Most small companies don’t discover their IT gaps in a planning meeting. They discover them during a server failure at 11 p.m., a ransomware attack on a Monday morning, or a compliance audit that uncovers a year’s worth of unpatched vulnerabilities. The IT support checklist for small companies in this guide exists to find those gaps before they find you.
This isn’t a theoretical framework. It’s a working audit tool designed for founders, operations leads, and office managers who carry some or all of the responsibility for keeping their company’s technology running. You don’t need to be a technical expert to use it. You need to know what questions to ask, what to look for, and what the answers tell you about your current risk exposure.
We’ve structured this guide in two parts. The first part explains the reasoning behind each checklist category: why it matters, what can go wrong without it, and what good looks like. The second part is the checklist itself, formatted as a practical audit tool you can work through with your team or your IT provider. By the end, you’ll have a clear picture of where your IT infrastructure stands and a prioritized action list to address the most critical gaps.
Why Small Companies Need a Structured IT Audit Process
There’s a pattern that plays out repeatedly in small business IT: infrastructure is set up when the company is small, grows organically as the team expands, and accumulates technical debt through a thousand small decisions made under time pressure. An employee sets up a shared password. A cloud service is provisioned without security review. A software license expires and nobody notices. A backup job fails silently for three weeks.
Each of these is minor in isolation. Together, they create the conditions for a serious incident. A structured IT support checklist short-circuits that accumulation by forcing a regular, systematic review of the systems and controls that keep your business running. It transforms IT health from something you think about reactively into something you manage proactively.
The benefits of running a structured IT audit are concrete:
- Incident prevention: Most IT failures are preceded by warning signs that a routine audit would have caught. Hardware approaching end of life, storage filling up, certificates about to expire, backup jobs reporting errors.
- Cost control: Audits surface unused software licenses, over-provisioned cloud resources, and redundant services. Small companies routinely find 10 to 20 percent of their IT spend is wasteful once they look closely.
- Compliance readiness: Regulators and enterprise customers increasingly require documented evidence of security controls. A regular audit process produces that documentation as a byproduct.
- Scalability: Understanding exactly what you have makes it significantly easier to plan for growth. You can’t scale what you haven’t mapped.
If your company uses a managed IT service provider, this checklist also serves as a benchmark for evaluating their performance. Compare what your provider should be covering against what your audit reveals. Gaps between the two are a conversation worth having. For companies exploring their options, the benefits of outsourced IT become particularly clear when you see how much of this checklist requires ongoing management, not just a one-time setup.
How to Use This Checklist
Before diving into the audit, a few notes on approach:
- Schedule dedicated time: A thorough IT audit for a 10 to 25 person company takes two to four hours if you have access to the right systems. Don’t try to do it in the margins of a busy week.
- Involve the right people: You’ll need access to admin credentials for your cloud platforms, your network equipment, and your endpoint management tools. If a managed IT provider handles these systems, ask them to participate in or run the audit on your behalf.
- Document everything: The value of the audit isn’t just in fixing what you find today. It’s in having a baseline to compare against at the next review. Write down what you have, what version it’s on, and what the current status is.
- Prioritize ruthlessly: You will almost certainly find more gaps than you can address immediately. Triage by risk: security and backup failures first, compliance gaps second, performance and efficiency improvements third.
- Set a review cadence: Run a full IT audit quarterly and a lighter monthly check on the highest-risk items (backups, security tools, access controls). Annual-only reviews miss too much in a fast-moving threat environment.
| Audit Frequency RecommendationFull IT audit: quarterly. Backup and recovery verification: monthly. Security tool health check: monthly. Access control review (departed employees, excess privileges): monthly. Software license and asset inventory: semi-annually. Vendor and third-party access review: quarterly. |
The IT Support Checklist for Small Companies
The checklist is organized across eight functional domains. Work through each section systematically. The Status column is for your team to mark as Complete, In Progress, or Action Required.
