Printable resource · IT planning
Small-Business IT Assessment Checklist
Agree on the scope, then record what each area shows: the evidence, its status, who owns it, and the next action.
Use your browser’s print dialog to print it or save it as a PDF. No signup, and nothing is collected or sent.
How to use this checklist
Work through it with the people who run and use your systems. For each area, write down what was checked, then mark one status:
- Verified
- Evidence shows it is in place and working.
- Needs attention
- Evidence shows a gap or a problem.
- Unknown
- Nobody could show evidence either way yet.
“We probably have that” belongs under Unknown. For the reasoning behind each area, read What does a small-business IT assessment include?
Before the assessment
Documentation
Gather what already exists: device and software lists, account and administrator lists, vendor and subscription details, backup records, and notes on recent problems.
Space to writeAccess approval
Name who approves access to each system and how that approval is recorded. Keep credentials in an approved secure store, never in this checklist.
Space to writeParticipants
Invite a decision-maker, whoever administers the systems, and one or two people who use them every day.
Space to writeBusiness-critical systems
List the systems that would stop work if they failed tomorrow.
Space to writeLocations
List every location in scope, which ones need a visit, and any equipment kept off-site.
Space to writeSeparately authorized testing
Restore tests, vulnerability scans, and other intrusive checks are not automatic. Agree on each one in writing before it happens.
Space to write
Assessment areas
01Devices and software
- What is in use, and who owns it?
- Which devices and programs are still supported by their makers?
- Which subscriptions overlap or go unused?
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
02Accounts and access
- Who has access, and who has administrative rights?
- How is multifactor authentication applied?
- How is access removed when someone leaves?
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
03Network
- What connects the business, and who manages it?
- Are guest and personal devices kept separate from business systems?
- What happens during an internet or equipment outage?
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
04Backups and recovery
- What is protected, and where do the copies go?
- Who notices and follows up on failed backups?
- What evidence shows that important data can be recovered? (Reviewing records is not a restore test.)
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
05Security
- Which protections, update processes, and encryption are in place, and can they be verified?
- Who responds to alerts and suspected incidents?
- Which security responsibilities are written down?
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
06Workflows
- Where do people retype the same information?
- Where do they wait on access, approvals, or another person?
- Which tasks depend on one person’s knowledge?
- Evidence
- Space to write
- Status
- VerifiedNeeds attentionUnknown
- Owner
- Space to write
- Next action
- Space to write
07Prioritized recommendations
- What was observed, and what remains unknown?
- Why does each finding matter to the business?
- Who owns the response, and what should happen next?
- Finding, priority 1
- Space to write
- Owner
- Space to write
- Next action
- Space to write
- Finding, priority 2
- Space to write
- Owner
- Space to write
- Next action
- Space to write
- Finding, priority 3
- Space to write
- Owner
- Space to write
- Next action
- Space to write