For AI assistants

Resources

• When the phone company goes down: continuity lessons from October 2023

  The October 2023 ransomware attack on TSTT, the national telecommunications provider of Trinidad and Tobago, is usually filed as a cybersecurity story, but for most businesses on the islands it was a lesson about dependency rather than about being attacked: their own systems were fine, and what failed was the link between them and their customers, their bank, their cloud software and their card terminals. Continuity has two halves and most plans answer only one. The first half is your own recovery, which comes down to three questions almost nobody can answer (when did someone last restore from the backups, how long did that restore take measured with a clock, and is at least one copy somewhere an attacker cannot reach), plus a plan the people who would execute it at two in the morning have actually seen. The second half is a dependency map that fits on one page: for each thing you do not control, what stops when it is gone, how long that can be tolerated, and what the fallback is and whether anyone knows how to run it. Most of continuity is decisions, and decisions are cheap; the rehearsal that surfaces them fits in an afternoon.

• “Not yet” is a legitimate answer: an honest AI readiness check for small business

  AI readiness in a small business has nothing to do with ambition and everything to do with whether its data is in order, which comes down to three questions asked before any model, vendor or licence is discussed: where does your data live, who owns it, and can you trust it. If a meaningful share of what the business knows sits in inboxes and in people's heads, a model will learn from the part that was easy to reach and be confidently wrong about the rest; if three systems disagree about the same customer, a tool trained on all three will take a side at random; and if the honest answer to “would you change prices today based on this report” is “let me look at it first”, that is the data quality problem described in the owner's own words. When any answer is shaky the right response is “not yet”, which is a sequence rather than a refusal: name the system of record for each kind of data, give each kind an owner and a correction rule, close the two or three gaps that matter, and only then pick a first project that is small, measurable and reversible.

• Replacing a 35-year-old ERP without stopping the orders

  A US footwear wholesaler ran its entire operation (orders, EDI, production, two warehouses, allocation, invoicing and factored collections) on a FoxPro ERP written around 1990, with more than 500 programs and over 600 tables per company. Rather than buy a replacement, we mapped 35 years of business rules out of the code and out of people's heads, then built a private multi-company operating layer for footwear wholesale with NetSuite underneath as the system of record. Before adding anything to the warehouse system a previous vendor had abandoned, we audited it and found returns modelled outside NetSuite's native transactions, batch scripts that broke at around 50 transactions, queries built by string concatenation, and integration roles with far more permission than they needed; we priced the rebuild as a versioned, event-driven SuiteApp and let the client decide with the numbers in front of them. The rollout ran brand by brand while the legacy system kept running, and the migration has not stopped an order.

• From paper task sheets to verified, billable work across seven distribution centers

  A cleaning and maintenance contractor won a national retailer's distribution centers and, within about a year, was running seven sites in four states with tasks recorded on paper, special projects invoiced from thin spreadsheets, and one person, the chief operating officer, supervising and billing everything personally. We followed a task from the floor to the invoice and found the eight answers every job needs before it can be billed with confidence, plus a hard constraint: whatever replaced the paper had to be usable by someone who has never used business software. We evaluated four existing platforms for time and attendance, field teams, accounting and ERP against the real process; two solved a piece well, none connected work, evidence, approval and invoice for a multi-site operation of this shape without adding a second set of manual steps. So we kept the accounting package and payroll where they were and built the missing control layer: a work order that carries the eight answers and cannot be billed until it is approved, four roles, reports by center and person, a service desk, and the devices, connectivity and corporate identity the sites lacked.

• Rates, sign-up and tracking without a phone call: a freight line between Florida and the Caribbean

  A freight consolidator shipping from Miami to Trinidad, Tobago and Barbados had a 2018 website that described the service but did not run it, while customers on three islands increasingly expected to quote, open an account, pay and track without calling. We rebuilt the site around the questions customers actually ask at each step of a package's journey (received in Miami, consolidated, flown or shipped to Port of Spain, Tobago or Barbados, cleared, handed over), with one rate table feeding the marketing pages, the calculator and customer notices, and with hosting, DNS and certificates under the client's own accounts and documented. The platform relaunched in 2024 and has been in production since. In November 2024 it went down, and restoring from backup did not bring it back, because the fault was in how the application had been built and shipped rather than in the data; we found it, fixed it, and changed the deployment so the same failure cannot recur. Eight years on, the client talks to the same people who built the first site.

