The last week of August is when SMEs find out whether their IT survived the summer. Systems that felt fine in July can look very different when everyone returns to the office on Monday morning. This checklist covers the concrete items you need to complete before the new term — not theory, not strategy, just the tasks that keep you from scrambling.

1. Test Your Backups With a Real Restore

Backups are not a checkbox exercise. If you haven't actually restored data from them in the last six months, they are a guess.

What to do:

• Pick one file server, one mailbox, and one critical application database.

• Restore each to a test location. Verify the data is readable and complete.

• Record how long each restore took. If it takes more than a few hours for your critical data, you need to talk to your IT provider about your recovery time objectives.

Why it matters now: September is when people need data most — after a summer of fragmented work, someone will inevitably ask for a file that was overwritten in July. If your backup fails on day one of the new term, you are no longer planning; you are reacting.

Scheme requirement vs good practice: Backups themselves are not a Cyber Essentials requirement, but testing them is good practice that insurers increasingly expect. Infinite Cloud IT standard: we test restores quarterly for every client.

2. Review User Access and Remove Leavers

Summer leave is the perfect time for someone to disappear without telling anyone. When people return in September, you need to know exactly who has access to what — and who doesn't.

What to do:

• Compare your current user list against HR records. Flag anyone who has left, changed roles, or moved to part-time.

• Remove access for leavers immediately. This includes email, file shares, cloud applications, and physical keys.

• Check for shared or generic accounts (admin@, info@, reception@). Assign them to named individuals.

Why it matters now: A former employee retaining access is one of the most common causes of data breaches in small businesses. September is when you notice that a contractor who finished in June still has access to your customer database.

Scheme requirement vs good practice: Cyber Essentials requires that you manage user access appropriately, but it does not prescribe a review schedule. Good practice: review quarterly or whenever someone joins, leaves, or changes role.

3. Verify Patch Compliance Across All Devices

Patch Tuesday happened in July. It happened in August. If your devices aren't patching automatically, they are vulnerable — and the gap widens every week. Without a consistent approach to your IT environment, patch management becomes guesswork rather than control — see how we bring standardisation to Sussex SMEs.

What to do:

• Check that every Windows PC, Mac, server, and network device is set to update automatically.

• Verify that third-party applications (browsers, Office, PDF readers, Java) are updated. These are often the weakest link.

• Confirm that your firewall and router firmware are current. Many SMEs never check this.

Why it matters now: Attackers do not wait for September. But when everyone is back in the office, the volume of connected devices increases — laptops on Wi-Fi, phones on guest networks, printers coming back online. That is when unpatched systems attract attention.

Scheme requirement vs good practice: Cyber Essentials requires that you use anti-malware and ensure system patching is up to date. This is not optional. If you are manually updating each machine, you are below the standard.

4. Check Your Cyber Essentials Renewal Timing

Cyber Essentials certification lasts 12 months from the date of your last successful assessment. If your certificate expires in September or October, you are running on borrowed time — and your insurance may not cover you the day it lapses. If you're unsure when your certification expires or what renewal involves, our Cyber Essentials guide covers the essentials.

What to do:

• Find your current Cyber Essentials certificate and note the expiry date.

• If it expires within the next three months, contact your certification body now. Assessment slots fill quickly in Q3 and Q4.

• If you have not yet achieved Cyber Essentials, treat this as your deadline to start the process. It is the baseline expectation from most government contracts and many commercial clients.

Why it matters now: Many procurement processes open in September. If you are bidding for work and your Cyber Essentials certificate is expired or about to expire, you will be disqualified before your proposal is even read.

Scheme requirement vs good practice: Cyber Essentials itself is not legally required, but it has become a standard requirement in public sector supply chains and increasingly in private sector tenders. Infinite Cloud IT standard: we track every client's certification expiry date and initiate renewal four months before it lapses.

