A mid sized company once needed an onboarding workflow recreated from scratch, not redesigned, recreated, because the only documentation for it lived in the head of an employee who had already left. The bill for consultants to reverse engineer that single process came to 47,000 dollars. The process itself was not complicated. The problem was that nobody had ever written it down.
Most of what your business knows isn’t written anywhere
Research on institutional knowledge puts a number on something most operators already sense intuitively: roughly 80 percent of an organization’s total knowledge is tacit, meaning it exists only in someone’s experience rather than in a document, a diagram, or a system. Of that, about 42 percent is unique to one individual, so if that person is out sick, on vacation, or gone for good, that knowledge isn’t available to anyone else until it gets painstakingly rebuilt.
For larger companies, this shows up as lost productivity on a massive scale, researchers estimate Fortune 500 companies lose over 31 billion dollars a year to poor knowledge sharing alone. For a small or mid sized business, the number is smaller in absolute terms but often more dangerous in practice, because there is no redundancy. When one person is “the IT person” and everything about your network, your vendor accounts, and your system passwords lives in their head or their personal notes, you don’t have a documentation gap. You have a single point of failure wearing a job title.
Why this is a security problem, not just an inconvenience
Undocumented environments slow everything down even on a normal day, knowledge workers report losing over five hours a week waiting on information or recreating things that already exist somewhere, just not anywhere anyone can find. But the real exposure shows up during the moments that matter most.
If a key employee leaves and nobody has a current access list, you cannot confidently say which accounts and systems to revoke access from, which is exactly the kind of gap that leads to a former employee’s credentials sitting active for months. If your business has a security incident, responders need to know what’s on your network and how it’s configured before they can contain anything, and that process takes far longer when the answer is “ask Dave” and Dave is unreachable. Our network and server management work is built around maintaining exactly this kind of current documentation, because it is the difference between a fast response and a slow, expensive one.
Where to start
You do not need to document everything at once. Three areas give you the most protection for the least effort:
- A current asset and network inventory. What hardware, software, and systems exist, and how do they connect. If this lives only in someone’s memory, that is priority one.
- An access and credential map. Who has access to what, and how that access gets granted and revoked. This is also the fastest fix for offboarding risk.
- Vendor and escalation contacts. Who do you call, for what, and under what contract. This is the one people forget until they need it at 2am.
Good helpdesk support should be building and maintaining this documentation as a byproduct of day to day tickets, not treating it as a separate project that never gets prioritized. If your business cannot answer “what happens to our IT if our one key person is unreachable for a week,” that is worth fixing before it gets tested for real. Schedule a free security assessment with Cloud9 and let’s find out where your documentation gaps actually are.