The 30-Minute Monthly IT Check for Small Businesses
Backups fail quietly, updates stall, and former employees keep their accounts. Six things to check once a month, while the problems are still cheap to fix.
Most owners only look at their IT when something has already gone wrong: a file won’t open, a laptop won’t start, an invoice got paid to the wrong account. Fixing things at that point always costs more than catching them early would have.
And almost none of it happens without warning. The backup that fails when you finally need it had been failing for weeks. The account a scammer used belonged to someone who left last year. Thirty minutes a month is usually enough to catch this category of problem.
The urgency behind the patching item, specifically, is well documented: Verizon’s 2026 Data Breach Investigations Report found 31% of breaches began with attackers exploiting unpatched software (now the most common way in, ahead of stolen passwords), while the median time to fully fix a known vulnerability has stretched to 43 days. Most attacks use a hole that was already known, with a fix already available that nobody had installed.
The six checks
1. Updates. Are Windows updates actually installing, or sitting at “restart required” week after week? Same question for phones, browsers, and your accounting software. A team that habitually clicks “remind me later” is a fixable problem.
2. Backups. Open the backup tool and read the last few runs. You want recent successes, not a list of errors. Then ask the harder question: when did anyone last restore a file? An untested backup is a hope, not a plan.
3. Who has access. Read the user list in Microsoft 365 or Google Workspace. Every name should be someone who still works for you. Departed employees, long-finished contractors, and shared “office” or “admin” logins all need to go.
4. MFA coverage. Not “do we have MFA” but “is it on for everyone”, especially admin accounts and anyone who touches money. Microsoft’s research puts MFA at blocking over 99.2% of account-compromise attacks; a single uncovered account undercuts all of it.
5. Devices. Anything connected that you don’t recognize? While you’re looking: laptops encrypted, phones with company email locked with a passcode.
6. Subscriptions and licenses. Read your billing page. Licenses for people who left, two tools doing the same job, and software someone signed up for without telling anyone. This check funds itself more often than any other.
Making it stick
Put it on the calendar (first Monday of the month works) and give it to the same person every time. Keep a running note of what you found; after a few months, patterns emerge, and a problem that keeps coming back needs a real fix, not another monthly reset.
One discipline: don’t stop to fix things mid-check, or thirty minutes becomes three hours. List what you find, then work the list afterward.
What you fix yourself: the small stuff: a laptop needing a restart, a license to cancel, an account to disable.
What goes to your IT provider: backups that keep failing, MFA that won’t enable for someone, an unrecognized device, updates that fail on the same machine every month. Repeat offenders usually mean something bigger is wrong underneath.
What this check is not
It isn’t monitoring. A managed IT provider has tooling watching your systems continuously, catching things no monthly glance would find. This check covers the part that tooling can’t know: who left last month, which subscriptions you actually approved, whose laptop that is. The two work together, and if you’re doing the monthly check but nobody’s doing the continuous half, that’s the gap managed IT fills.
Want a version of this checklist tailored to your environment, with the first walkthrough done together so you know exactly where everything lives? Ask us. It’s a genuinely useful hour, whether or not we ever work together beyond it.