameworks like COBIT and ISO/IEC 38500. Both say they scale to any size, but they’re written in boardroom language and assume more people than a 40-person business has. Take away the vocabulary and they’re answering four questions that any business can answer on a page or two.

Policies: what are the rules? These are the written expectations everyone follows. Which tools are approved, how sign-in and passwords work, how client data is handled, what happens when a laptop goes missing. For a small business that’s a handful of short documents.

Decision rights: who decides? For each kind of technology decision, this names the person who makes it, who has to be asked first, and who just needs to know. Buying a $15-a-month app. Signing a three-year phone contract. Giving a contractor access to the client folder. Turning off a security setting because it’s slowing someone down.

Accountability: who answers for the result? Each area has a named owner who’s expected to notice when something’s off and do something about it. That isn’t always the person doing the work. Your IT provider might run the backups, while someone inside the business owns the decision about what gets backed up and how long it’s kept.

Oversight: how do you know it’s working? These are the regular checks that tell you the rules are being followed and the decisions held up. An access review, a renewal calendar someone actually looks at, a quarterly meeting where open risks get a decision.

Your IT provider handles the running of things, like patching, tickets, new accounts, and backups. Governance covers what the technology is for, who’s allowed to change it, and who answers for it, and most of that is a business call. Your provider can walk you through what a three-year phone contract commits you to, and then you decide.

If you’d like an outside reference for the security side, NIST added a sixth function called Govern when it released version 2.0 of its Cybersecurity Framework in February 2024, and it published a quick-start guide for small businesses at the same time. It’s free and voluntary. You don’t need to adopt it to get value out of this, but it’s a useful checklist once you’ve got the basics down.

What happens when nobody governs IT

Ungoverned IT almost never fails all at once. It shows up as small costs and the occasional near miss:

• Access outlives the job. Former employees and contractors keep working logins for months because removing them wasn’t anybody’s job. What happens to your passwords when an employee leaves covers why that’s riskier than it sounds.
• Risk gets accepted by accident. An old server stays in the closet because replacing it never made the list, and nobody ever decided out loud to live with it. That’s how technical debt builds up.
• Too much depends on one or two people. When the person who knows how everything works goes on vacation or leaves, the business finds out how much lived only in their head.

The four areas most small businesses leave ungoverned

You don’t need to govern everything. Day-to-day support is rarely where things go wrong. The gaps show up in four areas, so start there.

Data

Ask an owner where their client data lives and you’ll get a partial answer. It’s in Microsoft 365, the accounting system, the CRM, a couple of shared drives, people’s laptops, and these days in whatever AI tools staff have started using. Data governance means knowing what you hold, where it is, who owns it, who can see it, how long you keep it, and how it gets deleted.

At small business scale that’s a short list of the five to ten systems that hold anything important, with an owner for each. Sort the data into three levels, public, internal, and sensitive, so people know how to treat it without a long policy. Give access by role, and review who has access to the sensitive systems every quarter. Decide how long you keep each kind of record, because data you no longer need is still data you’d have to report if it leaked.

Then decide who approves new uses of data. The most common new use right now is staff pasting client files into AI tools to summarize or draft from them. An AI acceptable use policy sets the rules for that, and what data you’re feeding into AI tools explains what the free and business versions of each tool do with your data.

Vendors and software

Every vendor relationship is a set of small decisions. Who’s allowed to sign up for a new tool, and up to what cost? Who signs contracts? Who checks a vendor’s security before it holds your clients’ data? Who watches the renewal dates? Who owns the relationship once the tool is in use?

The fix is a spending limit, a register, and a named owner for each vendor. Small, low-risk tools go through a fast lane. The software license article suggests approval within a day or two for anything under a few hundred dollars a year, with a short form that gets the tool into the register on day one. Anything that holds sensitive data, costs more, or runs longer than a year gets a proper look, and how to evaluate technology vendors covers what that review should include. The register keeps the renewal dates and notice periods, so a contract never renews just because nobody remembered to look.

Security

Your IT provider runs the security tools. Someone still has to own the security program, meaning the rules, the exceptions, and the hard calls. HIPAA calls that person the security official, and the FTC Safeguards Rule calls them the Qualified Individual. The Safeguards Rule lets that role sit with an outside provider, but the business still answers for the program and needs a senior person inside overseeing it. In a 40-person business, that’s often the operations manager or one of the owners.

