Most IT problems that land on a business owner's desk have been building for weeks. The backup that fails on the day someone deletes a client folder has usually been failing since the month before. The Microsoft 365 account a scammer uses to send fake invoices often belongs to someone who left the business last year.
A half-hour check once a month catches most of this while it is still cheap to fix. It needs no technical skill, only someone who knows who works in the business and what the business pays for. This post covers six things to look at, who should do the check, and which findings to hand to your IT provider.
Why a monthly look is worth the time
Attackers tend to take the easiest way in. Verizon's 2026 Data Breach Investigations Report found that exploiting known security flaws is now the most common way a breach begins, ahead of stolen passwords for the first time in the report's 19-year history. According to SecurityWeek's coverage of the report, about 31% of breaches came from unpatched software, meaning software with a known flaw where the maker has already released a fix that nobody installed. Verizon also reported that organisations took a median of 43 days to fully fix a known flaw, up from 32 days the year before.
Smaller businesses carry real costs when something does go wrong. ASD's Annual Cyber Threat Report 2024-25 puts the average self-reported cost of a cybercrime report from a small business at $56,600, up 14% on the previous year.
The six things to check
Updates: are they actually installing?
Open a few staff laptops and look at whether Windows updates are installing or sitting at "restart required" week after week. Do the same on phones and for the software people use most, such as the web browser and the accounting package. If someone keeps choosing "remind me later", that habit is the thing to fix.
Backups: look at the last few runs, then test one
Open your backup tool and read the last few results. You want recent successes, not a list of errors. Then ask when anyone last restored a file from the backup. Until someone has restored a file from it, you don't know the backup works.
User accounts: does every name still belong to someone?
Open the user list in Microsoft 365 or Google Workspace and read it through. Every name should be a current employee or contractor. Look for people who have left, contractors whose work finished months ago, and shared logins such as "office" or "admin" that several people use. Switch off anything you do not need.
Multi-factor authentication: switched on for everyone?
Multi-factor authentication (MFA) is the extra step after a password, such as approving a sign-in on a phone app. An authenticator app is a better choice than codes sent by text message, which Microsoft is phasing out. Check that it is on for every account, not only the people who set it up first, and pay closest attention to administrators and anyone who handles payments. A 2023 Microsoft study found MFA reduced the risk of account compromise by 99.22% across the population studied, and by 98.56% where passwords had already leaked.
Devices: do you recognise everything that is connected?
Look at the list of devices signed in to your systems. If there is a laptop or phone you do not recognise, find out whose it is. While you are there, confirm that laptops are encrypted (scrambled so a lost device cannot be read) and that any phone with work email on it has a passcode or fingerprint lock.
Subscriptions and licences: what are you paying for?
Read your billing page line by line. Businesses regularly pay for licences that belong to people who left, or for two tools that do the same job. It is also how you find software that someone signed up for without telling anyone.
Put it in the calendar and write down what you find
Pick a fixed day, such as the first Monday of the month, and give the job to the same person each time. Keep a running note of what you checked and what you found. After a few months you will see whether the same problem keeps coming back, which usually means it needs a proper fix instead of a monthly clean-up.
The 30 minutes only works if you stop yourself from fixing things halfway through. Write the findings down and deal with them afterwards.
What to fix yourself and what to pass on
Most findings are small: a laptop that needs a restart, a licence to cancel, an account to switch off. Handle those on the day. Pass the rest to your IT provider, in particular backups that keep failing, MFA that will not switch on for someone, a device nobody recognises, and updates that fail on the same machine every month. Those usually point to a bigger problem underneath.
Patching, MFA and backups all appear in the Essential Eight, the Australian Signals Directorate's baseline set of eight practices for reducing cyber risk. A monthly check doesn't replace an Essential Eight assessment, but it keeps an eye on several of the same areas between assessments.
What a monthly check cannot do
A glance once a month is not monitoring. A good IT provider has tools watching your systems every day and flagging problems you would never spot by eye. The monthly check covers what those tools cannot know: who left last month, which subscriptions you approved, and whose laptop is whose.
What to do next
1. Choose a day and a person this week, and book the first check in the calendar.
2. Run through the six items once now. Note anything that fails and send the backup and MFA findings to your IT provider.
3. Ask your IT provider where to find each item and to write the steps down, so the check does not depend on one person's memory.
If you'd like a hand getting started, iQtec's Managed IT Support team can help you set up the check and take on the findings that need a technician. Get in touch to talk it through.
Sources and further reading
Verizon, 2026 Data Breach Investigations Report, as reported by Help Net Security (20 May 2026)
SecurityWeek, Verizon DBIR 2026 coverage (19 May 2026)
ASD's ACSC: Annual Cyber Threat Report 2024-25 factsheet for businesses and organisations (October 2025)
Microsoft Research: How effective is multifactor authentication at deterring cyberattacks? (May 2023)
ASD's ACSC: Essential Eight
FAQ's
How often should a small business check its IT?
Once a month suits this list. Backups deserve a quick look more often if losing a day’s work would seriously hurt, because backups are the item most likely to fail quietly.
Who should do the check?
You or whoever runs the administration side of the business. Most of the list needs no technical skill, only someone who knows who works there and what the business pays for.
Is this not my IT provider's job?
Your provider handles monitoring, patching and fixing. The monthly check covers the parts that depend on knowing your business, such as who left last month or which subscription nobody approved.
What matters most if I only have ten minutes?
Backups and updates. Without a working backup you can lose everything you have stored, and unpatched software is now the most common way attackers get in.
Does this apply if everything we use is in the cloud?
Yes. Cloud tools still depend on updated devices, working backups, MFA switched on and user lists that match who actually works for you.