An IT infrastructure assessment is two things wearing one name. It’s a stocktake of everything you own and pay for, and it’s a set of tests on whether that stuff does what you assume it does. Most businesses have done a version of the first half. Very few have done the second.
The gap between the two is where the surprises live. The backup that has been running nightly for three years and has never been restored from. The server sitting under a desk that nobody can name a purpose for. The five licences you’re still paying for after those people left.
Here’s how to work through it without needing a fortnight.
Before you start: decide what you’re assessing for
There’s no single right scope. Pick one of these and the rest of the work gets much easier to prioritise.
- Risk. What could stop us trading, and how long would we be down?
- Cost. What are we paying for that we don’t use?
- Growth. Can this setup carry twice the staff?
- Evidence. A customer, insurer or tender wants proof.
Do all four at once and you’ll produce a document nobody reads. Pick the one that made you open this page.
1. Build the asset list
Everything, and more than you think. Desktops and laptops with their age and operating system version. Servers, physical and virtual. Network gear: modem, router, switches, access points. Printers and scanners. Phones and phone handsets. Every cloud service with a login, including the ones a department signed up for on a credit card.
Two columns matter more than the rest. Who owns it, meaning who in the business decides about it, and what breaks if it stops.
That second column is the whole assessment in miniature. A five year old switch in a comms cupboard is not interesting until you write down that every till in the shop runs through it.
2. Find the machines that are past end of support
This is the quickest win in the whole exercise.
Windows 10, version 22H2, along with the Windows 10 Enterprise LTSB editions, reached end of support on 14 October 2025. Microsoft’s position is plain: those editions receive no security updates after that date, and support will direct you to upgrade a compatible device to Windows 11 or replace it.
So the question for every machine on your list is whether it’s on a supported version, and if not, whether it’s capable of running one. Unsupported operating systems are the most common finding in a small business assessment and the easiest to plan around, because the answer is either an upgrade or a replacement and both have known costs.
Do the same check for line of business software. The application your business runs on has a supported version list too.
3. Test the backups instead of checking them
A backup job with a green tick is a report that a job ran. It isn’t evidence that you can get your data back.
Pick two things and actually restore them. One should be a single file from a week ago, because that’s the restore you’ll do most often. The other should be something structural: a mailbox, a database, a whole machine into a test environment.
Write down how long each took, who did it, and what they needed access to. That number is your real recovery time, and it’s usually longer than anyone guessed.
Across the twelve months to 18 August 2026 our service desk handled 110 requests touching backups or restores, from 22 different businesses. The great majority were someone wanting one file back after deleting it. That’s the restore worth being good at.
4. Benchmark the security, don’t just describe it
“We have antivirus and a firewall” isn’t an assessment finding. Use a published standard so the result means something to someone else.
ASD’s small business cyber security guide sets three starting measures: multi-factor authentication turned on, software updated, information backed up. After that it points at Maturity Level One of the Essential Eight.
The Essential Eight gives you eight named things to score yourself against: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups.
Score each one honestly, in a line or two. The output is a page you can hand to an insurer or a provider, rather than an opinion.
5. Audit the licences and the accounts together
These two questions belong side by side, because the answer to one exposes the other.
Pull the list of active user accounts and the list of paid licences, and compare both against your current staff list. Look for accounts belonging to people who left, accounts nobody can identify, shared logins, and licences assigned to no one.
While you’re there, check the plan itself fits. Microsoft publishes four business plans: Apps for business, Business Basic, Business Standard and Business Premium. They differ in whether you get the desktop apps, hosted email with a 50 GB mailbox, and the device management and advanced protection that come with Premium. Plenty of businesses are on the wrong one in both directions.
Licence and subscription questions made up 38 of our service desk requests over the year, across 18 businesses. It’s a boring category that quietly costs money every month.
6. Find the single points of failure
Walk the list and ask what happens if each item disappears at 9am on a Monday.
One internet connection. One person who knows the admin password. One server that hosts the file share and the accounting database. One phone number published on every vehicle.
You don’t have to fix all of them. You do have to know which ones you’ve accepted, and tell the owner of the business that you’ve accepted them.
7. Test the support path, don’t assume it
If something breaks tonight, who gets rung, on what number, and what happens if they don’t answer?
Check whether you have response targets in writing and what they actually promise. Ours are set by severity: a P1 where the business has stopped is 15 minutes to respond and 4 hours to resolve, while a P4 request is 1 business day to respond and 5 business days to complete. Whatever your arrangement, know the numbers before you need them.
8. Check it can carry growth
The most useful growth test in a small business is how long it takes to get a new starter working.
Over the year our team spent 40.6 hours across 41 new user and onboarding requests from 21 businesses. That’s roughly an hour each, and the ones that take three are almost always the businesses with no documented process: someone has to work out which apps, which licence, which permissions, from scratch, every time.
Time your own. If it’s more than an hour of someone’s day, the fix is a written checklist, not more people.
What to do with the findings
Sort everything into three piles: fix now, budget for, and accepted risk. Put a name and a date against the first pile. Write one sentence for each item in the third explaining why you’re living with it.
Then diarise the whole assessment for twelve months’ time. The document ages, and an old assessment read as current is worse than no assessment.
One thing to do this week: restore a single file from last week’s backup and time it. If nobody can, you’ve found the most important item on your list before you’ve written anything else down.
If you’d rather someone else ran the assessment and handed you the plan, have a look at how we work.