Why businesses ask for one
Owners usually ask for a health check at a turning point: they are unhappy with current support, preparing to switch providers, applying for cyber insurance, growing quickly or simply unsure whether things are as safe as they have been told. A health check replaces assumptions with evidence. It shows what is genuinely in place rather than what everyone hopes is in place. For many owners, the most valuable part is simply knowing which risks are real and which are not, so money goes where it matters.
It is also useful as a baseline. Even if everything turns out well, having a written snapshot of your environment helps when planning budgets, onboarding a new provider or answering questions from clients and insurers about how you protect their information. Comparing one year's report with the next also shows whether your IT is genuinely improving.
Security settings
Security is usually the largest part. A reviewer checks whether multi-factor sign-in is enforced for every account, whether old accounts are disabled, whether admin rights are limited, and how email is filtered for spam, phishing and spoofing. They look at endpoint protection on each device and whether alerts are being monitored by anyone.
They also check the basics that attackers exploit most often: outdated operating systems, unpatched software, firewalls running old firmware, and remote access tools left open to the internet. The NCSC publishes practical guidance on these essentials, and a health check measures you against similar common-sense controls rather than an abstract standard.
Backups and recovery
Next comes backup. The reviewer confirms what is backed up, how often, where the copies are stored and how long they are kept. Microsoft 365 and Google Workspace data are often assumed to be backed up by the vendor, which is only partly true, so this is a frequent finding.
The most important question is whether a restore has been tested. Backups that have never been restored are a hope, not a plan. A good health check attempts a small test restore, or at least confirms recent successful restores, and estimates how long a full recovery would take if the worst happened.
Devices, network and cloud services
The reviewer lists every computer and server, noting age, warranty status, operating system and whether each is still supported. Machines running an operating system that no longer receives security updates are flagged as a priority. They check the network: firewall, switches, Wi-Fi, cabling and internet connection, including whether there is any backup connection if the main link fails. Printers and other network devices are included, because they are easily forgotten.
Cloud services get the same scrutiny. Microsoft 365 or Google Workspace settings are reviewed for security and sharing, licences are matched against actual staff to spot waste, and the reviewer looks for files shared publicly by accident. Line-of-business apps are listed along with who supports them, so you know who to call when one of them misbehaves and whether that support contract is current.
Documentation and process
A health check also looks at how IT is run, not just the technology. Is there a list of admin accounts and who owns them? Is there a process for new starters and leavers? Is there a written plan for what happens if the office floods or the server dies? Are passwords kept in a password manager or on sticky notes? Does anyone check that departing staff lose access on their last day?
Gaps here are common and cheap to fix compared with technical problems. Writing down the network layout, owning your admin accounts and having a simple leaver checklist make a business noticeably more resilient, and they cost time rather than new equipment. They are often the quickest wins in the whole report.
What you should receive
The output should be a report you can understand without a technical background. Each finding should say what was found, why it matters and what is recommended, ranked by risk. Expect a short list of urgent items, a longer list of improvements and a summary of things that are in good shape.
A useful report includes rough costs or effort for each recommendation so you can plan. It should not be a sales pitch disguised as an audit. If you would like an independent view of where you stand, Office IT offers this kind of review, and the findings are yours to act on with whoever you choose.
In short
- A health check replaces assumptions about your IT with evidence.
- Security, backups, devices, network, cloud and process are the core areas.
- Untested backups and missing multi-factor sign-in are frequent findings.
- Expect a ranked, plain-English report with rough costs for each fix.