The IT health check

Most businesses find out about an IT problem the week it costs them something. The health check is a structured look at the things that quietly decide whether that week arrives — done with you, in plain language, with a written result you keep whether or not we ever work together.

1 · Backups and recovery

• Is every system that matters backed up — servers, Microsoft 365 mail and files, the line-of-business app?
• When was a restore last tested, not just scheduled?
• Is at least one copy offline or immutable, where ransomware can't reach it?
• How long would it take to be working again after a total loss — and does anyone know that number?

2 · Identity and access

• Multi-factor authentication on every account that can read email or reach data — no exceptions for owners.
• Who still has access that shouldn't — former staff, old contractors, shared logins?
• Are admin rights limited to the people who administer, and separate from daily-use accounts?
• Is there a password manager, or a spreadsheet, or a drawer?
• Does anyone but the owner know how to get into everything?

3 · Computers and devices

• Are operating systems and applications current, and is patching automatic or someone's memory?
• Is endpoint protection installed, managed centrally, and actually reporting?
• Are laptops encrypted, so a lost bag is an inconvenience rather than a breach?
• Which machines are past their support life (Windows 10 ended October 2025)?
• Can a lost or stolen device be located and wiped?

4 · Email and Microsoft 365

• SPF, DKIM and DMARC on your domain — whether your mail is provably yours, and whether others can send as you.
• Phishing and malware filtering: what's configured, what's default, what's off.
• Mailbox forwarding rules and app consents that nobody set up on purpose (a common sign of compromise).
• Licences: what you pay for, what's assigned, what's unused.
• Retention and legal hold, if your industry needs it.

5 · Network and internet

• Firewall age, firmware and whether anyone reviews what it allows in.
• Wi-Fi: is guest traffic separated from the business network? Is the admin password the one it shipped with?
• Remote access: VPN or exposed remote desktop? (The second is how most small businesses get hit.)
• Internet resilience — what happens to phones and card payments when the line drops?

6 · Servers, cloud and applications

• What's still on-premises, how old it is, and what depends on it.
• Who supports the line-of-business application, and is that arrangement still alive?
• Cloud services in use that the business doesn't know it's paying for.
• Single points of failure: the one PC, the one person, the one USB drive.

7 · Your website and domain

• Certificate valid and renewing; site loads over HTTPS without warnings.
• Renders properly on a phone; contact details correct; forms actually deliver.
• Domain registration and DNS: who controls them, when they expire, whether auto-renew is on.
• Outdated components with known vulnerabilities (we see ten-year-old libraries on local sites every week).

8 · People and documentation

• Is there a current list of systems, accounts, vendors and renewal dates?
• Has anyone shown staff what a phishing email looks like this year?
• Onboarding and offboarding: what happens to accounts on someone's first and last day?
• Who do people call when something breaks, and how long does it take?

9 · Cyber-insurance readiness

• The controls insurers now ask for at renewal: MFA, tested backups, endpoint detection, email filtering, patching.
• Whether your current policy's answers still match reality.
• What an attestation would need to say, and whether you could sign it today.

What happens next

Tell us a little about the business and we'll schedule the check, or pick a twenty-minute slot and we'll start there. Either way you'll have the written result inside two working days.