Anonymised case study based on my own hands-on work. The company is not named and no figures are claimed.
The situation
A mid-sized services company relied on Google Workspace for email, calendars, shared drives and video calls, but day-to-day IT sat with whoever had time. Account requests arrived through chats and hallway conversations, shared mailboxes had unclear owners, and domain email settings had grown by trial and error. The brief was simple: make IT predictable without adding bureaucracy.
The approach
1. One front door for IT requests. A shared IT mailbox became the single place for access requests, new joiners, leavers and issues, so every request had a written trail and nothing depended on memory.
2. A joiner and leaver routine. New accounts were created from a short checklist: the right organisational unit, groups, shared drives and signature. Leavers had sign-in suspended, mail and files handed to a named owner and devices recovered before the account was closed.
3. Groups instead of forwarding rules. Team addresses moved to Google Groups with named managers, which removed personal forwarding rules that nobody could audit.
4. Domain email hygiene. Sending domains were checked for correct SPF, DKIM and DMARC records, and third-party tools sending on the company's behalf were listed and authorised explicitly.
5. Security basics everywhere. Two-step verification was required, admin rights were limited to the people who needed them, and third-party app access was reviewed instead of approved by default.
6. Written runbooks. Each routine task got a short runbook, so a second person could cover holidays.
The outcome
IT work became visible and repeatable: requests had an owner and a history, account changes followed one routine, and email authentication and admin access were known rather than assumed.
FAQ
Does a mid-sized company need a full-time IT person? Not always; clear routines and a shared request inbox go a long way.
What should be fixed first? Admin access, two-step verification and leaver handling carry the most risk.
I take on a small number of advisory and hands-on systems engagements each quarter. Connect at virender.in.