IT health check checklist: 24 questions for small business owners
You don't need to be technical to get a rough read on your IT. Work through these questions with whoever looks after your computers. Every "no" or "not sure" is worth writing down. If you end up with more than a handful, that's your sign to get a proper health check.
Last updated
The short answer
A small business IT health check should confirm that backups run and have been test restored, every account with email or money behind it uses multi-factor authentication, all computers still get security updates, former staff accounts are closed, the domain has SPF, DKIM and DMARC set up, the network and Wi-Fi are secured and documented, and someone knows who to call when things go wrong.
How to use this checklist
Answer each question yes, no or not sure. Be honest: "I think so" counts as not sure. The questions are grouped so you can hand a section to the person who'd know. The first three groups match the Australian Cyber Security Centre's starting advice for small business (multi-factor authentication, updates and backups), so start there if you're short on time.
The checklist
1. Backups
Do backups run every day without anyone having to remember? Is at least one copy kept off-site or in the cloud, away from the office? Has anyone restored a file or a whole system from backup in the last six months? Are your Microsoft 365 or Google Workspace emails and files backed up separately?
2. Logins
Does every email account use multi-factor authentication? What about online banking, accounting software and remote access? Have accounts for everyone who has left been closed? Is there more than one person who can get into the admin accounts if the main person is away?
3. Updates
Do all computers install Windows or macOS updates automatically? Is any computer still on Windows 10 or older without paid extended updates? Is anything still running Office 2016 or 2019? Are your router and firewall on current firmware?
4. Email and payments
Does your domain have SPF, DKIM and DMARC records? Do staff phone a known number to confirm any change to a supplier's bank details? Would you know if someone set up a rule forwarding your email outside the business?
5. Devices
Does every computer have antivirus or endpoint protection that someone checks? Are laptops encrypted, so a stolen one doesn't mean stolen data? Do phones with company email have a passcode, and can you wipe them remotely?
6. Network
Is the guest Wi-Fi separate from the one staff use? Has the router's default admin password been changed? Do you know what happens to phones, EFTPOS and email when the internet drops?
7. Documentation and suppliers
Is there a written list of your systems, logins and who to call for each? Do you know which outside companies have remote access to your computers? Would your business keep running if your IT person was unreachable for a month?
Who this is for
- Owners and office managers who want a quick read on their IT without paying anyone yet.
- Businesses preparing for a cyber insurance renewal or a client security questionnaire.
- Anyone taking over IT duties from someone who has left.
What to do with your answers
- Fix the quick ones now. Turning on multi-factor authentication, closing old accounts and changing default passwords cost nothing and remove a lot of risk.
- Test a restore. If nobody has restored from backup recently, do it this week. It's the one that hurts most when it turns out not to work.
- List the old gear. Write down anything past its end of support date and plan to replace it before it becomes urgent.
- Get help with the rest. If you have more than five or six "no" or "not sure" answers, a professional IT health check will sort them into a proper plan.
How WaTo can help
- Our IT health check covers every question here and more, and checks the answers in your actual systems.
- You get a traffic-light report that ranks the fixes, and a walkthrough so you understand it.
- We're in Adelaide and have been looking after business IT since 2001.
Checklist questions
How long does this checklist take?
An hour or two if you can ask the right people. The questions you can't answer are often the most useful ones.
Is this enough for cyber insurance?
It's a good warm-up. Insurers ask similar questions, but they'll expect the answers to be accurate, so check anything you're unsure about before you sign the proposal.
Which section matters most?
Backups, logins and updates. The Australian Cyber Security Centre recommends small businesses start with exactly those three.
We answered yes to everything. Are we fine?
You're in better shape than most. It's still worth having someone check, because "yes" sometimes means "it was set up once" rather than "it's still working".
How WaTo can help with this
Guides on this topic
- What a useful IT health check looks at
- How to test backups and recovery before an outage
- Microsoft 365 security baseline for small businesses
- The IT documentation every small business should keep
Sources & references
WaTo Consulting. Last reviewed 2026-10-24. Review when the Australian Cyber Security Centre updates its small business guidance.
Too many "not sure" answers?
We'll check every one of them in your real systems and give you a plain-English plan.
Mon to Fri, 8:30am to 5pm