The security owner looks after a few things. The written policies, starting with a cybersecurity policy and a password policy. Exceptions, because sooner or later someone will ask to skip multifactor sign-in on a shared account or keep an old system online, and somebody should say yes or no, write down why, and set a date to look at it again. And the decisions you’ll need to make fast during an incident: who declares that something’s wrong, who calls your insurer, who brings in legal counsel, and who decides whether clients need to be told. Many cyber insurance policies expect prompt notice to the carrier, so that call shouldn’t wait on a meeting.

The security owner also makes sure leadership sees the picture often enough to make decisions. How to present an IT security report to non-technical leadership covers what that report should look like. If AI tools are part of the picture, and by now they are, how to build an AI governance framework applies the same structure to AI on its own.

Which projects come first

There are always more technology requests than time or money. Without governance, the projects that get done are whichever ones someone pushed hardest for, or whatever broke last. You end up with half-finished projects, a backlog nobody can rank, and the important but dull work, like replacing a server before it reaches end of support, losing out every quarter.

Keep one list of technology projects for the whole business, not one per department. Set a size above which a project needs leadership approval and a one-page plan with the goal, budget, owner, and date. The virtual CIO services page describes that one-page charter. Then agree on how projects get ranked and who breaks ties. The questions in how to align your IT strategy with your business goals are a good way to rank them, and the IT roadmap is where the ranked list ends up. When something gets pushed back, write down who decided and why. Otherwise the same request comes back six months later and nobody remembers why it was turned down.

How to set it up without the bureaucracy

The point is fewer surprises and faster decisions, so each step below should take less time than the problem it prevents.

Start with a decision table

Get the owner, whoever runs operations, someone from finance, and your IT partner in a room for 90 minutes. List the technology decisions that come up regularly, and for each one agree on who decides, who has to be asked first, and who needs to be told. If you’ve seen a RACI chart, this is a pared-down version of one. Here’s a starting point for a business of 25 to 60 people. Change the names and limits to fit yours.

Decision	Who decides	Asked first	Told afterward
New software up to $5,000 a year, no sensitive data	Department head	IT partner, for a quick check	Whoever keeps the software register
New software or AI tool that holds client or employee data	Security owner	IT partner, operations manager	Staff who’ll use it (AI tools go on the approved list)
Any contract over $5,000 a year or longer than one year	Owner or CFO	IT partner, operations manager	Finance
Access for a new hire or a role change	Hiring manager requests, data owner approves sensitive systems	Operations manager	IT partner carries it out
Removing access when someone leaves	Operations manager (same day, every time)	HR	IT partner carries it out
An exception to a security policy	Security owner	IT partner	Owner, if it lasts more than a month
Which projects happen this quarter	Leadership, at the quarterly review	Department heads, IT partner	Everyone affected
Living with a known risk rather than fixing it	Owner	IT partner or vCIO	Written into the risk register
A suspected security incident	Security owner declares it	IT partner, insurer, legal counsel	Leadership, right away

Most rows are settled within a few minutes. The ones that take longer are usually the ones where two people both thought they were in charge, and settling those is the main reason to hold the session.

Name an owner for each area

Data, vendors and software, security, and project priorities each get a named owner. In a 30-person business that might be two people. Each owner needs the authority to make the call and enough time to look at it at least once a month. Write the names into the policies and the decision table, and name a backup for each, so nothing stalls when someone’s out.

Write six short policies

Six covers it for a business your size: acceptable use (with AI tools included), access and passwords, data handling and retention, buying software and services, incident response, and remote work and personal devices. Keep each one to a page or two, written for the least technical person on staff. Have everyone sign them when they start and again after major changes, and review them once a year or right after an incident. How to build an IT policy for remote workers and the BYOD policy guide cover the last one. A short policy that matches how the business works is worth more than a long one copied from a template, because an auditor or insurer who finds one rule nobody follows will trust the rest of your answers less.

Put oversight on the calendar

Oversight is where governance tends to die, because the checks feel optional until something goes wrong. Give each one a date and an owner.

