A monthly IT checklist for small business needs about half an hour and no technical background. Once a month, look at six things: updates, backups, user accounts, two-step login, connected devices and what you pay for. It's how you catch slow-building problems, like a backup that quietly stopped, before they turn into an expensive bad day.
For most business owners, IT only gets attention after something goes wrong. Someone can't open a file. A laptop dies the morning of a big proposal. A vendor "updates their bank details" and an invoice goes to a criminal. Cleaning up after the fact is always the pricier option.
The frustrating part is that these problems nearly always give off early signs. A backup that fails when you need it has typically been failing for weeks. The login a scammer abused often belonged to an employee who left a year earlier. A short, regular look is usually enough to spot the warning signs in time.
Why bother every month?
According to Verizon's 2026 Data Breach Investigations Report, 31% of breaches started with criminals taking advantage of software that was missing a security fix. Unpatched software beat stolen passwords as the number one way in. The same research puts the typical wait to fully fix a known weakness at 43 days.
Put simply, the fix usually existed. It just hadn't been installed.
Your six-point monthly checklist
1. Are updates finishing?
See whether your Windows computers are completing their updates or have been nagging "restart required" for weeks. Do the same with phones and the programs your team leans on, such as the web browser and your accounting software. If staff habitually snooze update prompts, fix that habit.
2. Are backups working?
Open the backup software and scan its recent history. You're looking for a run of successes, not a list of errors. Then find out when someone last pulled a file back out of it. Until you've tried a restore, you're only hoping it works.
3. Does everyone on the user list still work here?
In Microsoft 365 or Google Workspace, open the list of accounts and go through it name by name. Look for former employees, contractors whose project ended long ago, and catch-all logins such as "frontdesk" or "admin" that get passed around. Disable whatever isn't needed.
4. Is two-step login on for everyone?
Two-step login (also called multi-factor authentication) should cover every account, not only the handful of people who switched it on early. Admins and anyone who moves money matter most. Microsoft says it stops more than 99.2% of attempts to break into accounts.
5. Do you recognize every device?
Review the laptops and phones linked to your company accounts. Track down the owner of anything unfamiliar. Also confirm that laptops have encryption turned on and that phones receiving work email are locked with a passcode, fingerprint or face.
6. What are you paying for?
Read through your software bills. Businesses often keep paying for seats that belonged to former staff, or for two products doing the same job. This is also where surprise sign-ups, tools someone started using without asking, tend to surface.
Turning it into a routine
Pick a fixed date, say the first Monday of each month, and have one person own it every time. Usually that's the owner or the office manager.
Jot down what you looked at and anything odd. Over a few months you'll notice repeats. A problem that shows up every single month deserves a permanent fix, not another round of cleanup.
To keep it to 30 minutes, resist fixing things mid-check. Note them, finish the list, then come back.
Handle it yourself, or call your IT provider?
Quick wins are yours: restart the laptop, cancel the unused license, switch off the old account.
Bigger warning signs go to your IT provider. Think backups that fail again and again, an account where two-step login refuses to turn on, a mystery device, or one computer whose updates fail every month. Those tend to be symptoms of something deeper.
What it won't do
A monthly checklist is not the same as monitoring. A solid managed IT provider uses software that watches your systems day and night and raises alerts you'd never catch on your own.
Your checklist fills a different gap: things only you know, such as who quit, which tools you signed off on, and which laptop belongs to whom.
Frequently asked questions
How often should a small business review its IT?
Monthly works for this list. If losing a single day of work would hurt badly, peek at backups more often, because they're the thing most likely to break silently.
Who should be in charge of it?
The owner or the person who runs the office. Very little of it is technical. It mostly takes someone who knows the staff and the bills.
I have no idea where any of this lives. Now what?
Have your IT provider show you once, and write down where to find each item. Many providers can also send a monthly report that answers most of these questions for you.
Shouldn't my IT provider be doing this?
They take care of monitoring, patching and repairs. This list covers the business knowledge they don't have, like last month's departures or a subscription nobody signed off on.
I only have ten minutes. Where do I start?
Backups first, then updates. Without a working backup, everything you store is at risk, and missing security fixes are now the leading way criminals get in.
We're fully in the cloud. Does this still matter?
It does. Cloud services still rely on up-to-date devices, reliable backups, two-step login and a user list that matches your actual team.
Sources and further reading
- Verizon 2026 Data Breach Investigations Report: 31% of breaches begin with unpatched software, and a known problem takes a typical 43 days to fully fix.
- Microsoft: Plan for mandatory Microsoft Entra multifactor authentication: the research behind the 99.2% figure.
Would rather not do this alone? Flux Labs can walk your team through where everything lives and handle the fixes, for businesses around Panama City and Bay County. Get in touch.
—
