The SMB IT checklist: 10 things to review every quarter

If you run a business with 10 to 100 people, you probably do not have someone whose full-time job is IT. Technology is handled by whoever is closest to it — often an office manager, an accountant or the owner. That works surprisingly well, until it does not.

This checklist is the routine we use when reviewing an SMB environment. It is deliberately practical. You do not need specialist tools for most of it, and you do not need to fix everything in one go. The point is to find the gaps before they find you.

1. Backups — and whether they restore

A backup that has never been tested is a hope, not a backup. Start by confirming three things: what is being backed up, where the copies live, and how long it would take to recover.

• Coverage: Are servers, cloud data, finance systems and email included? Are staff laptops covered, or only shared drives?
• Separation: Is at least one copy offline or immutable, so ransomware cannot encrypt it too?
• Recency: What is the recovery point — last night, last week, last month?
• Restore test: When did someone last restore a real file and confirm it opened?

If nobody can remember the last restore test, that is your first action item. Pick one folder and one file, restore it to a temporary location, and verify it.

2. Updates and patching

Unpatched software remains one of the easiest ways in for an attacker. The review here is less about installing updates and more about knowing whether they are actually happening.

• Are operating system updates applied automatically, or waiting for someone to click “restart later” indefinitely?
• Are browsers, PDF readers, Office and other common applications updated too — not just Windows?
• Are servers patched on a planned schedule, with a rollback plan?
• Is any device unsupported? An operating system that no longer receives security updates cannot be patched at all.

“It still works” is not the same as “it is supported”. Ageing software is a common finding in SMB reviews, and it is usually cheaper to replace than to recover from.

3. Accounts and multi-factor authentication

Most breaches involving SMBs start with a stolen password. Multi-factor authentication (MFA) is the single most effective control for email, remote access and admin accounts.

• Is MFA enabled on email, accounting software, remote access and any admin console?
• Are shared logins still in use? Shared accounts make it impossible to know who did what.
• Are former employees fully disabled, including email forwarding and VPN access?
• Do you have a list of who has admin rights — and does it really need to be that many people?

If MFA is not on email yet, treat that as urgent rather than quarterly. It is one of the highest-value changes you can make this week.

4. Storage and disk space

Full disks cause strange, hard-to-diagnose failures: databases stop writing, email queues back up, backups fail silently. It takes two minutes to check and saves hours later.

• How much free space is left on servers and shared storage?
• Is anyone using personal cloud drives as the company filing system?
• Are old project files, exports and duplicates accumulating with no retention rule?
• Is storage growth roughly in line with headcount, or is something unexpected filling it?

A simple retention policy — how long to keep quotes, invoices, projects and backups — removes a surprising amount of clutter and risk.

5. Network and Wi-Fi

You do not need a full network audit every quarter, but you should know whether the basics are still true.

• Is the guest Wi-Fi separated from the staff network and file servers?
• Has the Wi-Fi password changed since a contractor or departed employee had access?
• Are there known dead spots, or complaints that repeat in the same rooms?
• Is the firewall still supported, and has its firmware been updated this year?
• Do you know which devices are connected? Unknown devices are worth investigating.

If calls drop when people walk between rooms, that is a coverage or roaming problem — not something staff should have to work around.

6. Endpoint protection

Every laptop and desktop should have active, updating protection. The common failure is not the absence of antivirus; it is a subscription that lapsed quietly months ago.

• Is protection installed on every device, including machines used by management and finance?
• Are definitions and agents updating, or are there devices showing “out of date”?
• Are alerts going somewhere a human actually reads?
• Can you remotely isolate or wipe a lost laptop?

7. Licensing and renewals

Software audits are unpleasant, and vendors are becoming more systematic about them. A quarterly check keeps you ahead of it.

• Do you have proof of licence for Microsoft 365, accounting software and any industry-specific tools?
• Are any subscriptions renewing automatically at a higher tier than you need?
• Are there unused licences you are still paying for?
• Is anything running on a consumer licence in a business context?

Keep licence records in one place, with renewal dates and the person responsible. This is also useful when a vendor or insurer asks for evidence.

8. Devices and warranty

Hardware failures are inevitable. What you can control is how disruptive they are.

• Which devices are out of warranty, and which are nearing end of life?
• Are batteries swelling or failing on laptops that travel?
• Is there a spare machine that can be issued quickly if a key employee's laptop dies?
• Are UPS batteries in the comms room still healthy? A UPS that fails silently is just a heavy power strip.

An asset register does not need to be elaborate. A spreadsheet with device, user, purchase date, warranty end and serial number is enough to make planning possible.

9. Joiners, movers and leavers

Access tends to accumulate. People change roles, share folders “temporarily”, and leave with accounts still active. A quarterly review keeps the list honest.

• Do you have an up-to-date list of staff and the systems they should access?
• When someone left in the last quarter, were all their accounts disabled on the same day?
• Are finance folders restricted to finance staff, or open to everyone because that was easier?
• Do contractors have expiry dates on their access?

10. Documentation and contacts

If the person who “knows the IT stuff” is unavailable, can someone else keep the business running? Documentation is the difference between a minor disruption and a crisis.

• Is there a written list of critical systems, vendors and account owners?
• Are admin credentials stored securely — not in a notebook or a shared spreadsheet?
• Is there a one-page incident plan: who to call, in what order, and what to do first?
• Does your IT provider have current contact details and escalation instructions?

What to do with the results

Do not try to fix all ten areas at once. Sort the findings into three buckets:

1. Urgent: anything that could cause data loss, a security breach or a full-day outage. Fix this month.
2. Important: things that create recurring friction or increase risk over time. Schedule this quarter.
3. Housekeeping: tidy-ups and documentation. Handle when convenient, or bundle into a project.

The most common pattern we see is that backups and MFA are urgent, patching and licensing are important, and documentation is perpetually deferred. Deferring documentation is understandable — but it makes every future problem slower and more expensive to solve.

Good IT management for an SMB is not about buying more technology. It is about knowing what you have, whether it is working, and who is responsible when it is not.