The security administration mistakes that cause the most trouble in small businesses are not technical. They are recordkeeping failures: an inventory nobody updates, access that is granted and never reviewed, exceptions agreed verbally, logs with no retention decision, and documents with no named owner. Each one leaves a gap that is invisible day to day and obvious the moment somebody asks a question.
This article is general information about security administration and recordkeeping. It is not legal, compliance or security advice. Which frameworks and obligations apply to an organization varies by industry, size and jurisdiction, and those questions belong with a qualified professional who knows your situation.
What follows is a list of the patterns that show up most often, how to spot each one in your own records, and the paperwork that closes it.
Mistakes in what you have written down
Most of the trouble starts with the inventory, because every other record reads from it.
The inventory covers devices only. Laptops get counted, accounts and subscriptions do not. The gap this leaves is the biggest one on the list, because accounts change far faster than hardware and because a service nobody declared is a service nobody is maintaining. Fix it by adding three categories alongside devices: accounts and identities, software and subscriptions, and data stores.
Nothing has a last-checked date. A sheet with no dates cannot be distinguished from a sheet typed once two years ago. Add a single date column, fill it when someone confirms a row, and filter on it quarterly.
Retired items are deleted rather than marked. Deleting the row destroys the record of what you used to hold, which is sometimes exactly the question you need to answer. Change the status and keep the history.
The record lives in one person’s head. The most common version of this is the owner or the one technical person who knows the environment and has never written it down. The gap is not their competence, it is that nothing survives a vacation. Start with an hour of dictation into a plain sheet.
How to spot it
Open your inventory and count the rows that are not devices. If it is zero, or if the last-checked column does not exist, you have found your first week of work.
Security administration mistakes in access and ownership
Access is where gaps compound quietly, because permissions are added for good reasons and removed for none.
- Access is granted and never reviewed. Nobody set a cadence, so nobody is late. Fix it by scheduling a review, naming a reviewer and keeping the sheet.
- The person who administers access also approves it. The review becomes a self-check and confirms nothing. Separate the two roles even in a business of five people.
- Role changes add access but never remove it. After three internal moves a person holds the permissions of four jobs. Trigger a review on every role change, not just on joining and leaving.
- Leavers are handled informally. Email gets disabled, four other systems do not. Walk the full system list by name and record the date against each one.
- Shared accounts have no owner and no user list. Nobody can say who currently uses them, so nothing about them can be reviewed. Record a named owner and the current users for each.
- Service accounts belong to nobody. No human logs in, so no human feels responsible. Give each one an owner and a one-line note on what it does.
- Administrative rights granted for one project are never withdrawn. Make the end of a project a trigger for an access check, and write the withdrawal down.
- Contractors and agencies sit outside the roster entirely. They never appear in a staff-based review. Keep them on the same list as everyone else and review them at contract change.
The common thread is ownership. Access that no named person is accountable for will not be reviewed, because nobody’s calendar says to.
Mistakes in cadence and follow-through
A schedule that exists on paper and not in practice is its own category of gap, and it is the one most likely to be discovered by someone outside the business.
The cadence is a word, not a date. “Quarterly” with no specified week means it happens whenever someone remembers. Name the days.
Reviews are skipped in quiet quarters. A gap in the sequence is more visible than a review recording no changes. Hold the cadence and write down that nothing changed.
Decisions are made but never carried out. This is the most expensive mistake on the list. A review that marks twelve accounts for removal and removes none has consumed the effort and produced none of the result. Add two columns, date actioned and who actioned it, and do not close the cycle until both are filled for every line.
The log stops being written and nobody notices. Give the log an owner who glances at it monthly and dates the glance.
Nothing triggers an off-cycle review. Changes that should prompt one include a new system, a new provider doing the work, an incident or near miss, and a contractual obligation you have taken on. Write the trigger list into the policy so it does not depend on judgment in the moment.
Mistakes in exceptions and documentation
Exceptions are normal. Undocumented exceptions are the gap.
| The mistake | What it looks like later | The fix |
|---|---|---|
| Exception agreed verbally | Nobody can say who approved it or why | Register with approver, reason and review date |
| Exception with no review date | A temporary decision becomes permanent silently | Review date is never left blank |
| Same exception renewed every quarter | A business decision being deferred as an admin task | Escalate it as a decision, not another extension |
| Policy written to describe the ideal | The document contradicts the practice | Write the practice you have, with a dated plan to change it |
| Documents with no owner or version history | Cannot be assessed; reads as never reviewed | Named owner, version table, next review date |
| Policy names specific products | Goes out of date the week you switch suppliers | Describe the requirement, not the product |
The fourth row deserves emphasis. A policy claiming monthly access reviews in a business that has never run one documents a failure rather than a control. An honest document describing a quarterly review that genuinely happens is the stronger record every time.
Security administration mistakes in logging and triage records
Logging gaps are usually decisions that were never made rather than systems that were never configured.
No retention decision. Nobody wrote down how far back each source goes, so nobody knows which questions are answerable. Record a retention period per source, including the short ones.
Retention written as an aspiration. The document says a year, the system holds thirty days. Record what is actually held and note the shortfall as a known limitation with a review date.
Nobody owns alert review. Alerts arrive and are read by whoever happens to see them. Name who reviews, who covers, and who they escalate to.
Triage outcomes with no reason. A column of identical closures tells a future reader nothing. Require one sentence on what was checked and why the decision was reached.
The suppression list grows and is never reviewed. It becomes the place alerts go to be forgotten. Every suppression gets an owner and a review date.
No handover between whoever is on duty. Open items and expected activity do not reach the next person, so the same questions get investigated twice. Keep a five-line note with every change of duty.
Mismatched time zones across sources. Logs that cannot be read together are logs that cannot answer a question. Record the time zone per source and note the inconsistencies.
The pattern behind all of them
Every item above is a missing name, a missing date, or a missing written reason. That is genuinely the whole list. Technical sophistication does not close these gaps and its absence does not cause them.
So the practical test for any security administration record you keep is three questions. Who is accountable, by name? When was this last confirmed? And if a decision was made here, is the reason written down? A record that answers all three is doing its job. One that answers none is a document rather than a record.
Start with whichever record is thinnest rather than whichever is most interesting. In most small businesses that is the account inventory, and almost everything else reads from it.
To see which of these gaps shows up in your own records before you decide where to start, work through the Free Cyber Security Scorecard page on this site and use its weakest area as your first job.