A small business IT checklist

Record the domain registrar, email service, hosting and core subscriptions. Check who administers each one and how the business recovers access. A contractor can manage a service while ownership remains with the business.

Use individual accounts where practical and multi factor authentication where supported. Check former staff, contractors and shared administrator access. Document how access is granted and removed.

Identify the devices used for work and whether their software is supported. Review updates, local files and required apps. An unmanaged personal device may need a different access arrangement from a business controlled laptop.

Name the data that needs recovery and the service protecting it. Verify the restore process with an agreed test. Record the result and keep instructions available if the usual system fails.

Submit a safe test through the website form and check where it arrives. Review the published services, contact details and hosting ownership. A polished page does little for enquiries if the form sends to an unattended inbox.

Prioritise a known access or recovery gap over buying another tool without a job. Use the IT health check to record what is known and what needs review. Ask for a scoped job if you want help with the result.

Use a small register with the service or device, its owner, the evidence you checked and the next action. A domain entry might name the registrar, the business account controlling it and the date recovery access was verified. Keep passwords and recovery secrets in an appropriate protected store, rather than in an ordinary checklist.

If you cannot verify a statement, mark it unknown. Guessing that a supplier has it covered hides the question. The owner can then confirm the arrangement or ask for a scoped investigation.

List the accounts, devices and shared records the person used. Agree on the handover of required information and the point at which their access is removed. Include services outside the main email platform, such as the website CMS, accounting app and domain registrar.

Check contractor access as well as staff accounts. A completed departure needs evidence that the required records are available to the business and that unnecessary access has been removed. Deleting an account before reviewing its records can create a separate recovery problem.

Start with work that affects essential access or recovery. If nobody can recover the business inbox, establish that route before changing suppliers. If an important folder has no known recoverable copy, clarify the protection and restore process before retiring its device.

ASD's small business guidance covers practical security measures including multi factor authentication, software updates and backups. Use that guidance alongside your environment and obligations. The checklist helps you organise questions, while an assessment or repair needs its own scope.