| A. Hardware and Asset Inventory | Status | |
| A1 | Complete inventory of all company-owned devices (laptops, desktops, servers, mobile devices) with assigned user, purchase date, and warranty status. | [ ] |
| A2 | All devices running a supported operating system version with no end-of-life systems in active use. | [ ] |
| A3 | Hardware refresh plan in place for devices approaching end of life (typically 3 to 5 years for laptops, 5 to 7 years for servers). | [ ] |
| A4 | Asset tags or serial numbers recorded for all devices. Lost or stolen devices can be identified and remotely wiped. | [ ] |
| A5 | Inventory reviewed and updated when devices are purchased, retired, or reassigned. | [ ] |
| B. Software, Licensing, and Patch Management | Status | |
| B1 | Complete inventory of all software in use, including version numbers and license expiry dates. | [ ] |
| B2 | All operating systems and critical applications current on security patches. Critical patches applied within 72 hours of release. | [ ] |
| B3 | Automated patch management in place for endpoints and servers (via MDM, RMM tool, or managed IT provider). | [ ] |
| B4 | No unlicensed or unauthorized software installed on company devices. | [ ] |
| B5 | Software license audit completed. Unused licenses identified and cancelled to reduce unnecessary spend. | [ ] |
| B6 | End-of-life software (e.g., Windows 10 reaching end of support in October 2025) flagged and migration plan in place. | [ ] |
| C. User Access and Identity Management | Status | |
| C1 | Complete list of all active user accounts across every platform (email, cloud services, CRM, financial systems, code repositories). | [ ] |
| C2 | Offboarding process verified: departed employees have all accounts disabled within 24 hours of termination. | [ ] |
| C3 | Multi-factor authentication (MFA) enabled on all critical systems: email, VPN, cloud platforms, financial tools, remote desktop. | [ ] |
| C4 | Principle of least privilege applied: users have access only to systems and data required for their role. | [ ] |
| C5 | Shared or generic passwords eliminated. Every user has individual, unique credentials for all systems. | [ ] |
| C6 | Password manager deployed company-wide. Team is not storing passwords in spreadsheets, browsers, or notebooks. | [ ] |
| C7 | Privileged administrator accounts are separate from daily-use accounts. Admin access used only when required. | [ ] |
| C8 | Third-party vendor access reviewed. External contractors have only necessary access, with time-limited credentials where possible. | [ ] |
| D. Network Security and Infrastructure | Status | |
| D1 | Business-grade firewall in place and firmware current. Consumer-grade routers not used in production environments. | [ ] |
| D2 | Wi-Fi network using WPA3 or WPA2 encryption. Default router credentials changed. Guest network separate from business network. | [ ] |
| D3 | DNS filtering active (e.g., Cisco Umbrella or Cloudflare Gateway) to block malicious domains at the network level. | [ ] |
| D4 | VPN required for remote access to internal systems. Split tunneling policy reviewed and documented. | [ ] |
| D5 | Network segmentation in place: critical systems (finance, HR, servers) on separate network segments from general employee devices. | [ ] |
| D6 | Open ports and unnecessary services on internet-facing systems identified and closed. | [ ] |
| D7 | Network diagram current and accessible to IT team or provider. No undocumented devices on the network. | [ ] |
| E. Endpoint Security | Status | |
| E1 | Endpoint Detection and Response (EDR) solution deployed on all company devices, including employee-owned devices used for work. | [ ] |
| E2 | EDR management console actively monitored. Alerts reviewed at least weekly; critical alerts trigger immediate response. | [ ] |
| E3 | Full disk encryption enabled on all laptops and mobile devices (BitLocker for Windows, FileVault for Mac). | [ ] |
| E4 | Remote wipe capability configured for all mobile devices and laptops. Tested in the last 12 months. | [ ] |
| E5 | Mobile Device Management (MDM) in place for all mobile devices accessing company email, data, or applications. | [ ] |
| E6 | BYOD (Bring Your Own Device) policy documented and enforced, including minimum security requirements for personal devices. | [ ] |
| F. Backup and Disaster Recovery | Status | |
| F1 | Automated cloud backup running for all critical business data, including file servers, databases, and SaaS applications. | [ ] |
| F2 | Backup jobs monitored: failures generate alerts and are investigated promptly. Not just assumed to be working. | [ ] |
| F3 | 3-2-1 backup rule followed: three copies, two media types, one offsite (cloud) copy. | [ ] |
| F4 | Backups are immutable or air-gapped: ransomware cannot reach and encrypt backup data. | [ ] |
| F5 | Monthly file restore test completed and results documented. Specific files restored from backup to verify integrity. | [ ] |
| F6 | Quarterly full application restore test completed. At least one critical system restored from backup and verified. | [ ] |
| F7 | RPO and RTO defined, documented, and tested. Recovery time performance measured against RTO target. | [ ] |
