IT estate audit: the checklist in 8 blocks

A readable picture of what the company owns (hardware, software, accounts and connections), the condition of each item and what is missing to operate without risk. It does not replace a technical vulnerability assessment. It is the basis for deciding where to invest. When the answer is "I don't know", record exactly that: it is valuable information.

• A complete inventory Every workstation, laptop, server, printer, firewall, switch and access point, with location, manufacturer, model and serial number.
• Age As a rule of thumb, workstations and laptops over 5 years old and servers over 6 go into planned replacement, not emergency repair.
• Warranties What the manufacturer covers and when it ends.
• Ghosts The equipment that physically exists and appears on no list. There is always some.

• Operating systems The version on every workstation and server. Windows 10 stopped receiving standard security updates in October 2025; what to do is in Windows 10 without support: options for businesses.
• Servers Windows Server 2012 or earlier is already unsupported; 2016 loses support in January 2027.
• Licences Microsoft 365, antivirus, ERP and others: total, assigned and those paid for that nobody uses.
• Self-installed software Remote access, personal cloud file storage, online converters installed without authorisation.

• Scope Servers, workstations, mailboxes and files in the Microsoft cloud, and the ERP database.
• Frequency, destination and versions A single copy in the same building is as good as none.
• Last successful restore If there has never been one, this is point number one.
• Alerts Who is notified of a failed backup, and whether that warning is read.

Weak answers in this block? Start here, with managed backups and tested restores.

• Active users Domain and Microsoft 365 accounts cross-checked against current staff. Every discrepancy is an account to disable today.
• Administrators On workstations, servers and Microsoft 365. Few and identified.
• MFA Active on every account with email and files, administration included, no exceptions.
• Shared accounts "reception", "shop": who knows those passwords?
• Third parties Which suppliers access the network, with which credentials, and whether that access is still justified.

• Diagram Even hand-drawn: rack, switches, internet entry point, Wi-Fi coverage.
• Rack Organised and labelled, or a tangle nobody touches? That dictates how long every fault lasts.
• Segmentation Guests isolated from the internal network; servers, cameras and card terminals on their own segments.
• Internet Operator, speed, whether there is a backup link and how many hours the business can last without it.

• Firewall Model, update status, who manages it and the date of the last rule review.
• Endpoints The product used, whether it is on every device, who receives the alerts.
• Email Filtering of phishing and tampered invoices, the most frequent fraud in Portuguese companies.
• Incident plan If ransomware encrypts a workstation at 9am on a Monday, who does what in the first half hour?

To go deeper, use the cybersecurity checklist for SMEs in Portugal.

• Admin credentials For the ISP router, servers, switches and firewall: stored securely and known to more than one person.
• Contracts Internet, licences, support: terms, lock-ins, inclusions and exclusions.
• External supplier Is there a written SLA? And what if that company closed its doors tomorrow? See the SLA you should demand from an IT partner.

• Point of contact Who handles IT internally, and who stands in during holidays.
• Awareness Date of the last phishing training. "Never" means this is the cheapest and most profitable investment on the list.
• Joiners and leavers Creating and disabling accounts, collecting equipment, revoking access.

Split them into three groups:

1. Downtime risk: backups never tested, an unsupported server, a single internet link.
2. Attack risk: no MFA, former employees' accounts still active, a firewall nobody manages.
3. Cost with no return: surplus licences, equipment being repaired when it should be replaced.

Groups 1 and 2 can be closed within weeks; the savings from group 3 pay for the rest. If you want the survey done with us, this is what our IT consultancy for businesses delivers: first the visit, then the written report with priorities and only at the end, if it makes sense, a proposal.

We come to your company, go through the list side by side with you and leave the risks and the order of resolution in writing, with no commitment. Learn more about DataRoad's IT audit and consultancy.

More than 10 workstations · support contract · remote, on-site and telephone support. +351 211 459 950 * · sales@dataroad.pt

*Call to a Portuguese landline.