Security in a small office rarely collapses in a dramatic moment. It rots, quietly, one ex-employee login and one skipped update at a time. A single annual review - half a day, once a year - is how you catch the rot while it is still cheap to fix.
Every control in this series decays on its own. People join and leave, software ages, the backup drive fills, the router gets replaced and its password becomes the factory default again. The annual review exists to reverse that drift in one deliberate pass: who has access to what, whether the essentials still hold, and what changed in the business that changes the risk. This page gives the checklist form of the review, small enough for a real office to finish, thorough enough to matter. Bring the owner, the person who handles IT, a laptop, and the password manager. That is the whole cast.
Print the current staff list. Then walk system by system - email, server and PCs, accounting, banking, NAS, router, cloud storage, remote access - and write down every account that exists and who it belongs to. Any account whose person has left gets disabled the same day, not noted for later.
Hunt specifically for the ghosts: old admin accounts from a previous IT person, test accounts, the temp from two summers ago, vendor support logins that were never closed. Attackers do not need to break in when a forgotten door is still unlocked and unmonitored.
Walk the core list from this series with fresh eyes and evidence. Is MFA actually on for every mailbox - including the owner and the shared ones? Is any machine months behind on updates? Did the password manager rollout stall at half the office? Are the router and NAS still on unique passwords, or did a replacement quietly reset them?
Finish with the two proofs, not opinions: run a test restore from the backup and open the files, and run the leaver test - pick last year's most senior departure and confirm, system by system, that they can no longer get into anything.
Ask what is different since last year, because new things arrive without security attached. A new branch means new accounts and a new router. New accounting or CRM software means new admin users and new data to back up. Work-from-home growth means the office perimeter now includes home PCs you have never seen.
Also review incidents and near-misses honestly: every phishing click, every scare, every hour of downtime. The review is not about blame - it is about which control gets strengthened this year because reality voted for it.
Close the review by sorting spending into the order this series has used throughout. First confirm the free layers are truly done - updates, firewall, Defender, BitLocker, MFA - because paying for advanced tools on top of missing basics is the classic small-office waste. Then the modest essentials: password manager seats for everyone, a proper offline or off-site backup copy.
Only after those hold should paid endpoint platforms or monitoring services enter the plan, and the review should pick one headline improvement for the year, fund it, and date it. A review that produces twelve intentions produces none; one dated improvement a year compounds into a genuinely secure office.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoFor a small office, half a day is realistic: an hour on the access audit, an hour re-verifying the essentials including the test restore, and an hour on changes and planning. Offices that keep the simple logs from this series - update checks, backup tests, leaver actions - find each review faster than the last.
The owner or a decision-maker who can approve changes, and the person who actually handles IT day to day. Security reviews fail when the findings need a purchase or a policy and nobody in the room can say yes.
The full review is annual, but its actions are not: leavers are removed the day they leave, restores are tested quarterly, and updates are checked monthly. The annual review is the audit that those habits actually happened - not a substitute for them.