| F8 | SaaS application data (Microsoft 365, Google Workspace, Salesforce, etc.) covered by dedicated backup solution. | [ ] |
| G. Security Awareness and Incident Response | Status | |
| G1 | Security awareness training delivered to all employees at least monthly (micro-training format, not annual compliance only). | [ ] |
| G2 | Phishing simulation program running. Click rates tracked over time as a measurable security metric. | [ ] |
| G3 | Written incident response plan documented, reviewed in the last 12 months, and stored in an offline or out-of-band location. | [ ] |
| G4 | Key incident response contacts documented: IT provider or MSP, legal counsel, cyber insurer, law enforcement (FBI IC3). | [ ] |
| G5 | Regulatory breach notification obligations understood and response timelines documented for applicable frameworks (GDPR, HIPAA, state laws). | [ ] |
| G6 | Tabletop exercise or incident simulation conducted in the last 12 months. | [ ] |
| G7 | Clear, blame-free process for employees to report suspicious activity. Team knows who to contact and how. | [ ] |
| H. Compliance and Documentation | Status | |
| H1 | Applicable regulatory frameworks identified (GDPR, HIPAA, SOC 2, PCI-DSS, CCPA) and compliance obligations documented. | [ ] |
| H2 | Data inventory completed: what personal or sensitive data is held, where it is stored, how long it is retained, and who has access. | [ ] |
| H3 | Data processing agreements in place with all third-party vendors who handle personal data on your behalf. | [ ] |
| H4 | Acceptable Use Policy (AUP) documented, distributed to all employees, and signed acknowledgment on file. | [ ] |
| H5 | IT and security policies reviewed in the last 12 months and updated to reflect current infrastructure and practices. | [ ] |
| H6 | Cyber insurance policy in place, reviewed in the last 12 months, and coverage limits understood by leadership. | [ ] |
| H7 | Vendor security assessments conducted for high-risk third-party integrations. Vendor SOC 2 reports or equivalent obtained. | [ ] |
Understanding Your Results: How to Prioritize What You Find
Working through the checklist will surface a mix of completed items, gaps, and things you simply don’t know yet. Here’s how to triage what you find and decide what to tackle first.
Tier 1: Address Immediately (Within 30 Days)
These are the gaps that create direct, near-term risk to your business operations or data security:
- Any endpoint without EDR protection.
- Any critical system without MFA enabled.
- Active user accounts for departed employees.
- Backup jobs that are failing, untested, or not covering critical data.
- Known unpatched vulnerabilities on internet-facing systems.
- No incident response plan or key contacts documented.
Tier 2: Address Within 90 Days
These are important controls that meaningfully reduce your risk profile but don’t represent immediate operational emergencies:
- Full disk encryption on all laptops and mobile devices.
- Network segmentation separating critical systems from general-use networks.
- Security awareness training program established for all employees.
- SaaS application data covered by dedicated backup solution.
- Third-party vendor access reviewed and minimized.
- Password manager deployed company-wide.
Tier 3: Incorporate Into Ongoing Operations
These are process disciplines rather than one-time fixes. Build them into your regular operating rhythm:
- Monthly backup restore tests and security tool health checks.
- Quarterly full IT audit using this checklist.
- Regular phishing simulation program with tracked metrics.
- Semi-annual software license audit and asset inventory review.
- Annual tabletop incident response exercise.
| When to Escalate to a Managed IT ProviderIf your Tier 1 list has more than three items, or if your team lacks the technical depth to address the gaps identified, that is a signal to engage a managed IT service provider. The operational cost of maintaining these controls in-house typically exceeds the cost of outsourcing them once you account for the staff time involved. Remote IT support for businesses can often address Tier 1 gaps faster and more reliably than an internal team working on these issues in parallel with their primary responsibilities. |
The New Employee IT Onboarding Checklist
A significant proportion of IT security incidents can be traced back to the period immediately after a new employee joins. Accounts are created hastily, access is over-provisioned for convenience, and security policies aren’t communicated clearly. A structured onboarding checklist closes this window. Include this as a standard part of your HR onboarding process:
- Device provisioning: Company device prepared with latest OS updates, EDR installed, full disk encryption enabled, and MDM enrolled before the employee’s first day.
- Account creation: Email, SSO, and role-specific application accounts created with individual credentials. No shared logins.
- MFA enrollment: New employee enrolled in MFA on all required platforms on day one, before receiving access to sensitive systems.
- Access provisioning: Role-based access assigned according to the principle of least privilege. Access rights reviewed against actual job responsibilities, not copied from a colleague’s profile.
