By Joe Engelking, CEO. Published November 2026.
A year-end IT review is a short pass through backups, accounts, renewals, aging equipment and staff habits before the new year starts. Do it in November or December while budgets are still open and nobody is rushing through tax season. The checklist below covers twelve areas, who each one protects you from, and the order we would work them in if you only have an afternoon.
What should a small business check on its IT before the year ends?
Check the things that fail quietly: backups, user access, sign-in protection, renewals, unsupported systems and old hardware. These are the problems that cost the most in January, when you are busy and the person who knew the answer is on vacation. Use the table to see all twelve at once, then read the sections for how to check each.
| Area | What to check | What it protects against |
|---|---|---|
| Backups | Restore one real file and one mailbox from backup. Confirm the newest copy is from this week. | Backup and recovery |
| Access | List every account. Disable former staff, old vendors and shared logins nobody uses. | Offboarding |
| Sign-in protection | Turn on multi-factor sign-in for email, remote access and every admin account. | Account takeover |
| Admin rights | Count who has administrator rights. Remove it from anyone who does not need it daily. | Malware spreading |
| Renewals | Write down every domain, certificate, firewall subscription, warranty and software license with its renewal date. | Surprise outages |
| Operating systems | Check that every computer and server runs a version the vendor still supports. | Unpatched systems |
| Old hardware | Flag computers, firewalls and switches that are failing or past a sensible replacement age. | Budget planning |
| Updates | Confirm patches are installing on every device, including the laptop that lives in a truck. | Known vulnerabilities |
| Email protection | Send a test phishing message or ask your provider to show what the filter caught this quarter. | Phishing |
| Staff training | Remind everyone how to report a suspicious email before year-end invoice and gift-card scams start. | Fake requests |
| Documentation | Store passwords, vendor contacts and network diagrams where more than one person can reach them. | Single point of failure |
| Budget | Turn the findings into a one-page list of must-do, should-do and next-year items. | Surprise costs |
Do your backups actually restore?
A backup that has never been restored is a guess. Pick one file and one mailbox, restore them, and write down how long it took and what broke. Confirm the newest copy is recent, not months old. We regularly get calls from owners hit by ransomware who have no backup, or whose newest copy is three months old. In those cases we have to tell them nothing can be done, then help them build something that works going forward.
For the full picture, see our backup and disaster recovery page and the post on why having backups is not a disaster recovery plan.
Who still has access who should not?
List every account in your email system, your line-of-business software, your remote access tool and your cloud storage. Disable anyone who has left, any vendor you stopped using, and any shared login that nobody can explain. Then count your administrators. Admin rights make an attacker’s job easier, so keep them to the few people who need them. Turn on multi-factor sign-in everywhere it is offered, starting with email.
Which licenses, domains and certificates renew in January?
Write down every renewal with its date: your domain name, website certificate, Microsoft 365 or Google Workspace licenses, firewall subscription, antivirus, warranties and any software you rent. A lapsed domain takes email and your website down with it. A lapsed firewall subscription leaves a working box that no longer gets updates. Put the dates on one shared sheet, not in one person’s inbox.
Which computers and servers are past support?
Check that every computer and server runs an operating system its maker still updates, and that patches are installing, including on laptops that rarely come into the office. Then flag hardware that is failing or old enough that you would rather replace it on your schedule than during an outage. A common rule of thumb is to plan for replacement at four to five years, but a machine that is still fast and still supported can wait.
Is your staff ready for year-end scams?
Year-end brings fake invoices, requests for employee tax forms, gift-card requests that appear to come from the boss, and shipping notices. A five-minute reminder on how to report a suspicious message does more than a yearly video. We cover what works in security awareness training for small business, including how to run phishing tests without punishing anyone.
What belongs in next year’s IT budget?
Turn what you found into three lists: must do now, should do this year, and watch for next year. Include replacements, renewals, any gap in your security and any project you have been putting off. A one-page list lets the owner approve a plan instead of reacting to one emergency at a time. If your IT is handled by a provider, ask them for exactly this page.
Want a second set of eyes on this list?
We run a free IT assessment, on-site or remote, that walks through backups, access, security and equipment for your business. If you would rather have a team check it, contact us and we will set up a time. You can also read how managed IT services from a family-run team based in Hoffman Estates keep this list from piling up.
Year-end IT checklist questions
How often should a small business review its IT?
At least once a year, and again whenever someone important joins or leaves, you move offices, or you change a major system. A year-end review works well because renewals, budgets and tax-season deadlines all land in the same few weeks.
Can we do this checklist ourselves?
Yes, if someone has administrator access to every system and the time to check each one. Most of the effort goes into finding logins and renewal dates nobody wrote down. If that person is you, expect the first pass to take longer than the checklist suggests.
Should we change everyone’s passwords at year end?
Not as a routine. Forced rotation tends to produce weaker passwords. Change a password when it may have been exposed, when someone leaves, or when you find it reused. Turn on multi-factor sign-in, which protects you better than a new password does.
What if the person who set up our IT is gone?
Start with access. Find out who owns the domain, the Microsoft 365 or Google admin account and the firewall login. If nobody knows, that is the first item to fix, because every other task depends on it.
What should we do first if we only have an hour?
Test a restore from backup, then turn on multi-factor sign-in for email. Those two checks cover the failures we see most often: no usable backup after ransomware and stolen email logins.