SMBs make extensive use of IT from the day they are conceived
PC penetration is high. The overwhelming majority use internal networks and servers. All are now connected to the internet. Many are starting to use advanced storage options.

Their IT infrastructure is complicated by use of diverse operating systems
On the desktop Microsoft Windows is used by 93.5% of SMBs, but many have not upgraded to Windows XP and are using a mix of old and new to avoid the inconvenience and expense of upgrades. On their servers SMBs are also using a mix of old and new versions of Microsoft operating systems along side UNIX, Linux and other operating systems

SMBs are still managing most of their applications in house and there is no headlong rush for hosted solutions
Email is quite commonly outsourced and business applications increasingly so. But the majority have no stated plan to move to external management by a third party preferring to keep things in house.

There is an awareness of the threats to information systems and the data they contain
After the failure of internet connections the most common problems faced by SMBs are attack by viruses and malfunction of PCs. This makes the PC the most vulnerable part of the IT infrastructure and the problem is increasing as employees become more mobile. Despite this, PCs are not as well protected as servers.

SMBs need to keep their IT management under review and be responsive to new threats
Once good practice is in place it needs to be kept under review to make sure it remains effective and that new threats like spyware and phishing are protected against.

Patching of operating systems is not as effective as it should be
The belief that there is little benefit in paying for upgrades is understandable, but it should not preclude good patch management. Small SMBs need to take advantage of Microsoft's automated online patch management procedures. As businesses grow and their IT environments become more complex, central management of both servers and PCs becomes more important and in house automated software can be used to achieve the same goal.

The main reason that good practice is hard to achieve is due to lack of expertise and resources
Most small SMBs do not have an IT expert in-house. Even in large SMBs, where they often do it is not always their full time job. This means that to achieve good practice SMBs require easy to use automated tools.

Those responsible for IT in SMBs should be free to focus on the business, whether or not it is their full time job
Automating the drudge of backup, patch management and keeping security up to date frees the individual responsible for IT to focus on adding value to the business. This is not only a motivation for them, but increases the overall confidence the business has in IT and makes sure it is able to react more easily to rapidly changing business needs and regulatory requirements.