How can you audit your business IT in 30 minutes?

Why audit your IT at all?

Most small businesses don't have a problem they can see. They have gaps they can't see: an old admin account nobody uses, a backup that has quietly failed for months, a laptop that stopped updating last spring. Those gaps are what attackers and bad luck find.

The numbers show how common this is. The government's Cyber Security Breaches Survey, published in April 2026, found that 43% of UK businesses had a breach or attack in the previous 12 months, rising to 65% of medium-sized businesses. Phishing was the most common attack, hitting 38% of businesses. Yet only 47% of businesses said they use multi-factor authentication (MFA), and only 25% had a formal incident response plan.

Thirty minutes won't replace a proper review. It will tell you whether you're broadly in control, and where to spend your next pound and your next hour.

How does the scoring work?

Take the ten areas below in order, three minutes each. For every area, give yourself 2 if you can answer "yes" and prove it (a screen, a report, a document), 1 if you think so but can't show it, and 0 if the answer is no or you don't know. "I don't know" scores zero on purpose: if you can't check it, nobody is checking it.

Area (3 minutes each)	The question to answer	2 points	1 point	0 points
1. Accounts and MFA	Is MFA on for every user, including admins and email?	Enforced for everyone, admins separate	On for most people	Off, optional or unknown
2. Patching	Are critical updates installed within 14 days on every device?	Automated and reported	Automatic, never checked	Manual or unknown
3. Devices	Is every device company-owned, listed and on a supported OS?	Full list, all managed, Windows 11 or current macOS	Mostly	No list, personal devices, Windows 10
4. Email security	Is email filtered beyond the default, and are staff trained on phishing?	Filtering plus regular training	One or the other	Neither
5. Microsoft 365	Are files in SharePoint/OneDrive, licences right and sharing controlled?	Reviewed in the last year	Set up once, never reviewed	Files on laptops, no review
6. Backup	Is data (including Microsoft 365) backed up separately, and has a restore been tested?	Tested restore in last 6 months	Backups run, never tested	No backup or unknown
7. Leavers and access	Are leavers removed the day they go, and do people only see what they need?	Written checklist, same-day removal	Done, but not always promptly	Old accounts still active
8. Connectivity	Is your internet fast enough, and is there a backup connection?	Right speed plus 4G/5G or second line	Right speed, no backup	Regular problems
9. Phones	Are you off analogue lines and ready for 31 January 2027?	All digital, alarms and lifts checked	Phones done, other lines unknown	Still on PSTN or ISDN
10. Support and plan	Does someone monitor your IT, and is there a plan for the next 12 months?	Proactive support and written plan	Support, but reactive	Nobody, or "the person who's good with computers"

16–20: you're in good shape. Check the ones and fix them this quarter. 12–15: typical for a growing business. Pick the three lowest areas and give each an owner and a date. Under 12, or a zero on areas 1, 2 or 6: stop and fix those first, because they're the gaps attackers use most.

What are the 2026 best practices behind each question?

The table is built on the controls that stop most everyday attacks. They're the same ideas behind Cyber Essentials, the government-backed baseline, which tightened in April 2026.

MFA everywhere. Since the Cyber Essentials update (version 3.3) in April 2026, MFA must be on for every cloud service that offers it, and missing it is an automatic fail. Treat it as the minimum, not an extra. Keep admin accounts separate from everyday accounts, and keep them few.

Patch within 14 days. The same update made installing critical and high-risk updates within 14 days of release an automatic-fail question. That's hard to do by hand across 20 laptops, which is why patching should be automated and reported. Windows 10 reached end of support on 14 October 2025, and paid extended updates for businesses run a year at a time, so any Windows 10 machine still in use needs a replacement date.

Standardise and manage devices. A business with three laptop models and one operating system is far easier to secure than one with nine. Company data on personal phones and laptops should sit inside a managed app or profile, so you can remove it when someone leaves.

Layer email security and train people. Phishing is the most common attack by a distance, so the inbox is where filtering and awareness pay off most. Short, regular training beats one annual session.

Back up separately, and test it. Microsoft keeps Microsoft 365 running, but protecting your data from deletion, ransomware or a rogue leaver is your job. A backup that has never been restored is a hope, not a backup.

Control access and plan for leavers. Most "old account" risks come from people who left. A one-page leavers checklist fixes most of it.

Resilient connectivity and digital phones. Your phones, card machines and cloud apps now all depend on one internet connection. A 4G/5G backup is cheap insurance. Openreach closes the analogue phone network on 31 January 2027, so anything still on a copper line, including alarms and lift lines, needs to move.

Monitor and plan. Problems found by monitoring get fixed before users notice. A simple 12-month plan stops IT spending from being a series of emergencies.

What we see when we run this audit properly

When Indigo carries out a technology assessment, the lowest scores cluster in the same three places: backup that's never been tested, Microsoft 365 that was set up once and not reviewed since, and leavers' accounts still active. None of these are expensive to fix. They persist because nobody owns them. Our service desk handled 1,854 tickets in September 2026, with an average first response of 13 minutes and 65% resolved within 2 hours, and a good share of that work is exactly this kind of routine housekeeping.

Example: a 25-person contractor scores 11 out of 20. MFA is on for office staff but not for site managers' shared login, patching is automatic but unchecked, and nobody has tested a restore. Fixing those three areas (removing the shared login, turning on patch reporting and testing one restore) would take their score to 16 within a month, at very little cost. The shared login matters most, because one stolen password there gives access to everything the site team can see.

When should you get a professional assessment instead?

A self-audit tells you what you know. A professional assessment tells you what you don't. Get one if you scored under 12, if you answered "don't know" more than three times, if you're bidding for work that asks for Cyber Essentials, or if you've had a security scare, a key person leave, or a merger or new site in the last year.

A good assessment should look at your actual systems rather than a questionnaire: Microsoft 365 security settings, the device list from a monitoring tool, backup reports, firewall rules and your contracts. It should end with a short, costed list of priorities, not a 60-page report nobody reads.

How Indigo does this. Indigo Unified Communications runs a free technology assessment from our Glasgow and Livingston offices: a consultant reviews your devices, security, Microsoft 365, backup, connectivity and phones, and gives you a short written list of priorities. We hold Cyber Essentials Plus and ISO 27001:2022. Across the 2,000+ devices (endpoints) we manage, we use Datto RMM to monitor and update them, Kaseya 365 Endpoint to protect them against viruses and ransomware, and Microsoft Intune to manage them. Book a free technology assessment →

What to do next

1. Run the ten-question table above with whoever looks after your IT, and write down the score for each area.
2. Fix any zero on MFA, patching or backup this month. Those three matter most.
3. Check every phone line, alarm and lift line against the 31 January 2027 switch-off using our PSTN switch-off check.
4. Use the Cyber Essentials checklist if customers or tenders ask for certification.
5. If you scored under 12, book a free technology assessment or see what managed IT support should include.