- Security orientation: 30-minute security briefing covering phishing awareness, password policy, incident reporting process, and acceptable use policy. Signed acknowledgment on file.
- IT documentation access: New employee provided with IT helpdesk contact, escalation path, and links to relevant internal IT policies.
The Employee Offboarding IT Checklist
The mirror image of onboarding, and just as critical. Departing employees represent a significant access risk if offboarding is handled inconsistently. This checklist should trigger automatically when HR initiates the termination process:
- Immediate account suspension: On or before the employee’s last day, disable all accounts: email, SSO, cloud platforms, VPN, CRM, financial systems. Do not merely change passwords; disable the accounts.
- Access revocation audit: Review all systems the employee had access to and confirm revocation across each one. SSO reduces this complexity significantly; standalone application accounts require manual review.
- Device recovery: Retrieve all company-owned devices. If remote, use MDM to initiate remote wipe before the device is returned or retained by the departing employee.
- Credential rotation: Rotate any shared credentials the employee had access to, including service accounts, shared email inboxes, and infrastructure credentials.
- Data review: Review whether the employee transferred, downloaded, or copied sensitive data in the days before departure. Cloud storage audit logs and email activity reports are useful here.
- Documentation update: Remove the employee from all emergency contact lists, incident response plans, and IT documentation that referenced them by name or role.
How Managed IT Services Simplify Checklist Management
best managed IT services for startups
Reading through this checklist, it becomes clear why IT management is a full-time discipline rather than a part-time administrative task. The best managed IT services for startups don’t just fix things when they break. They own the ongoing management of most items on this checklist as part of their standard service delivery.
A quality managed IT provider typically covers:
- Continuous endpoint monitoring and EDR management (Category E).
- Automated patch management and software updates (Category B).
- Backup monitoring, restore testing, and disaster recovery management (Category F).
- Network security monitoring and firewall management (Category D).
- Security awareness training program delivery (Category G).
- Incident response support and coordination (Category G).
- Compliance documentation and reporting support (Category H).
What they typically don’t replace is the governance layer: defining your access control policies, making decisions about which compliance frameworks apply, conducting vendor security assessments, and ensuring your cyber insurance coverage is appropriate. Those decisions require business judgment that sits with your leadership team, regardless of who handles the technical execution.
Understanding managed IT services pricing helps you evaluate whether bundling these services with a provider makes more financial sense than managing them piecemeal in-house. For most companies with fewer than 50 employees, the bundled model wins on both cost and quality.
Remote and Hybrid Work: Additional Checklist Considerations
remote IT support for businesses
If your team works remotely or in a hybrid model, several areas of this IT support checklist require additional attention. Remote work expands your attack surface considerably: devices leave the protection of your office network, employees connect from home routers with varying security configurations, and the boundary between personal and work technology blurs.
Supplement the core checklist with these remote-specific controls:
- VPN policy: All remote access to internal systems routed through a business-grade VPN. Personal VPN services do not substitute for this.
- Home network security guidance: Employees provided with written guidance on securing their home router: changing default credentials, enabling WPA2 or WPA3, and keeping firmware current.
- Screen lock policy: Devices auto-lock after a maximum of five minutes of inactivity. Required when working in public spaces.
- Public Wi-Fi policy: Team understands that public Wi-Fi use requires VPN. Zero-trust access controls reduce the risk of unprotected connections.
- Remote support capability: IT team or provider has the tools to deliver remote IT support for businesses, including remote desktop access for diagnostics and secure software deployment to distributed devices.
The Bottom Line
An IT support checklist for small companies is only as useful as the discipline behind it. The businesses that avoid serious IT incidents aren’t the ones with the most sophisticated technology; they’re the ones that consistently execute the fundamentals: keeping systems patched and monitored, protecting access with MFA, maintaining tested backups, and reviewing their infrastructure regularly against a documented standard.
Use this checklist as your audit tool. Work through it with your team or your IT provider, triage what you find by risk tier, and build the review cadence into your regular operating rhythm. The gaps you find today are far less expensive to close than the incidents they would otherwise cause.
And if the volume of Tier 1 findings tells you that your current IT setup needs more support than your team can provide, that’s valuable information too. It’s precisely the kind of clarity this checklist is designed to surface.
Want expert help working through your IT audit? Contact us today for a complimentary IT health assessment and a personalized roadmap for your small company’s infrastructure.