IT checklist 2026: would your company survive an outage, an attack and the arrival of AI?

1. Key data and databases (e.g. ERP) are backed up automatically at least once a day.

2. At least one copy is stored off site and cannot be deleted from the company network.

3. In the last 6 months someone restored data from backup and recorded the result.

4. You know how many hours the company can work without its server, and there is a written recovery plan.

5. E-mail, Microsoft 365 and remote access require multi-factor authentication (MFA).

6. Accounts of former employees are disabled on their last day.

7. Staff don't work day to day with administrator rights.

8. Admin passwords are kept in a password manager, not a notebook or spreadsheet.

9. Systems and software update automatically, and no Windows version without vendor support is in use.

10. Computers and servers have EDR protection with a central console that someone reviews regularly.

11. The firewall is up to date and the guest network is separated from the company network.

12. Laptop disks are encrypted (e.g. BitLocker).

13. Staff have had phishing awareness training in the last year.

14. The company knows whether NIS2 applies to it and what its deadlines are.

15. It is clear who reports an incident and how, including within 24 hours.

16. There is current documentation of hardware, licences, passwords and configurations.

17. The company has written rules on what data may be entered into AI tools.

18. Staff have been trained in using AI.

19. You know which repetitive tasks take your team the most hours each month.

20. Data for management reports is collected automatically, not by hand in Excel.