Most owners only look at IT when something has already gone wrong: a file won’t open, a laptop won’t start, or an invoice gets paid into a scammer’s account. Fixing it then costs more than preventing it would have.
Almost none of it happens without warning. The backup that fails when you finally need it had been failing for weeks. The account a scammer used belonged to someone who left last year. Thirty minutes a month is usually enough to catch that kind of thing.
Why a monthly look is worth the time
Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches started with attackers exploiting software that hadn’t been patched — making unpatched software the most common initial path in that dataset, ahead of stolen passwords. The same report found the median time to fully fix a known problem had risen to 43 days.
Most attacks use a problem that was already known, with a fix already available. Nobody had installed it yet.
The check
1. Updates
Check whether Windows updates are installing on your computers — or sitting at “restart required” week after week. Do the same for phones and for the software you use most (browser, accounting app). If people keep clicking “remind me later,” that’s something to fix.
2. Backups
Open your backup tool and look at the last few runs. You want recent successful backups, not a list of errors. Then check when anyone last restored a file. If it’s never been tested, you don’t know whether it works.
3. Who has access
Pull up user accounts in Microsoft 365 (or Google Workspace) and read the list. Every name should be someone who still works for you. Look for leavers, finished contractors, and shared logins like “office” or “admin.” Switch off anything you don’t need.
4. Multi-factor authentication
Confirm MFA is on for everyone, not just early adopters — especially admins and anyone who handles money. Microsoft’s research has shown MFA blocks more than 99.2% of account-compromise attacks.
5. Devices
Look at what’s connected to your systems. If there’s a laptop or phone you don’t recognize, find out whose it is. Confirm laptops are encrypted and any phone with company email has a passcode or biometric lock.
6. Subscriptions and licenses
Open your billing page and read what you’re paying for. Businesses regularly pay for licenses belonging to people who left, or for two tools that do the same job. It’s also how you find shadow SaaS somebody signed up for without telling anyone.
Make it a routine
Put it on the calendar on a fixed day — first Monday of the month works — and give it to the same person each time (you or whoever handles admin).
Keep a running note of what you checked and what you found. After a few months you’ll see whether the same problem keeps coming back. If it does, fix the root cause instead of clearing it every month.
Thirty minutes only works if you don’t stop to fix everything mid-check. Write findings down; deal with them afterward.
Who fixes what
Handle the small stuff yourself: a laptop that needs restarting, a license to cancel, an account to disable.
Send the rest to your IT provider: backups that keep failing, MFA that won’t enable for someone, a device nobody recognizes, or updates that fail on the same machine every month. Those usually mean a bigger problem underneath.
What this check doesn’t do
It isn’t 24/7 monitoring. A good MSP has tools watching systems all day and flagging things you’d never spot from a monthly glance.
The check covers what those tools can’t know on their own: who left, which subscriptions you approved, and whose laptop is whose. West Computers clients get the monitoring layer; this checklist is the owner-side pass that keeps people and billing honest.
Frequently asked questions
How often should a small business check its IT?
Once a month for this list. Glance at backups more often if losing a day’s work would seriously hurt.
Who should do it?
You or whoever runs the admin side. Most of the list needs no deep technical skill — just knowing who works there and what you pay for.
What if I don’t know where to find any of this?
Ask your IT provider to walk you through it once and write down where each item lives. Many will also send a monthly summary covering most of it.
Isn’t this my IT provider’s job?
They handle monitoring, patching, and fixing. The check is the part that depends on knowing your business — who left last month, which subscription nobody approved.
If I only have ten minutes, what matters most?
Backups and updates. Without working backups you can lose everything you’ve stored, and unpatched software is a top way attackers get in.
Does this apply if everything we use is in the cloud?
Yes. Cloud tools still need updated devices, working backups, MFA, and access lists that match who actually works for you.
Article adapted with permission from The Technology Press.