IT infrastructure maintenance: a checklist for small and mid-sized companies

IT only gets noticed when it breaks. This list helps make sure it does not. Use it yourself, or to check whether your IT partner does everything it should.

Every day

• backup completed successfully (automatic notification),
• server and network monitoring with no alerts,
• failed logins and suspicious activity reviewed.

Every week

• security patches installed on computers and servers,
• antivirus and EDR up to date on all devices,
• free space on servers and NAS,
• open tickets and recurring problems.

Every month

• test restore from backup,
• user account review: former employees' accounts disabled,
• license review (Microsoft 365, antivirus, software),
• firmware updates on routers, firewall and WiFi,
• a monthly system health report.

Every quarter

• access rights review on shared folders,
• MFA check on all accounts,
• a phishing simulation or short employee training.

Every year

• a full disaster recovery test,
• a hardware replacement plan (computers older than 5 years, servers out of support),
• a security and documentation review,
• a check that IT keeps up with company growth.

The 3-2-1 backup rule

Three copies of data, on two different types of media, one of them off-site and isolated from the network. It is the most important protection against ransomware.

Documentation

Hardware inventory, network diagram, passwords in a password manager, vendor contacts and procedures. Without it, the company depends on one person.

If you want someone else to own this list, see IT infrastructure maintenance or request a free IT review. Create strong passwords with our password generator.