In this guide 6 sections
A small office baseline answers four questions. Which devices exist, and who holds each one? Which accounts carry admin rights? When did a backup last survive a restore test? Which subscriptions renew next, and who pays? Put one person’s name and a date beside every answer, then review quarterly.
Start with a list of every device and who holds it
Walk the office with a notepad. Count laptops, desktops, the reception PC, the router, the switch, the label printer, the NAS box under the accounts desk and every phone that reads office mail.
Then add the machines nobody remembers. A spare laptop in a cupboard may still hold a saved mail login. A former intern’s desktop may still be joined to the office network and carry old files.
Write the operating system version and purchase year beside each line. Anything the maker no longer patches goes to the top of the replacement list. Check BitLocker or FileVault status on each laptop too, because a stolen unencrypted disk is an incident, not an inconvenience.
- Serial number and make
- Named holder, or shared with a location
- Operating system and version
- Disk encryption on or off
- Purchase year and warranty end
Find out who can change everything
List every admin account: the mail tenant, the domain registrar, the router login, the accounting package, the backup console and the website host. Beside each one, write who holds the password and who could recover it if that person left tomorrow.
Look for the shared login. A mailbox called accounts@ with a password pinned to a monitor is common, and named users are better wherever the software allows them. Everything else goes into a password manager.
Turn on second-step sign-in for the admins first. Staff accounts can follow. Also check that SPF, DKIM and DMARC records exist for the mail domain, since forged invoices usually start there.
- Mail and file admin
- Domain and DNS registrar
- Router and Wi-Fi controller
- Accounting and payroll package
- Backup console and cloud storage
Ask when a restore was last tested
A backup job that reports success proves only that files were written. Readable? Unknown. Pick one folder, restore it onto a different machine, open three files, and record the date and the person who did it.
Then ask what the job misses. Laptops with files on the desktop folder, delivery photos in a phone gallery, the Outlook .pst archive and a spreadsheet on a USB stick often sit outside the schedule.
If the server or NAS holds the only copy, that is a finding. Mark it red. A RAID array is not a backup, and neither is a second folder on the same disk.
Map the renewals before they surprise you
Search the company card statement and the inbox for the words renewal, invoice and expires. Build a table of domain names, SSL certificates, antivirus seats, mail licences, accounting licences, the website host and the support contract.
Put the renewal date, the notice period and the payer on each row. A domain that lapses on a Sunday takes mail down with it, and a licence that auto-renews for twice the seats in use quietly drains the account.
Sort by date. The next ninety days go on the owner’s calendar, with a reminder two weeks ahead. Note who receives the renewal emails, because a leaver’s mailbox is where many notices die.
Give every answer an owner and a review date
The page works only when each row carries a name, because without one the question is answered once and then drifts away from the person who knew the answer. Nobody has to be technical. They only keep that row true.
Set the review for the first Monday of each quarter and keep it under an hour. Walk the four blocks, change what moved, and mark anything unresolved with a date.
Start this week with the admin list. It is the shortest block.
Office IT baseline sheet
Four blocks fill the sheet: Devices, Admin accounts, Backups and Renewals. Each block is a table with columns for item, current answer, risk flag, named owner and next review date. Devices lists serial number, holder and patch status, while Backups lists what is covered, the last restore test and who ran it. Renewals lists vendor, date, notice period and payer.
Open a blank worksheet to printQuestions owners ask
How long does a baseline review take for a small office?
A first pass takes half a day for an office of a few dozen people. Later quarterly reviews take under an hour, since only the rows that moved need changing.
Who should own the baseline in an office with no IT person?
Usually the owner or office manager holds the page. Individual rows can belong to others, such as the accountant for accounting licences, provided each row carries a name.
What counts as a tested backup?
A restore you actually performed, on a different machine, with files opened and checked by a person. A green tick in the backup console alone does not count.
Should the shared reception computer be on the list?
Yes. Shared machines are often the least patched and the most used by visitors and part time staff. Record who is responsible for the machine and how it signs users out.