IT Manager's 20-Point Infrastructure Health Check

A practical walkthrough checklist for 20–200 seat firms. Recommended checks — not a compliance certification. Formal requirements (SOC 2, ISO 27001, cyber-insurance) need an assessor or broker.

Free checklist, no signup. Nothing here is tracked per-visitor.

ASSETS & LIFECYCLE

Inventory every device: owner, age, warranty, OS build.
Flag ghost assets: no logon in 30+ days.
Confirm Windows 11 readiness or ESU coverage.

NETWORK

Map subnets: staff, guest, IoT, printers separated.
Review firewall rules: no any-any inbound.
Confirm VPN/ZTNA access list matches current staff.

BACKUP & RECOVERY

Verify 3-2-1-1-0 coverage: 3 copies, 2 media, 1 offsite, 1 immutable, 0-error test.
Run a test restore this quarter; log RTO.
Confirm M365/Google data has real backup, not sync.

IDENTITY & ACCESS

Enforce MFA for all users, starting with admins.
Complete joiner-mover-leaver review: disable leavers, revoke sessions.
Keep 2 break-glass admin accounts with tested recovery.

ENDPOINTS & PATCHING

Confirm patch compliance: OS + apps under 30 days.
Verify EDR/antivirus coverage on every device.
Check encryption on all portable devices.

LICENSING & VENDORS

Reconcile licenses vs headcount; reclaim ghost seats.
Audit SaaS sprawl: card statements vs IdP app list.
Log vendor renewals 60 days out with exit clauses noted.

MONITORING & RESPONSE

Confirm alerting on risky sign-ins and forwarding rules.
Keep a 1-page incident contact card: who calls whom first.

Sources & limits: control areas adapted from NIST CSF 2.0 Small Business Quick-Start and CIS IG1 baseline; thresholds (30-day logon, quarterly restore) are practical defaults, not standards. Verify against your auditor, insurer, or counsel before relying on this list.