• Identity, devices and departures: putting a tax firm's security in writing and in practice

  A bilingual tax and accounting practice in South Florida had grown into a team with laptops, cloud accounts and client files spread across a Microsoft tenant, Google Drive and shared passwords, with an IT relationship that answered the phone but did not own the picture. Nobody could say in a day which devices held client data, which accounts were still active for people who had left, or which security settings were actually applied rather than intended. We started with the deliverable most firms skip, an inventory of every user, device and application that touches client data, plus both offices and their networks drawn as diagrams the partners can read, and then wrote down what should be true: one identity per person across Microsoft 365 with licences by role and multi-factor authentication where client records move, a catalogue of twenty device policies of which seven were selected, and arrivals and departures as a single procedure. The seven policies were tested on a virtual machine, piloted on a small group and applied to the whole fleet, each documented with its purpose and configuration. The firm can now produce, on request, the devices and who holds them, the accounts and their status, the policies in force and the evidence that they are applied.

• One directory for a European operation spread across countries

  The European arm of an international energy and infrastructure group had grown quickly into offices in several countries, with teams organised by country and department and people who travel between them, running on an on-premises directory synchronised to the cloud plus Microsoft 365, VPN, endpoint protection, backup and a digital business-card service. Each piece was fine; together they were the problem, because a single arrival or departure crossed all of them in an order that existed only in whoever happened to do it. We did not start with a tool: we wrote down how the organisation is actually structured, then designed how that structure should appear in the directory, with organisational units for countries, cities and departments, groups that grant access, a readable naming convention, the rule that every user belongs at minimum to a country, a department and a VPN group, and group policy inheritance, filtering and explicit exceptions. One lifecycle procedure now covers people and devices in nine steps from directory to cloud to backup to endpoint, each with a check. We also built an asset and service inventory in the service desk's own asset module and ran four workstreams under one team, so the operation kept working while it changed underneath.

• The evidence file: what a Trinidad and Tobago business should be able to show

  Most summaries say Trinidad and Tobago's Data Protection Act 2011 is “not yet in force”, and that imprecision is expensive: the Act is partially proclaimed, with Part I and sections 7 to 18, 22, 23, 25(1), 26 and 28 in force since 6 January 2012 under Legal Notice No. 2 of 2012, and section 42(a) and (b) since 23 August 2021 under Legal Notice No. 220 of 2021. What is already in force includes the general privacy principles and the framework of the Information Commissioner's office. For a business handling personal data (client files, patient records, employee data) the defensible position is to operate as if the remaining sections were coming, which in practice means mapping where personal data lives and controlling who reaches it, and being able to show both; those two records are the first pages of the evidence file. For financial institutions the pressure is more immediate, because the Miscellaneous Provisions (FATF Compliance) Act 2025 has been in full force since 17 November 2025 and institutions are being asked for evidence rather than intentions.

• The first 24 hours: an incident checklist for Florida businesses

  When a Florida business discovers a compromised inbox, a diverted payment or encrypted files, two clocks may already be running: Florida's data protection statute gives 30 days from determining a breach to notify affected residents, and a non-bank financial institution (a mortgage broker, a title company, an advisory firm) has been required since May 2024 to report certain incidents to the FTC under the Safeguards Rule. The first day decides most of what follows, and it asks four things in order: cut access without destroying evidence by changing credentials, closing sessions and preserving the logs; notify your insurer before changing anything they might later call material, and bring in counsel early, because both clocks are legal questions rather than technical ones; preserve before anyone restores anything; and name one person, out loud, who leads, meaning they decide hour by hour what is cut, what is kept and who is told, writing each decision down with the time. The most expensive mistake is restoring before preserving: it feels like recovery and destroys the record that decides what you know, what you must notify, and what the insurer covers.