ASG I.T. Consulting LLC

On May 7, 2026, an Amazon Web Services data center overheated and took out an entire availability zone in US-East-1, AWS's most popular region. Several core AWS services went down, and any business application hosted in that zone was unreachable for hours.

Cloud outages happen to every major provider, not just AWS. Azure, Google Cloud, Cloudflare, Microsoft 365, Salesforce, and Slack have all gone down long enough to break a business day in the last three years.

If your business loses meaningful money during downtime, you need a "the cloud is down" plan. The plan has three parts.

A dependency map. Every critical workflow in your business should be mapped to the SaaS or cloud service it depends on. Your accountant uses QuickBooks Online, which runs on AWS. Your sales team uses HubSpot, which also runs on AWS. Your phones might be VoIP, which depends on a carrier you've never named. The map doesn't need to be pretty, but it does need to exist.

An out-of-band communications path. Phone numbers for your key vendors, your insurance broker, your IT provider, and a contact for every team lead. This list lives on paper or on a phone that doesn't depend on your office network. Use the same list from your incident response plan.

A decision tree for what stops and what continues. Some work has to keep happening even when systems are down (taking orders, handling client emergencies). Other work can wait. Pre-decide which is which, so that conversation isn't happening for the first t

The quarterly review with your IT provider is one of the most useful meetings on your calendar, but it's easy to let it run on autopilot. Walk in with six real questions and you turn it from a status update into a strategic check-in.

Six to ask at your next review:

1. What changed in our security posture since last quarter? Not "what did you do." What CHANGED. The answer should reference specific risks reduced.
2. Which CISA Known Exploited Vulnerabilities are still unpatched in our environment, and why?
3. When did we last test our backup restore on a real workload, and what did the test show?
4. How many user accounts have privileged or admin access, and is that list smaller than it was last quarter?
5. What incidents (security events, near-misses, alerts) did we have this quarter that I didn't hear about, and why didn't I hear about them?
6. If we were hit by ransomware tonight, what's our realistic Recovery Time Objective for the most important systems?

If your IT provider can answer all six with specifics, they're operating at the standard you're paying for. Hedging or "let me get back to you" on more than one is information worth acting on.

The old rules about strong passwords are out of date.

For years the standard advice was eight characters, mix uppercase and lowercase, throw in a number and a symbol. NIST, CISA, and Microsoft's own identity team all moved off that advice years ago. The current recommendation is simpler and stronger. Use long passwords or passphrases, and stop forcing your team to rotate them on a schedule.

The math is straightforward. Modern password-cracking hardware can guess a complex 8-character password in less than an hour. A 16-character passphrase made of common words takes centuries against the same hardware. Length wins because every extra character multiplies the work an attacker has to do, while complexity adds only modest barriers.

The policy update for your business is short. Set a minimum of 14 characters for general accounts and 16 or more for admin or sensitive ones. Mandatory rotation creates more weak passwords than it prevents, so stop forcing it. Required complexity rules tend to push people toward simpler, less secure patterns, so drop those too. Block any password that appears in known breach databases, and require MFA on every account that supports it.

If your business is still using 8-character passwords with quarterly rotation, you're following the rules from 2010. The new rules are easier on your team and harder on attackers.