Monthly IT Checklist: Catch Problems Early and Save Money

Most business owners only look at their IT when something's already gone wrong. A file won't open. A laptop won't start. An invoice gets paid into a scammer's account instead of the vendor's.

Here's the thing: almost none of that happens without warning. The backup that failed when you needed it had been failing quietly for weeks. The account a scammer used to get in belonged to someone who left the company last year. By the time you notice, the problem has already been sitting there — getting more expensive to fix every day.

Thirty minutes a month is usually enough to catch it first.

Why a Monthly Look Is Worth the Time

The numbers make a pretty strong case for building this into your routine:

• 31% of data breaches now start with attackers exploiting software that was never patched — ahead of stolen passwords as the most common way in (Verizon, 2026 Data Breach Investigations Report).
• The median time to fully fix a known vulnerability has risen to 43 days.
• MFA blocks more than 99.2% of account compromise attacks, according to Microsoft's own research — but only if it's actually turned on for everyone.

Put those together and the pattern is clear: most attacks aren't clever. They're walking through a door that was already known to be unlocked, because nobody had gotten around to closing it.

The Checklist: 6 Things to Look at Once a Month

Print this section, save it, or copy it into your notes app — this is the part you'll actually use.

☐ 1. Updates

Check whether Windows updates are actually installing on your computers, or quietly sitting at "restart required" week after week. Do the same for phones and for the software you use most — your browser, your accounting app. If people keep clicking "remind me later," that's the thing to fix.

☐ 2. Backups

Open your backup tool and look at the last few runs. You want recent, successful backups — not a list of errors you've learned to scroll past. Then check when anyone last actually restored a file from it. A backup that's never been tested is a guess, not a safety net.

☐ 3. Who Has Access

Pull up the list of user accounts in Microsoft 365 or Google Workspace and read through it, name by name. Everyone on it should still work for you. Watch for people who've left, contractors who wrapped up months ago, and shared logins like "office" or "admin" that half the team knows the password to. Switch off anything you don't need.

☐ 4. Multi-Factor Authentication

Confirm MFA is switched on — and that it's on for everyone, not just the first few people who set it up. Pay the closest attention to admin accounts and anyone who handles money. This single setting blocks the overwhelming majority of account takeover attempts.

☐ 5. Devices

Look at what's actually connected to your systems. A laptop or phone you don't recognize is worth chasing down immediately. While you're at it, confirm laptops are encrypted and that any phone with company email on it has a passcode or fingerprint lock.

☐ 6. Subscriptions and Licenses

Open your billing page and read what you're actually paying for. It's common to be paying for licenses that belong to someone who left, or for two different tools that do the same job. It's also usually how you discover software someone signed up for without telling anyone.

Make It a Routine, Not a One-Off

A checklist you run once doesn't help you six months from now. A few things make it stick:

• Put it on the calendar — the first Monday of the month works well — and assign it to the same person every time.
• Keep a running note of what you checked and what you found. After a few months, patterns show up: if the same problem keeps coming back, it needs a real fix, not another quick clear.
• Don't stop to fix things mid-check. Write down what you find, finish the list, then deal with it after. Otherwise thirty minutes turns into an afternoon.

Who Fixes What

Most of what turns up is small enough to handle yourself:

You can usually handle:

• Restarting a laptop stuck on an update
• Cancelling a license nobody's using
• Switching off an old account

Send this to your IT provider:

• Backups that keep failing
• MFA that won't turn on for someone
• A device on your network nobody recognizes
• Updates that fail on the same machine, month after month

If something keeps showing up on your list two or three months running, that's usually a sign there's a bigger issue underneath it.

What This Check Doesn't Replace

This isn't monitoring, and it isn't meant to be. A good IT provider has tools watching your systems all day, flagging things you'd never catch from a monthly glance. This check covers what those tools can't know — who left last month, which subscriptions you actually approved, whose laptop is whose. It's the layer that depends on knowing your business, not your network.

Frequently Asked Questions

How often should a small business check its IT? Once a month covers this list well. Backups are worth a quicker look more often if losing a day's work would genuinely hurt — that's the item most likely to fail quietly.

Who should actually do this? You, or whoever handles the admin side of the business. Almost none of it requires technical skill — just someone who knows who works there and what the business pays for.

What if I don't know where to find any of this? Ask your IT provider to walk you through it once and write down where each item lives. Many will also send a monthly summary covering most of it for you.

Isn't this my IT provider's job? They handle the monitoring, the patching, and the fixing. This check is the part that depends on knowing your business — who left last month, which subscription nobody approved — not your infrastructure.

If I only have ten minutes, what matters most? Backups and updates. Without a working backup, you can lose everything you've stored. And unpatched software is now the single most common way attackers get in.

Does this still apply if everything we use is in the cloud? Yes. Cloud tools still need updated devices, working backups, MFA switched on, and access lists that actually match who works for you today.

Want Us to Run the First One With You?

If you're not sure where half of this even lives — backups, licenses, admin accounts — that's a normal starting point, not a bad sign. Attitude IT can walk through your first monthly check with you, show you exactly where everything is, and set you up with a monthly summary so the list stays this easy going forward.

Talk to Attitude IT →