Run your own IT assessment in an afternoon

The short answer

An IT assessment checks whether your technology is documented, secure, backed up, supported and worth what you pay for it. A useful IT assessment checklist covers eight areas: inventory, accounts and access, security controls, backups and recovery, network, applications and integrations, support and vendors, and spending. For each item you record what you found and score it.

You can run the checklist below yourself in an afternoon with your IT person or provider. Score each item as controlled, needs attention, significant exposure or unknown. The unknowns matter as much as the problems, because you cannot protect what nobody can describe. The questions draw on the CIS Controls Implementation Group 1 safeguards and CISA’s Cyber Essentials, both written with smaller organizations in mind.

How to run it in an afternoon

Set aside three to four hours and get the right people in the room. You need the owner or office manager, whoever handles IT day to day, and someone from finance who can see invoices.

1. Gather documents first. Your last 12 months of technology invoices, the Microsoft 365 or Google Workspace user list, any IT contracts and your cyber insurance application.
2. Work through one area at a time. Answer each question with yes, no, partly or unknown. Do not debate fixes yet.
3. Ask for evidence. A screenshot of the MFA report or a backup log beats a confident answer.
4. Score as you go, using the four levels below.
5. Finish with a 20-minute review of the significant exposures and unknowns, and assign an owner to each.

A worked example (illustrative)

Here is a hypothetical example. Picture a 40-person accounting firm running this checklist before its insurance renewal. Inventory was controlled. MFA was on for staff email but not for two partner accounts and the bookkeeping admin login, so accounts scored needs attention. Backups ran nightly, but nobody could remember a restore test, so recovery scored unknown. Spending showed nine paid licenses for people who had left.

The resulting plan fit on one page: enforce MFA on the remaining accounts this week, run and time a restore test this month, remove the unused licenses at renewal, and write a one-page recovery plan before the insurance questionnaire was due.

1. Inventory

• Is there a current list of every computer, phone, server, firewall and printer, with owner and age?
• Is there a list of every software subscription, who pays for it and when it renews?
• Do you know which devices are past their manufacturer’s support date?
• Are personal devices used for work, and is that written down?

CIS lists hardware and software inventory as its first two controls because every other control depends on them.

2. Accounts and access

• Is multi-factor authentication required for every user on email and remote access?
• Are admin accounts separate from everyday accounts, and limited to a few people?
• When was the last review of who has access to what?
• Were the accounts of the last three people who left disabled the same day?
• Are shared passwords stored in a password manager rather than a spreadsheet?

Leaver handling is the most common gap we see in small offices. Our employee offboarding IT checklist covers it step by step.

3. Security controls

• Does every computer have endpoint protection that someone actually checks?
• Are Windows, macOS and key applications updated automatically, with a report to prove it?
• Are laptops encrypted?
• Is email filtered for phishing and malware, with SPF, DKIM and DMARC set up for your domain?
• Have staff had security awareness training in the last 12 months?
• Is there a written plan for what to do if someone clicks a bad link?

4. Backups and recovery

• What is backed up: servers, cloud email, shared files, line-of-business data?
• Is at least one copy stored offline or in a separate account that ransomware cannot reach?
• When was a restore last tested, and how long did it take?
• Does anyone get alerted when a backup fails?
• Is there a written recovery plan with contacts and priorities?

A backup that has never been restored is a hope, not a plan. See our backup and disaster recovery guide for how to test one.

Prefer to have someone else run the checklist? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

5. Network

• Is the firewall supported and updated, and does someone review its settings?
• Is guest Wi-Fi separated from the business network?
• Have default passwords on routers, cameras and printers been changed?
• Is remote access through a secure method rather than open remote desktop ports?
• Is there a second internet connection, or a plan if the main one fails?

6. Applications and integrations

• Which systems would stop the business if they went down for a day?
• Are key systems connected, or does staff retype data between them?
• Are there tools nobody uses, or several tools doing the same job?
• Who is the vendor contact and support route for each critical application?

Manual re-entry between a CRM, accounting system and website is often the easiest win. Connecting those systems usually removes the re-entry entirely.

7. Support and vendors

• How fast does IT reply, and how fast does work start? Is that written down?
• Who holds admin passwords and documentation, and would you get them if you changed providers?
• Are vendor contracts, renewal dates and cancellation terms in one place?
• Is there a single owner for IT decisions inside the business?

8. Spending

• What is total annual technology spend, including licenses, hardware, telecom and support?
• Are you paying for licenses assigned to former employees?
• Is hardware replacement budgeted, or does it arrive as an emergency?
• Were any emergency or after-hours fees paid in the last year, and why?

How to score your findings

Use one of four ratings for every item. Keep it simple; precision matters less than honesty.

Turning the score into a plan

1. Fix significant exposures first, starting with email account security, backups and leaver access, since these drive most small-business losses.
2. Resolve unknowns next. Often this is one phone call or one report.
3. Group needs-attention items into projects with an owner and a month.
4. Write down the controlled items as evidence for insurers, auditors and customers.
5. Repeat the assessment once a year or after a big change such as a new office or system.

JLB USA provides managed IT and cybersecurity for businesses with roughly 25 to 100 employees and can work alongside an existing IT person.

Keep reading

• How to reduce IT costs without making your business riskier
• Business continuity vs disaster recovery: what is the difference?
• Fractional CIO: what they do, what drives the cost and when you need one
• Outsourced IT vs in-house IT: which is right for your business?

Related services

• Free Technology Health Assessment
• Managed IT services
• Employee offboarding IT checklist