A business can be busy and still struggle to see whether its work is improving. An owner may know this week’s sales but not which jobs are late, whether customers are waiting for an answer or whether important records could be recovered after a lost device. A few useful measures and a basic protection routine make these questions visible.

Start with one diagnostic question: “Which decision did I make last week without enough reliable information?” If it concerns performance, begin with Five Numbers to Review Each Week. If it concerns account access, backups or updates, begin with A Basic Cybersecurity Routine for a Small Business.

Use measures to choose an action

A measure needs an owner, a clear definition and a comparison period. “Complaints” could mean any comment, a formal request for a remedy or a repeated fault; decide which is useful before counting. The Australian government’s guide to setting business goals asks how progress will be known and where the information will come from. Its guide to digital performance illustrates the principle of choosing measures that match a goal rather than collecting every available number.

For example, a six-person workshop might review completed jobs, overdue work and customers awaiting a promised update each Monday. The owner then asks which number warrants one action this week. If overdue jobs rise, the team examines a handful of actual jobs before changing the schedule. A single figure is a prompt for investigation, not an explanation.

Protect what the business needs to function

List the accounts and data without which the business cannot book, deliver, invoice or contact customers. Give each account an owner; review access when roles change; plan how to restore essential records; and keep systems updated. The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide is written for smaller organizations beginning this work. CISA’s small-business resources cover measures including multifactor authentication, updates and backups. Controls reduce risk but cannot guarantee security.

Measure whether reviews actually happened, not just whether a policy exists. For a two-week trial, record the share of priority accounts reviewed, the date of the last successful restore check and whether important updates are overdue. If an issue concerns a suspected breach or regulated data, obtain qualified local advice promptly; incident duties vary by jurisdiction.

Next step: Write down one weekly decision that currently relies on a guess and one essential account that needs a named owner. Choose which of the two article topics to test first.