In most Polish SMEs, leadership knows down to the złoty how much the company earns and how much it spends on marketing. It doesn't know whether IT is running well or just pretending. As long as things work, nobody asks. When they break, everybody asks — loudly and at once. It can be done differently.
The point isn't to build a "CIO action pack" with 40 KPIs and a management dashboard for 60 grand. The point is six numbers that land on one A4 sheet each month (or one slide), show a 12-month trend, and give leadership a clear read: is IT under control, or is it drifting. Without those numbers, every conversation about IT collapses into "I feel like…". With them, it becomes "resolution time spiked in April — let's find out why".
This piece is about which six numbers are actually worth measuring in a 10–50 person company, and how to do it without hiring an analyst.
Why IT should be measured like any other department
The sales team has KPIs. Production has OEE. Accounting has month-end close timeliness. In most Polish SMEs, IT has nothing — beyond the owner's gut feeling that "things seem to break more lately". The result: IT budget decisions get made emotionally (generous after an outage, grudging after a quiet quarter), and the quality of the external vendor or in-house team is judged by whoever complained loudest this week.
Six metrics won't replace a conversation. But they take the guesswork out of it. A shared vocabulary suddenly appears — inside the company, and with the external IT provider who now has to put the same numbers on the table each month, agreed to in the contract.
The rule is simple: measure what you'd notice first if it stopped working. The rest is statistics for statistics' sake.
Metric 1 — Uptime of critical systems
The percentage of the month during which the systems that actually stop the business when they're down were up. Not "all systems" — just those three or four whose absence hurts immediately: ERP, email, file server or SharePoint, in some businesses the online store too.
Target for a typical SME: 99.5% monthly for critical systems, meaning at most ~3.5 hours of downtime per month. That's a realistic threshold — full 99.99% (52 minutes a year) demands architecture a 20-person company has no reason to pay for.
How to measure: simple HTTP/HTTPS + ping monitoring (Uptime Kuma, Zabbix, cronjob) probing the key endpoints every minute. Commercial tooling isn't required. Monthly report: uptime percentage + list of major outages with a one-sentence root cause.
Metric 2 — Ticket resolution time
Average time from ticket opened to closed, broken out by priority. This is the most honest measure of your IT team's or vendor's quality — more so than the number of tickets (which you don't want to reduce; you want to reduce the recurring ones).
Sensible SME thresholds: critical (system down) — up to 2 hours; high (one person can't work) — up to 4 hours; normal — up to 24 business hours. Don't copy someone else's SLAs; set your own based on what actually hurts. An online store down for 6 hours costs differently than a printer offline for half a day.
Monthly report: average time per priority + percentage of tickets within SLA. Also add the number of tickets open at month-end for longer than 5 days — that's where "not-really-important" problems fester quietly until they blow up six months later.
Metric 3 — Backup restore test result
This is the metric 80% of companies consider "handled" because "the backups are running". The question "when did you last actually restore a file from backup, from scratch?" usually ends in silence.
The metric is simple: once a month, pick one meaningful dataset at random (ERP database, accounting folder, one person's mailbox) and restore it from backup to a test environment. Log: did it succeed (yes/no), how long it took, is the data consistent. Monthly report: result + real RTO + date of the last successful test for each critical dataset.
This one number saves the company once every couple of years. A backup that has never been tested isn't a backup — it's a hope.
Metric 4 — IT cost breakdown
Leadership doesn't need to reforecast the IT budget every month. It needs to know whether run-rate costs (licenses, cloud, support) are rising, falling, or flat. And where the money goes broken out into 4–5 categories, not 30 line items.
A sensible split for a monthly report:
- SaaS licenses and cloud (Microsoft 365, Google, hosting, cloud backups)
- External support (IT outsourcing, one-off projects)
- Hardware (new laptops, monitors, replacements)
- Security (antivirus, MFA, SIEM, cyber insurance)
- Everything else (printers, telephony, network)
Month-over-month view spots trends faster than the annual audit. When SaaS costs jump 12% without any new headcount, something got bought quietly — time to open the subscription registry.
Metric 5 — Phishing simulation click rate
Security in SMEs usually gets measured by "how many antivirus licenses do we have". That's meaningless. The one security metric that actually says something about the company's resilience is how employees react to a fake email.
Once a month, send the team a simulated phishing message (an invoice, a bank notice, a "CEO" transfer request). Measure three numbers: who clicked the link, who entered credentials, who reported the message as suspicious. The goal is to move click rate from the typical 20–25% at the start down to 3–5% within 6 months — and grow the number of reports. Report growth matters more than click reduction: it shows the team is actively watching.
Monthly report: click rate + report rate + one-line note on what the simulation was.
Metric 6 — Patch compliance
The percentage of company laptops and servers that have all critical patches from the last 30 days installed. It's the single best indicator of IT hygiene — it says more about the level of discipline in the shop than any list of tools does.
Target: 95% of devices within 30 days of a critical patch release. That's a workable threshold — 100% is unrealistic (someone is always on leave with their laptop locked away), but 60% means there's no discipline in the company and the first serious CVE will roll you over.
How to measure: Intune, WSUS, GPO; in smaller companies a plain PowerShell script collecting Get-HotFix from every domain-joined machine. You don't need a SIEM, you need discipline.
A real example
A 30-person distributor of technical components from Silesia started reporting those six metrics in January — one A4 sheet at each monthly board meeting. After 6 months, two findings paid the cost of the whole exercise back many times over.
The first: the "ticket resolution time" metric showed that the average time at their IT outsourcing vendor was 4.2 business days for "normal" tickets, against a contractual 24-hour SLA. Nobody had measured it before; everybody grumbled, but without numbers. Once the chart was on the table with the vendor, they negotiated a 15% retainer cut for three months and a specific commitment to the 24-hour SLA. By the end of the quarter the real time was down to 18 hours.
The second finding was even simpler — and more expensive. The IT cost breakdown showed the "SaaS licenses" category rising month after month, even though headcount was flat. A half-day review of the Microsoft 365 admin console turned up 12 active accounts for former employees (from 3 months to 2 years after leaving), plus duplicate licenses left over from a migration from Business Standard to Business Premium that nobody had switched off. Turning all of it off yielded roughly PLN 21,000 in annual savings. Without the metric, nobody would have caught it — the costs just showed up as "the usual Microsoft invoice".
Two numbers, one report, one evening of analysis. That's the effect you're after.
Where to start
You don't need to build a system. You need to collect the six numbers manually in the first month and start showing them. In order:
- Write down the targets. Agree with leadership what count as "green" and what counts as "red flag" numbers. Without that, a chart is just a chart — not a decision.
- Get the data you don't have. You're probably missing uptime monitoring (one hour of setup), a regular backup restore test (one day), a phishing simulation (Microsoft Attack Simulator in M365 Business Premium is free; external alternatives from ~€8/user/month).
- Make the first report on paper. Excel, PowerPoint, Notepad — doesn't matter. One page, six numbers, three-month trend (or "start" if this is the first month).
- Bring it to one board meeting. Don't ask for it to become "a permanent agenda item" — just bring it and show it. If it's useful, it'll stay. If nobody engages, check whether you're measuring the right things.
- After three months, drop the metric nobody asks about and add the one somebody did. Don't cling to the list. Six is the ceiling of what a board can absorb in a minute — not a floor.
If you don't have someone in the company who can collect the first round of data and lay out the report in half a day, we do this for clients as a "workshop + one-off setup + template". First call is free and takes half an hour.
IT that isn't measured gets managed by emotion — generous after an outage, grudging after a quiet stretch. Six numbers a month is enough to change that.