An IT infrastructure audit for a small company: 12 questions you should be able to answer

An audit isn’t about technology — it’s about “what happens if…” questions. Here are the twelve we start every migration project with.

Data

1. Where is the 1C database, and who can restore it? If the answer is “on Dilnora’s computer, and Shukhrat restores it when we call him”, you don’t have backups.
2. When did you last check that a backup actually restores? “Backups are being made” and “we restored from a backup” are different things.
3. Is there a copy outside the office? A fire, a theft or ransomware takes both the server and the external drive next to it.

Access

4. Where are the passwords for the servers, domain, hosting and email written down? If they’re in one person’s head, the company depends on that person.
5. Have former employees been disconnected everywhere? RDP, VPN, email, shared folders, company messengers.
6. Is there two-factor protection on remote access? Open RDP with a password is the main cause of ransomware attacks.

Hardware and services

7. What happens if the office server goes down for a day? Who won’t be able to work, and how many people.
8. When were the servers last updated, and how old is the hardware? A server over 5 years old with no warranty is a matter of time.
9. Who finds out about an outage first — you or your clients? No monitoring means your clients.

Money and documents

10. How much does the company spend on IT per month — including server room electricity, contractors, licenses and foreign subscriptions? The total is usually a surprise.
11. Whose name are the domain and licenses registered in? A domain in the studio’s name and licenses in a former employee’s name are typical findings.
12. Is there an infrastructure diagram, even on a single page? If not, a new specialist will need a month to figure things out.

What’s next

If the answer to three or more questions is “don’t know” or “not great”, you need an audit with a written report: what you have, what the risks are, what to do first and how much it will cost to get things in order. We complete such an audit in 3–5 days; for clients moving to MyCloud, its cost is credited toward the migration project.