Central Perk Cafe: A fictional case study of a well structured small business
This page presents a realistic small-business example that is intentionally best in class across four pillars: IT Infrastructure, Cybersecurity, Compliance, and Streamlined Operations.
The goal is to show what “organized” looks like when systems, security, and operations are treated as one program. Each pillar includes downloadable SOPs.
How to use this page
- Read the story to understand the business context.
- Download the SOPs.
- Compare what Central Perk does to what your business does today.
- Notice where gaps appear: missing managers, no cadence, no evidence, and too many undocumented exceptions.
The story
Central Perk Cafe is a single-location coffee shop with 22 employees, seasonal hiring spikes, and a mix of dine-in and mobile orders. They accept card payments, use a cloud POS, and run accounting and payroll through SaaS tools.
The owner wants three outcomes:
- Predictable uptime
- Predictable costs
- Fewer surprises
Their MSP relationship is built around standards and routine verification. Instead of “call us when it breaks,” Central Perk runs a short list of repeatable processes that keep the business stable without requiring a large internal IT team.
The four pillars
1) IT Infrastructure
What good looks like: standard devices, segmented networks, tested backups, and documented recovery steps.
Why it matters: fewer outages, faster fixes, less chaos when something fails.
SOPs
- SOP-IT-001 Workstation, POS, and Tablet Standard Build and Lifecycle
- SOP-IT-002 Backup and Disaster Recovery for POS, Accounting, and Shared Files
- SOP-IT-003 Network and Wi-Fi Segmentation for Guest, Staff, POS, and IoT
2) Cybersecurity
What good looks like: strong identity controls, phishing defenses, monitoring, and a clear incident playbook.
Why it matters: most small-business incidents start with email, passwords, or unmanaged devices.
SOPs
- SOP-CS-001 Identity and Access Management (MFA, Least Privilege, Access Reviews)
- SOP-CS-002 Email Security and Phishing Response
- SOP-CS-003 Incident Response for Ransomware, POS Compromise, and Account Takeover
3) Compliance
What good looks like: day-to-day controls that support PCI requirements and practical privacy expectations, with evidence that controls are happening.
Why it matters: compliance is easiest when it is built into routine operations, not treated as a yearly scramble.
SOPs
- SOP-CO-001 PCI DSS Operational Controls for Card Payments
- SOP-CO-002 Data Retention and Privacy for Customer and Employee Information
- SOP-CO-003 Vendor Risk Management for POS, Delivery Apps, and IT Providers
4) Streamlined Operations
What good looks like: clean onboarding, disciplined ticketing, and a monthly cadence that turns IT into business outcomes.
Why it matters: most small-business IT pain is process pain, not technology pain.
SOPs
- SOP-ST-001 New Hire Onboarding and Offboarding for Systems and Security
- SOP-ST-002 Ticketing and Change Management with the MSP
- SOP-ST-003 Monthly Business Resilience Review (Patching, Backups, Security, KPIs)
What well structured looks like in practice
- Named managers and cadence: every control has someone accountable and a frequency.
- Evidence: Central Perk can prove what happened, not just claim it.
- Few exceptions: exceptions exist, but they are time-bound and documented.
- Business alignment: maintenance windows and priorities match cafe operating realities.
Fictional company. Example documents for demonstration and education.