Practical technology guidance for your business

MFA: the highest-impact protection you can turn on today

Multi-factor authentication (MFA) asks for a second confirmation beyond your password — usually a code or an approval from your phone. It's the single most effective security measure against account takeover: even if someone gets your password through phishing or a data breach, they can't get in without that second factor.

Microsoft has reported that MFA blocks the vast majority of unauthorized account access attempts. Even so, it's common to find organizations where only some users have it turned on — often because rollout was never finished across every account, not because anyone decided not to use it.

If you're not sure what percentage of your users have MFA active, it's one of the first things we check in any security assessment.

5 signs of a phishing email

Phishing remains the most common way an attacker gets into an organization — not because technology fails, but because it tricks a person. These are signs worth teaching your whole team:

1. Unusual urgency. "Your account will be suspended in 24 hours" or "Payment overdue, act now" — time pressure is designed to keep you from thinking twice.

2. The sender doesn't match. The display name might say "Microsoft," but the actual email address is something else — it's always worth checking the full address, not just the name.

3. Links that don't go where they claim. Hovering over a link (without clicking) shows the real URL — if it doesn't match what the email describes, that's a clear sign.

4. Unusual requests for information. No legitimate bank or vendor will ask for your full password, an MFA code, or an urgent wire transfer by email.

5. Language or formatting errors that aren't typical for that organization. Not always present, but a red flag when they show up.

The 3-2-1 backup rule: what it means and why it's the standard

The 3-2-1 rule is a simple way to make sure a backup actually protects you when you need it: at least 3 copies of your data, on 2 different types of storage, with 1 copy off-site (in the cloud, or at a separate physical location).

The most common mistake we see isn't a missing backup — it's a backup that exists but has never been tested. A backup that can't be restored correctly isn't a backup, it's a false sense of security. We recommend testing restores periodically, not just confirming the backup "ran" without errors.

In Puerto Rico, the off-site copy is also protection against extended power or weather-related outages — not just ransomware or human error.

How to choose an IT services provider in Puerto Rico

Some concrete questions worth asking any provider before you sign:

How do they prove backups actually restore? Ask them to show you evidence, not just tell you.

How fast do they respond to an urgent issue, and how do they measure it? A promised response time with no historical data behind it is just a promise.

Do they explain technical decisions in terms you understand, or just tell you what to buy? A good provider helps you understand the "why," not just execute the "what."

How do they handle licensing and long-term cost? Some providers make more when you buy more licenses than you need — it's worth having them explain exactly what you're paying for and why.

Ask a Technology Question