How to use this checklist

Ask the people responsible for IT and business operations to review it together. Select Confirmed only when there is recent evidence. Choose I do not know when a setting, report or result has not been checked. Use Not applicable only when the item truly does not apply to your environment.

Marking an answer takes little time; gathering evidence or running an authorised restore test can take longer. High-priority items affect access, data or continuity and should be reviewed first when they are unresolved or unknown.

A starting point for a review. The answers are your own assessment. This list does not certify security or replace a technical inspection. Do not enter passwords, recovery keys or confidential data. Answers and notes stay in the current page and are cleared when it is reloaded.

Jump to a section
Download the PDF checklist ->

Accounts and access

Start with people and access: who can sign in, who owns each account and who approves changes.

01. Important accounts have MFA enabledHigh priority

Check business email, administrator accounts and remote access. Confirm the settings and registered methods rather than assuming MFA is enabled.

Next step: Plan MFA rollout with IT support, a small pilot group and an account recovery procedure.

02. Each employee has an individual business accountRoutine check

Compare employee and active account lists. Check whether people share a password for email or a business application.

Next step: Separate user accounts and grant access to shared resources through approved groups or delegation.

03. Former employees' access has been reviewed and revokedHigh priority

Review email, VPN, cloud applications, shared folders and active sessions. Record who approved business data handover.

Next step: Have an authorised administrator block unneeded access and preserve data according to company decisions before deleting accounts.

04. Administrator access is separate from everyday workRoutine check

Check who has administrator rights on computers and business systems, and whether their role requires those rights.

Next step: Agree on separate administrator accounts and reduced privileges, with business application testing.

05. The company controls its domain, licences and account recoveryRoutine check

Record the domain owner, subscription administrator and authorised recovery contact. Check renewal dates and secure access storage.

Next step: Clarify ownership and permissions. Keep passwords, backup codes and keys in a protected system outside this checklist.

Backup and recovery

A completed backup message does not prove the business can resume work. Look for evidence of the latest copy and a restore test.

06. Backup covers the data the business needs to operateHigh priority

List business documents, databases, NAS/server and cloud data. For each group, identify the backup system and responsible person.

Next step: Close backup coverage gaps. Do not treat file synchronisation or RAID as a replacement for a separate backup.

07. The latest successful backup and failures have been checkedHigh priority

Review the date, scope and report of the latest successful job. Check who receives an alert when a backup fails.

Next step: Assign someone to monitor failures and check that the backup schedule matches acceptable data loss.

08. A trial restore has been successfully verifiedHigh priority

Look for a test date, selected data, results and confirmation that the recovered file or application opens. Record recovery time only if measured.

Next step: Arrange a controlled test in a separate location or test environment without overwriting production data.

09. A backup copy is protected from problems in the primary systemHigh priority

Check whether a failure, fire or compromised user account could destroy both originals and all copies. Review a separate location and an offline or immutable copy.

Next step: Agree with IT support on a suitable separate copy, access protection and a way to test its recovery.

10. The business has agreed acceptable downtime and data lossRoutine check

For critical processes, record acceptable outage duration and loss of recent data. Identify who authorises recovery.

Next step: Align backup and recovery procedures with those objectives. Record the gap between the target and tested result.

Computers and software

An inventory and regular checks help plan equipment replacement and updates before work is interrupted.

11. There is an up-to-date computer and equipment inventoryRoutine check

For each device, record the user, role, purchase year, warranty and recurring problems. Include servers, NAS and network equipment.

Next step: Assign someone to update the inventory when equipment is purchased, assigned, repaired or retired.

12. Systems and applications are supported and have an update planHigh priority

Check versions, vendor support status and recent updates. Record devices that need a specific migration plan.

Next step: Plan supported versions and updates, with backups and critical application testing. Document exceptions.

13. Device protection is active and alerts are reviewedRoutine check

Review protection status, updates and recent alerts. For portable computers, also check disk encryption and authorised access to recovery keys.

Next step: Resolve inactive protection and assign responsibility for alerts. Store recovery keys securely outside the checklist.

14. Licences and business subscriptions are documentedRoutine check

Compare active users, assigned licences, installed software and renewal dates. Check that purchases are recorded for the company.

Next step: Remove unnecessary costs and plan renewals or plan changes based on actual use.

15. There is a plan for failure of a critical computer or applicationRoutine check

Record who relies on each critical device, available replacements and access to business data. Identify recurring problems.

Next step: Plan spares or replacements based on business impact and downtime cost, supported by an annual IT budget.

Network and support organisation

Check real working conditions: connection stability, separated access and a clear way to report problems.

16. Internet and WiFi have been checked at workstationsRoutine check

Record where and when interruptions occur and their symptoms. Test business applications and video calls; one speed test does not establish stability.

Next step: Have IT support check the connection, coverage and network equipment, comparing results under the same conditions.

17. Guest access is separated from business resourcesRoutine check

Check whether a guest device can reach internal folders, servers, NAS or network management. A different WiFi name alone does not prove isolation.

Next step: Agree on isolation and access rules, then verify that approved business functions still work.

18. Remote access and network equipment have controlled accessHigh priority

With the administrator, review authorised users, remote access methods, updates and exposed services. Do not enter public IP addresses or passwords in this checklist.

Next step: Limit access to business needs and arrange protection and updates in an agreed maintenance window.

19. There is a contact and procedure for a critical service outageRoutine check

Record IT support and internet provider contacts, working hours and escalation arrangements. Review UPS and power outage plans where needed.

Next step: Agree on the call sequence and temporary working arrangements. Leave UPS or shutdown testing to the responsible person.

20. Open issues have an owner, due date and follow-up checkRoutine check

Review recent tickets, recurring failures and the three main risks. For each open issue, record an owner and the agreed next step.

Next step: Include checks in regular maintenance and repeat this checklist after significant business changes.

Turn findings into a short action plan

Start with high-priority gaps and unknowns, then address recurring problems. For each issue agree on an owner, a due date and evidence that will confirm completion. A confirmed item does not cancel an unresolved risk elsewhere.

Record issues and ownership only. Keep confidential details in your internal system.

For ongoing checks and follow-up, explore managed IT maintenance in Belgrade.

Common questions

Does a completed backup mean recovery will work?

A successful job report is useful evidence, but it does not replace a restore test. Verify that selected data can be recovered and used in a separate test location. Record the result and measured time.

How often should a business repeat the checklist?

Set a review rhythm with IT support and repeat relevant checks after staff changes, equipment replacement, migrations or an incident. Backup failures and security alerts need ongoing monitoring between reviews.

What should you send when requesting IT support?

Send the number of users and devices, affected services, symptoms and open checklist items through the agreed contact channel. Share credentials and sensitive technical details only through an agreed secure method.

Sources and editorial responsibility

Prepared by NBG TEAM d.o.o. for business IT reviews. The selection of checks is an editorial framework; settings depend on your systems and agreed support scope. About NBG TEAM.

Version: 1.0, .