IT security assessment: When did you last have an IT health check?

Every new client of ours starts with a 14-page onboarding checklist, and Chad Odom, our owner, performs and signs that review himself. It is an IT security assessment and health check in its most thorough form, and it rarely comes back clean. Most organizations look closely at their technology only when something breaks or a client, insurer or auditor asks for proof.

You don’t have to wait for either. A health check answers a few blunt questions: are your systems patched and supported, do your backups restore, who has access to what, and would you pass if someone asked for evidence?

Why an IT health check matters

IT drifts. Every hire, departure, software install, vendor login and quick fix changes your environment a little. None of it feels risky on its own. After a year or two you have old accounts that still work, devices nobody has patched, and a backup job that failed months ago without anyone noticing.

Attackers look for exactly that drift. Verizon’s 2026 Data Breach Investigations Report found that exploiting software vulnerabilities has overtaken stolen passwords as the most common way breaches start.

What a good IT health check covers

A useful review looks at six areas. The paperwork matters as much as the technology, especially if you keep client, patient or financial records.

Security basics

Check that MFA is on for every user, especially email and admin accounts, that endpoint protection is current and reporting in on every computer, that firewalls are updated and not running factory defaults, and that staff have had security awareness training in the last year.

Microsoft 365 settings

The tenants we review at onboarding tend to share the same problems: Microsoft’s default settings everywhere, auditing turned off, no conditional access, Intune licensed but never used, and licenses that are either underused or Standard where Premium is needed. Each one is quick to check and fix.

Supported software

Every operating system, application and firmware version should still receive security updates. Windows 10 reached end of support on October 14, 2025, as did Office 2016 and Office 2019. Office 2021 support ended on October 13, 2026. Microsoft’s paid Extended Security Updates for Windows 10 run one year at a time, the first business year ended in October 2026, and the price doubles each year. Anything unsupported belongs on a replacement plan.

Backups and recovery

Confirm that servers, cloud data and Microsoft 365 are all backed up, that one copy sits where ransomware can’t reach it, and when the last successful test restore happened. Our backup best practices cover the details.

Accounts, hardware and network

Look for accounts belonging to people who left, shared logins, too many administrators, and vendors with remote access they no longer need. Then check device age, warranty status, failing disks, Wi-Fi coverage and internet redundancy. A five-year-old server out of warranty is a risk even while it runs fine.

Compliance paperwork

If you handle health, financial or legal client information, include your risk assessment, written policies, vendor agreements, and records of training and access reviews. Healthcare practices need a HIPAA risk analysis (our guide to conducting a HIPAA risk assessment walks through it), accounting and tax firms have written security program requirements under the FTC Safeguards Rule, and cyber insurers ask detailed questions at renewal. At onboarding, the gaps we find most often are missing administrative safeguards, missing physical safeguards, and technical safeguards that exist but are misconfigured.

A self-check you can run this week

If you can’t answer yes with confidence, put the item on your list.

1. Every user has MFA on for email and remote access.
2. No computer runs Windows 10 without paid security updates, or any other unsupported software.
3. Someone restored a file or system from backup in the last 90 days, and it worked.
4. Everyone who left in the past year has had their accounts disabled.
5. You know who has admin rights, and the list is short.
6. You have a written hardware list with purchase dates and warranty status.
7. You know who to call, and what to do first, if ransomware hits tomorrow.

A “no” or “not sure” is where the conversation should start.

What you should get at the end

• 01A short list of urgent fixes that reduce real risk right away, such as turning on MFA or repairing a failing backup.
• 02A prioritized plan for bigger items, with rough timing so you can budget.
• 03A view of which hardware needs replacing and when, so upgrades don’t all land in the same month.
• 04A plain-language reason for each item.
• 05A plain “this is fine” where things are in good shape.

A 60-page scan report with no priorities is a sign the review wasn’t finished.

How often to do one

Do a full review at least once a year, and again after any big change: an office move, a new location, a switch in key software, a merger, a security incident, or losing the person who “knew how everything worked.” For our managed IT services clients, we hold a planning review whenever they ask for one. Year-end is a natural time, and our year-end technology review checklist pairs well with this one.

Can’t remember your last health check? Book a 15-minute call, tell us what has been bugging you, and we’ll tell you where to look first.

Frequently asked questions