When we run a free IT assessment, we are checking the same ten things every time. None of them are exotic. Together they stop the overwhelming majority of the attacks that actually hit small businesses — not nation-state stuff, but the phishing, ransomware, and account takeovers that arrive by email every day.
Here is the full list, so you can audit yourself before you ever talk to us — or to anyone.
The non-negotiables (do these first)
1. MFA on everything that matters — email, banking, payroll, remote access. Enforced, not optional. This single control stops most account takeovers.
2. Tested backups. Not "we have backups" — when did you last restore a file from them? Ransomware gangs target backups first; untested backups are a hope, not a plan.
3. Patching on a schedule. Most breaches exploit vulnerabilities that had fixes available for months. Windows, macOS, browsers, and the router firmware everyone forgets.
4. Unique passwords in a manager. The attack is not guessing your password — it is reusing the one leaked from some other site. A password manager ends that class of attack for a few dollars per user.
The layer insurers now require
5. Endpoint detection and response (EDR) — modern antivirus that watches behavior instead of matching known viruses. Cyber-insurance applications now ask for it by name.
6. Email filtering that catches phishing and spoofed senders before staff see them. 7. Offboarding discipline: when someone leaves, their access dies the same day — former-employee accounts are a favorite way in.
The layer that separates managed from lucky
8. Someone actually watching — alerts that no one reads are decoration. 9. Device management (Intune or Jamf) so lost laptops can be wiped and settings enforced. 10. A written plan for the bad day: who to call, what to unplug, where the insurance policy is.
Numbers 1–4 you can genuinely do yourself this week, and you should. Numbers 5–10 are why our Professional managed IT tier exists — they need enterprise tooling and a human on the other end. If you only want a one-time gap check, an $89/hour engagement covers an audit without any contract.
Want your ten checked by an engineer instead of a checklist? That is literally what the free assessment is — and the written summary is useful even if you never hire us.