A Bradenton accounting firm lost $43,000 last year because a backup hadn’t run in six weeks. Nobody checked. Nobody noticed — until ransomware encrypted every client file on a Friday afternoon. The backup they were counting on? Empty. Six weeks of dead air.
That’s not a freak accident. It’s what happens when nobody looks under the hood. And it’s fixable — with 30 minutes a month and a simple checklist.
Why 30 Minutes a Month Is Worth More Than You Think
Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches started with attackers exploiting software that hadn’t been patched. That makes unpatched software the number one way attackers get in — ahead of stolen passwords.
Even worse, the median time to fix a known vulnerability has climbed to 43 days. That’s 43 days where the front door is unlocked and labeled “come on in.”
Most of these aren’t sophisticated attacks. They’re opportunistic. An attacker scans for a known hole, finds yours, and walks in. A monthly check catches the holes before they do.
Your 6-Point Monthly IT Checklist
Set a recurring 30-minute calendar block. Assign it to one person by name. Run through these six items every single month.
1. Check for Updates on Every Machine
Open each computer and verify the operating system and core software are current. On Windows: Settings → Update & Security → Check for Updates. On Mac: System Settings → Software Update.
If an update is stuck, restart and try again. These patches close the exact security holes attackers are scanning for right now.
2. Verify Your Backups Actually Work
Log into your backup system and confirm it’s been running. Look for recent dates and successful results. Then do the real test: try restoring a single file.
If you can’t open a recent backup or restore a file, your backup is a mirage. It won’t save you when it matters.
3. Remove Old User Accounts
Open your Microsoft 365 admin panel (or equivalent) and review the full user list. If someone no longer works with you, disable or remove their account immediately.
Old accounts are one of the easiest ways attackers get in. A leaked password from a former employee’s account gives them a quiet backdoor nobody is watching. While you’re there, confirm every active account has multi-factor authentication turned on.
4. Review Suspicious Logins
In Microsoft 365, check sign-in logs at entra.microsoft.com. Look for logins from unfamiliar locations, odd hours, or unknown devices. Google Workspace shows similar data in Admin Console → Reporting → User Log Events.
If anything looks off, change that account’s password and enable MFA if it isn’t already on. Don’t wait. Don’t “keep an eye on it.”
5. Check Email Forwarding Rules
Here’s something most Tampa Bay business owners don’t know: after an attacker compromises an email account, one of the first things they do is set up a hidden forwarding rule. Every email you send and receive gets copied to an address they control — and you never notice.
Check each user’s mailbox rules in Outlook or Microsoft 365. In Google Workspace, check Routing rules in Admin Console and Filters in each user’s Gmail settings. Remove anything you didn’t set up.
6. Do a Quick Physical Walkthrough
Walk around your office. Unlocked laptops on desks? USB drives lying in the open? A password on a sticky note? An unfamiliar device plugged into a wall jack?
If someone walked in from the street, what could they see, grab, or plug in? Fix it now.
The Checklist Only Works If You Actually Use It
Put the 30-minute block on the calendar for the same day every month. Assign it to one person — not “the team,” one person with their name on it. Use a simple spreadsheet to track what you checked and what you found.
If the same problem keeps showing up — backups failing silently, updates stuck for weeks — that’s a sign you need a longer-term fix, not just a monthly glance.
This Isn’t a Substitute for Professional IT Support
This checklist catches the obvious stuff. It won’t catch advanced threats, misconfigured firewalls, or the kind of slow-burn compromise that takes months to detect. That’s what a managed security partner handles — monitoring your network around the clock, keeping machines patched automatically, and responding to threats before they become incidents.
What this check does is make sure nothing obvious slips through the cracks between professional reviews. Think of it like checking your tire pressure between oil changes — it doesn’t replace the mechanic, but it keeps you from a blowout on I-75.
Your Business Is Too Important to Leave Unchecked
If you ran through this list and found things that worried you — or if you realized you’ve never checked any of this — it might be time to talk to someone who does this every day for accounting firms, law firms, and financial advisors across Manatee County.
Book a free 15-minute risk assessment with Justin and Sara at Reef Cyber Security.
Or call us at (941) 243-1718.
