Why a calendar beats good intentions
IT maintenance has a frustrating quality: when it's done well, nothing happens, so it's easy to skip. Nobody notices that the backup hasn't run for three weeks until they need a file back. Nobody notices that a former employee still has access until something goes missing. Nobody notices the firewall subscription lapsed until the internet slows to a crawl or an attack gets through.
Putting tasks on a calendar, with a named person responsible, takes them out of the 'when we get time' category. If you have a managed IT provider, many of these tasks should be in their service, but someone in the business should still see the results. If you handle IT in-house, this calendar is the core of the job. Either way, the list below is a starting point; adjust it to the systems you actually run, and drop anything that doesn't apply rather than ticking boxes for equipment you don't have.
Every month
Check that backups ran successfully, including Microsoft 365 or Google Workspace backups, any server or NAS backups, and cloud copies. Look at the report, not just the absence of errors. Confirm Windows and macOS updates installed on every computer, and follow up on machines that keep failing or haven't checked in, since a laptop that has been in a drawer for two months will be far behind.
Review the endpoint protection console for detections and devices that have stopped reporting. Check that no unexpected admin accounts or mail forwarding rules have appeared in Microsoft 365. Glance at disk space on servers and shared storage. Process any pending account changes: starters, leavers, role changes. Each of these takes minutes when done monthly and hours when left for a year.
Every quarter
Test a restore from backup. Pick a real file or mailbox, restore it to a separate location and confirm it opens. Once a year, extend this to a larger test, such as restoring a whole server or a full SharePoint site, to understand how long a real recovery would take.
Review user accounts and access across all systems: remove anyone who has left, check that each person's access still matches their role, and confirm the list of admins. Review guest and contractor access. Check the licence register against active users and cancel unused seats. Update firmware on the firewall, switches, Wi-Fi access points and printers. Look at the asset list and flag any devices approaching the end of support or warranty. Spend twenty minutes reading through your IT documentation and correcting anything out of date. Quarterly is also a sensible rhythm for a short meeting between the business's IT owner and the IT provider to go through tickets, risks and upcoming work.
Every year
Review your IT policies, incident response plan and business continuity plan, ideally alongside your cyber insurance renewal. Run a phishing awareness refresher for all staff. Check domain name renewal dates and make sure they're set to auto-renew with a current payment method. Check certificate renewals for any systems not handled automatically.
Plan the next year's hardware replacements and budget. Check which computers will fall out of operating system support, which servers or network devices are near end of life, and which software contracts come up for renewal. Do a broader security review, internally or with an outside assessment, and use the results to set priorities. Run a full incident tabletop exercise, even a simple one: 'Ransomware on Monday morning, what do we do?' Walking through the first hour with the owner, office manager and IT provider usually exposes a missing phone list, an unclear decision-maker or a backup nobody knows how to reach, all far cheaper to fix in a meeting room than mid-incident.
Make it someone's job
Put the tasks in a shared calendar or task list with a named owner for each, and a place to record that it was done and what was found. A simple checklist in Microsoft Planner, a recurring task in your ticket system or even a spreadsheet with dates works. What matters is that someone ticks it off and someone else can see that it was ticked.
If you use a provider, ask to see their monthly and quarterly reports, and ask how they handle exceptions such as a backup failure. Office IT provides a monthly summary to managed clients for exactly this reason, but whatever arrangement you have, the business should be able to see that the routine work is actually happening.
In short
- Monthly: backups, updates, endpoint alerts, account changes.
- Quarterly: restore test, access and licence review, firmware updates, documentation.
- Yearly: policies, training, renewals, hardware planning and a security review.
- Give each task a named owner and a record of completion.
- If outsourced, ask to see the results.