Check	How often	Who
Who has access to sensitive systems	Every quarter	Data owners, with the IT partner
Software register and upcoming renewals	Monthly look, decided at the quarterly review	Vendor and software owner
Risk register and decisions log	Every quarter	Owner, with the vCIO or IT partner
Policies	Once a year, and after any incident	Security owner
The decision table itself	Once a year	Leadership

These fit into the quarterly business technology review you may already hold. The access review results, the renewals coming up, and the open risks go on its agenda, and the decisions come out of it.

Keep small decisions fast

Most rows in the table should never need a meeting. A cheap, low-risk tool gets a quick check from the IT partner and goes in the register the same day. More people get involved only when a decision is expensive, hard to undo, or touches sensitive data.

You’ve overdone it if approvals take longer than the purchase is worth, if staff can’t name a single policy, if a committee meets without deciding anything, or if spending starts turning up on personal cards. The license article’s section on shadow IT has the fix for that last one.

Scale it to your size

At around 10 people, the owner makes most of these calls, and an admin-access list, same-day access removal, and a few basic policies cover it. From about 25 people, the full decision table and quarterly checks start to pay off. Past 75 or so, each department needs its own data and vendor owners, and a board, a bank, or investors may want to see the records.

How IT governance connects to compliance

Most of what compliance frameworks ask a small business to show is governance. They ask about technical controls as well, but the questions that trip businesses up tend to be about who’s responsible, what’s written down, and whether you can prove it.

A named responsible person. The HIPAA Security Rule requires a designated security official. The FTC Safeguards Rule, which covers a wide range of non-bank financial businesses including tax preparers, mortgage brokers, and car dealers that arrange financing, requires a Qualified Individual to oversee the security program. If you hold information on 5,000 or more consumers, that person also has to report in writing to your board, or to a senior officer if you don’t have one, at least once a year. Below 5,000 you’re excused from a few written pieces, including that report, a written risk assessment, and a written incident response plan, but not from having the program. Whatever your size, the rule also requires notice to the FTC within 30 days of discovering a breach of unencrypted information on at least 500 consumers.

Written policies and a risk assessment. HIPAA, the Safeguards Rule, and CMMC all expect them. CMMC Level 2 also expects a written system security plan, and assessors look for evidence that each requirement is being met.

Oversight of your vendors. The Safeguards Rule requires you to oversee service providers that handle customer information, including what your contracts require of them. HIPAA requires business associate agreements with vendors that handle patient information. The vendor register and the review step from earlier are where that work lives.

Proof. Cyber insurance applications, client security questionnaires, and auditors all ask some version of “show me.” If you’ve been running the checks above, you already have the dated policies, signed acknowledgments, access review records, and written risk decisions they’re asking for. Without them, a business can have most of the right controls in place and still be unable to show any of them. An answer on an insurance application that turns out not to be true can also cause trouble later, when you file a claim.

If you’re in a regulated field, HIPAA cybersecurity requirements for small healthcare businesses goes deeper on that framework, and our IT compliance services cover HIPAA, CMMC, and SOC 2 work. This is general information rather than legal advice, so check with your counsel how each rule applies to your business.

How a vCIO provides ongoing governance support

Setting up governance takes a few weeks. Keeping it running is the harder part, because every piece of it is easy to skip in a busy month. A virtual CIO can carry most of that load, doing the prep and the follow-up so leadership only has to make the calls.

In practice, a vCIO:

• Drafts the decision table and the policies with you, starting from versions that have worked for other businesses your size, so the first session is editing a draft, not starting from a blank page.
• Keeps the lists and the calendar. The software register, the risk register, and the decisions log stay current, and each quarterly review gets the access results, upcoming renewals, and open risks with a recommendation for each.
• Reviews vendors and contracts before you sign, and flags terms and renewal dates you’d otherwise miss.
• Puts the security picture in business terms for leadership, and fills in insurance and client questionnaires with evidence behind each answer.
• Says when something’s slipping. That includes a project behind schedule, a policy nobody follows, or a risk that’s been “accepted” for a year without anyone looking at it again.

A vCIO still doesn’t make your decisions for you. They recommend, and leadership decides and answers for the result. If you need more security depth than a vCIO brings, for a CMMC or SOC 2 effort, say, a virtual CISO can fill the security official or Qualified Individual role, with someone senior on your side overseeing it. Virtual CIO services for small business covers how the engagement is set up, what it costs, and what a full year of the work looks like.

A worked example

The engineering firm from the opening is a composite, and the numbers are for illustration.

