A Cup of Tea and 25 Minutes: The Monthly IT Check Your Small Business Can Actually Keep

The problem with heroic IT clean-ups

Small-business IT tends to get attention in bursts. Something breaks, someone panics, a password gets reset, and everyone promises to be more organised next time. Then the next six months disappear.

The fix isn't a bigger annual audit. It's a smaller habit. Twenty-five minutes, once a month, with a cup of tea and a checklist you don't need a consultant to translate. The aim is not to make your IT perfect. It's to stop the same handful of risks quietly getting worse.

At 25Seven IT, we'd rather see a firm do a modest monthly check than a heroic clean-up every second winter. So here's a routine designed to survive real life.

Before you start: three rules

• Put it in the calendar. Same time each month. Last Friday afternoon works well because nobody is starting anything ambitious.
• One person owns it. Not a committee. One name.
• If it takes longer than 25 minutes, stop. Write down what you found and pick it up next month. The point is the habit, not the marathon.

The six checks, roughly timed

1. Test one backup restore (5 minutes)

A green tick in a backup dashboard is not the same as a working restore. Pick one folder or one file, restore it to a test location, and open it. That's it.

If you use a cloud service, check what the provider actually backs up and how long it keeps copies. If nobody knows, that's your first action. A backup you've never restored is a rumour, not a safety net.

2. Look at your admin accounts (5 minutes)

In Microsoft 365 or Google Workspace, list who has global admin or super admin rights. Fewer is better. Daily email accounts should not be admin accounts. Named admin accounts are better than a shared login called something like officeadmin.

If the same password for that admin account is written on a sticky note in a drawer, deal with that this month. It's a small job now and a very large job later.

3. Check MFA coverage (4 minutes)

Multi-factor authentication is still one of the most effective controls a small firm has. In the admin centre, look for users who are not enrolled or who are exempt. Pay particular attention to anyone who can access finance, payroll, or customer records.

An authenticator app is usually a sensible default. SMS codes are better than nothing, but they're not the strongest option. The main thing is that the important accounts are covered and that the person who set it up still has access to the phone.

4. Glance at patch status (3 minutes)

You don't need a full vulnerability report. Check the obvious things: Windows and macOS updates, browser updates, and any router, NAS, or printer that has firmware updates sitting ignored.

Automatic updates are your friend here. If a device has been asking for a restart for three weeks, that's a small sign of a larger habit problem.

5. Review licence renewals (3 minutes)

Put renewals in a calendar with a reminder two weeks before. Check for licences you're paying for but not using, especially after someone has left. Auto-renew is convenient until it quietly renews something nobody needs.

Keep a simple list: what the licence is for, who owns it, when it renews, and how much it costs. That list is boring. It also saves money.

6. Check who is still in the tenant (5 minutes)

Compare your current team list with the active users in Microsoft 365 or Google Workspace. Anyone who has left should be blocked, their mailbox and files dealt with, and their licence reclaimed. Anyone who has changed roles should have the access reviewed.

This is the check that catches the ghost accounts. It's also the one most likely to reveal a forwarding rule nobody remembers setting up.

If you only do three of these

Some months will get away from you. If you can only manage three checks, do these:

1. Test a backup restore.
2. Check MFA coverage.
3. Review leavers and admin accounts.

Those three cover the risks that tend to hurt small firms most: losing data, losing an account, and leaving a door open after someone has moved on. The rest can wait for a calmer month.

A printable checklist

Use this as a simple monthly record. Print it, scribble on it, and keep it in a folder or shared note.

• Date:
• Owner:
• Backup restore tested? Which file or folder?
• Admin accounts reviewed? How many global admins?
• MFA exceptions found?
• Patch status checked? Any devices behind?
• Licence renewals due in the next 60 days?
• Leavers or role changes checked?
• Actions for next month:

What to do with the results

Don't turn the checklist into a project plan. Pick no more than three actions and give them dates. If the same issue appears three months running, that's a sign you need a proper fix rather than another note in the margin.

A monthly 25-minute check won't make a small business bulletproof. It will make it harder to ignore the basics. And in our experience, that's most of the battle.