An annual IT review is a chance to check whether your technology arrangements still match the business you run today. You may have hired people, changed suppliers, added software, or started storing information in a new place since the last conversation with your provider.
The aim is a short list of verified answers and practical next actions. You do not need to solve every issue in the meeting or become a security specialist first.
Start with a small review meeting
Invite the owner or decision maker, the person who coordinates office technology, and your IT provider. Include managers who can explain changes in how the team works. Ask for a current account and device list, a summary of backup arrangements, and outstanding support or security actions before the meeting.
If those records do not exist, make gathering them your first action. An honest unknown is more useful than a confident assumption.
1. Confirm what the business depends on
List the systems needed for the most important daily tasks: email, scheduling, sales, accounting, customer records, and shared files. Identify who manages each service and how support is reached.
Ask what would happen if a key system stopped working tomorrow. Which task would be affected first? Is there an agreed temporary process? Does the person responsible know the business priority?
Include systems outside your provider’s usual scope. A subscription purchased by a team manager can still hold important customer information.
2. Review people and access
Compare current staff and regular contractors with active business accounts. Check that people who left no longer have access and that role changes have been reflected in permissions. Ask specifically about administrator accounts and shared credentials.
Have managers confirm what access is needed; have your provider confirm how changes are implemented. Keep evidence of the review without exporting passwords or unnecessary personal information into a shared spreadsheet.
If departures are difficult to track, improve the employee offboarding process. If new starters receive inconsistent access, use the onboarding checklist.
3. Check account protection and recovery
Ask your provider to show which important services require MFA and whether any accounts are exempt. Review lost-device recovery and who can help when a key administrator cannot sign in.
Do not treat a list of enrolled users as proof that every required account is protected. Ask for confirmation of the actual settings, exceptions, and responsibility for monitoring changes.
Our MFA guide explains a manageable way to discuss rollout and recovery with staff. Record gaps as actions rather than changing important settings during an unplanned meeting.
4. Check devices and software support
Review work laptops, desktops, phones, and any personal devices allowed to access business information. Confirm who maintains them and whether their operating systems and important applications remain supported.
Ask how updates, device protection, encryption, and lost-device reporting are managed. If the provider only maintains some devices, identify who looks after the rest.
Include upcoming replacement decisions in the budget. A device that still turns on may need attention if its software no longer receives security updates. Ask your provider to confirm vendor support dates rather than relying on age alone.
5. Verify backups with a recent recovery example
Ask what is backed up, what is excluded, and when someone last tested recovering important information. Find out what the test actually demonstrated: a single file, a full system, or another recovery task.
Discuss how long recovery could take and whether that matches business needs. A successful file restore is useful evidence, but it does not automatically show that every business service can be restored within the same time.
Record the next test, the responsible person, and how the result will be checked. The backup-check guide provides questions to send your provider.
6. Review suppliers and information handling
List vendors with access to your systems or important data. Confirm their business purpose, account owner, support route, and any contract renewal dates. Ask whether unused integrations or supplier accounts can be removed through an approved process.
Review where customer, staff, and financial information is stored. Ask whether people are using approved locations and whether access reflects current responsibilities. Refer retention and privacy questions to a qualified adviser when the requirements are unclear.
A review is also a good moment to capture customer security commitments. If you answered a security questionnaire, check that the promises still match what the business does.
7. Refresh contacts, policies, and response plans
Check the incident lead, backup contact, urgent IT support details, and insurer reporting route. Make sure essential contacts remain available if company email is unavailable.
Ask whether staff know how to report a concern and whether anyone has practiced the response conversation recently. Use our incident response planning guide for a short scenario.
Review policies against actual working arrangements. Update documents when the business changes rather than simply changing the date at the top. Confirm who approves the revision and how affected staff will hear about it.
Turn the review into three useful actions
End with a short action list. For each item, record the issue, the next step, the person responsible, a target date, and what will count as completion. Agree which items need urgent attention with your provider.
For example: the office manager confirms the leaver list; the provider checks affected accounts; the owner reviews the results. Another action might be arranging a restore test, with a named business person checking that the recovered files are usable.
Schedule a follow-up rather than waiting another year. Some checks need to happen more often, and significant staffing, supplier, or system changes should trigger a review sooner. An annual meeting is a useful baseline, not a promise that everything can wait twelve months.
For broader guidance, see the NIST Small Business Cybersecurity Corner. This checklist supports a business conversation; it does not certify security or establish compliance with a particular standard.