The first session. The owner, the other principal, Lisa (the office manager, who also handles the books), the senior project engineer, and a vCIO the firm had added to its IT agreement after the insurance scare spent 90 minutes on the decision table. Lisa took vendors and software, which she’d been doing anyway, now with a spending limit and a backup. The other principal became the security owner. The senior project engineer took the project archive and client files as data owner. The owner kept project priorities and the final say on living with a risk.

The first checks. The first access review turned up eleven accounts for people who had left, including a contractor with access to the project archive two years after the job ended, and four shared logins. All of them were fixed within a week. Lisa’s spreadsheet became the software register. It listed 46 subscriptions, and seven of them were unused or did the same job as another tool. Cancelling or consolidating those saved about $9,000 a year.

The policies. The vCIO brought drafts of six policies, which came to about twelve pages in total once the firm had edited them to match how it really worked. Everyone signed them within a month.

The projects. Fourteen requests from across the firm went onto one list. Leadership picked four for the next two quarters, pushed six back with a written reason for each, and dropped four.

The first exception. A few months in, a client’s project portal turned out to allow only one login per firm, and its sign-in code went to an engineer who’d be out for two weeks. The team wanted the code sent to a shared inbox. Under the old setup someone would have made the change and moved on. This time the security owner approved it for 30 days, wrote down why, and asked the client for individual logins. They arrived three weeks later, and the exception was closed.

The renewal. At the next insurance renewal, the question on page three got the principal’s name in place of the provider’s, and every answer had a date, a report, or a signed policy behind it.

The time. Setting it up took about 25 hours of the firm’s time over six weeks, plus a few hours a month of vCIO time added to the agreement. Keeping it running takes a couple of hours a month and part of the quarterly review.

IT governance for Tampa Bay businesses

Sequentur is headquartered in Clearwater, Florida, with a team in Tampa. If your business is in the area, the decision table session and the policy work can happen around your own conference table. Storm season and Florida’s breach law both belong in your governance from the start.

Decide who decides before a storm

Hurricane season runs June 1 through November 30, and the leadership disaster recovery plan covers the systems. What it won’t settle is who’s in charge when the office is closed, people have evacuated, and the bridges across the bay are shut for wind, with your Clearwater and Tampa staff on opposite sides. Who can close the office and move everyone to remote work? Who can approve emergency spending, like replacement laptops or extra hours from your IT partner, if the owner can’t be reached? Who holds the admin access if your main contact has left the area? And where’s the contact list if email is down? Write the answers into your decision table and check them at the spring quarterly review, alongside the restore test.

Florida’s breach law expects reasonable measures

Florida’s breach statute, section 501.171, requires any business holding Floridians’ personal information to take reasonable measures to protect it, without listing what those are. If anyone asks, your dated policies and review records are what you’ll point to. The deadlines are tight: notice to affected people no later than 30 days after you determine, or have reason to believe, there was a breach, a report to the Department of Legal Affairs if 500 or more Floridians are affected, and no more than 10 days for a vendor holding the data to tell you. Settle now who makes the notification call and who phones counsel, and put the vendor deadline in your contracts.

Common mistakes

1. Starting from a big-company framework. A 40-person business that adopts one built for a bank spends months on paperwork nobody opens again. Start with the decision table and the four areas, and add more only when a client or regulator asks.
2. Assuming your IT provider has it covered. Most provider agreements cover running the technology, not deciding what it should do. Ask your provider which decisions they think are yours. It’s often more than you’d expect.
3. Sending every decision to the owner. That’s a bottleneck, not governance. Most decisions belong with the person closest to them, inside a limit.
4. Setting it up once and never looking at it again. Owners leave, the business grows, and new tools arrive. Put the yearly review of the decision table and the policies on the calendar now.

How this fits the rest of your IT

Governance is the frame for the rest of this series. The roadmap and the annual IT budget decide what gets done, the quarterly review is where the checks happen, and technology due diligence looks at the same four areas in a business you’re buying. If you’re weighing whether your current provider can take this on, how to choose the right IT partner as your business grows covers what to look for. Virtual CIO services for small business has the whole library, grouped by topic.

How Sequentur can help

If you’d like help working out who should decide what about your technology, or you need governance in place before an insurance renewal or a compliance review, schedule a call. If you’re in Tampa or Clearwater, we’ll come to you.