5. Verify Email Security Records Are Correct

DMARC, SPF, and DKIM records control who can send email on behalf of your domain. If they are misconfigured, your messages go to spam — or worse, attackers send phishing emails that appear to come from you.

What to do:

• Check that your SPF record lists all authorised sending sources (your email platform, marketing tools, CRM).

• Verify your DKIM signatures are active for your domain.

• Confirm your DMARC policy is set to at least p=quarantine (preferably p=reject).

• Test by sending an email to yourself through a free tool like MXToolbox's DMARC analyzer.

Why it matters now: September is a peak month for phishing campaigns targeting back-to-school organisations. If your DMARC is not configured, attackers can spoof your domain with no friction.

Scheme requirement vs good practice: Cyber Essentials requires that you protect email against malware and phishing, but it does not mandate DMARC. Good practice: set DMARC to p=reject for your primary domain.

6. Confirm Your Insurance Is Not Running on a Lapsed Certificate

Many SMEs' cyber insurance policies reference Cyber Essentials certification as a condition of cover. If your certificate has expired, your insurer may refuse a claim — regardless of whether the incident is related to patching or access control.

What to do:

• Read your cyber insurance policy wording. Look for any reference to Cyber Essentials, ISO 27001, or equivalent certification.

• If your certificate has expired, start the renewal process immediately. Do not wait until you have an incident to discover the gap.

• Ask your insurer whether they require Cyber Essentials Plus for your level of cover. Many do.

Why it matters now: An incident in early September with a lapsed certificate is the worst possible combination. You lose data and insurance cover simultaneously.

7. Prepare Your IT Support Contact for the Return

When everyone returns after summer, your IT provider should already know what to expect. You do not want to be the person calling on Monday morning to say "nothing works" — you want them to have already checked that nothing will break.

What to do:

• Confirm your support contract is active and you have the correct emergency contact number.

• If you have seasonal staff or temporary workers starting in September, let your IT provider know so they can prepare accounts and access in advance.

• Make sure your IT provider has up-to-date contact details for the decision-makers who can authorise urgent work.

Why it matters now: A well-prepared IT support relationship means your provider can respond faster when the September rush hits. A poorly prepared one means you spend your first week on hold.

Checklist Summary: What Needs Doing Before Day One

Why September Is Different From Any Other Month

September is not just another month for IT. It is the moment when fragmented summer work collides with a full roster of active users, seasonal staff, and procurement deadlines. The gap between what your IT looked like in July and what it needs to be in September is where most SMEs get caught.

This checklist is not about building a strategy. It is about making sure the systems you already have actually work when everyone returns.

Need Help With Your Pre-September IT Check?

If you would like a second pair of eyes on your preparations, our Security Triage Call is a free, no-obligation conversation where we walk through your current setup and identify the gaps that matter most. No sales pitch — just a clear picture of where you stand.

Book your Security Triage Call

And if your backup and disaster recovery arrangements need attention before the new term, learn about our Backup & Business Continuity service.

Frequently Asked Questions

How long does a pre-September IT check take? Most of the items on this checklist can be completed in a single working day — roughly 6–8 hours depending on the size of your organisation. Some items, like testing backups with real restores, may take longer if you have substantial data volumes.

Can we do this checklist ourselves or do we need an IT provider? You can work through it yourself if you have the technical confidence. However, if you are unsure about patch management, DMARC configuration, or whether your backup tests were successful, an experienced provider will save you time and reduce the risk of missing something critical.

Is Cyber Essentials required for all SMEs? Cyber Essentials is not a legal requirement, but it has become a standard expectation in many sectors. Government contracts require it. Many commercial clients and insurers require it. If you are unsure whether you need it, the answer is probably yes.

What happens if we miss one of these items? Missing a single item does not mean disaster — but missing several creates compounding risk. The most common consequence is scrambling in October when problems surface that could have been prevented in August.

This article is for general information and does not constitute advice. IT requirements vary between organisations. If you need guidance specific to your setup, speak to a qualified professional.