I'm the only technical person at a small business. My work has shifted from data projects into system administration, security and client risk assessments. I've figured out some basics, but I haven't had much mentoring.
What should I focus on learning and putting in place? Courses, communities and practical starting points would all be helpful.
Start with a boring baseline that someone else could pick up if you were unavailable. Make an inventory of systems and devices, record who owns the important accounts, separate admin accounts from everyday accounts, and check where MFA is enabled.
Then document your patch schedule, endpoint setup, backups and restore tests. A simple risk register can track what still needs work, how serious it is and why it hasn't been fixed yet. Write down why you made decisions, not just which buttons to click.
Since you're working in a Microsoft environment, AZ-900 is a reasonable starting point for cloud fundamentals. From there, look at training for the Microsoft 365 and cloud admin areas you actually manage, rather than collecting certifications just to collect them.
Try to connect each module to a task at work. Identity, access, endpoint management and security settings will probably be more useful than studying topics you never touch.
Pick a framework like CIS Controls or NIST CSF and use it as a checklist for finding gaps. You don't have to implement everything at once. Compare it with what you already have, note the risks and choose a few things to improve.
Don't use Secure Score as the whole assessment. It's a useful signal, but it won't tell you everything about your environment or whether you can recover when something breaks.
For the client questionnaires, keep your current policies, system diagrams and asset information together somewhere you can maintain them. That makes it easier to give consistent answers and spot questions you can't support with evidence.
Automate repetitive admin tasks where it makes sense, but document what the automation does and how to run or update it. Otherwise it can become another thing only one person understands.
Answers are reviewed before publication.
7e+tagclip_309:
What would you document first? There's a lot in that list.
4r~zipcase_638:
I'd start with the inventory, account ownership and how to restore critical data. Those give you a useful map while you work through the rest.