February is when the practical pressure of 6 April arrives. Not the panic — the preparation. For most UK SMEs, this is the last full month before the tax year changes, and it is the point at which IT preparation separates a smooth year-end audit from a scramble for evidence that should have been there all along.

This checklist is written for owner-managed businesses with roughly 10 to 25 people. It covers what to verify in your IT systems during February so that when April arrives — and your accountant, insurer or a prospective client asks for proof — you have it ready.

Why does February matter for tax year-end IT preparation?

Because the tax year does not give you time to build controls from scratch. By 6 April, evidence must already exist. Any business that waits until March or April to check whether its systems can produce reliable evidence — device inventories, patch records, access logs, backup verification — will find itself responding under time pressure.

February gives you enough time to notice a gap, triage it, and either fix it or document a reasonable alternative. That is the difference between running an audit and surviving one.

What should be on a February IT checklist for tax year preparation?

1. Evidence readiness for year-end audits

Accountants do not need perfect IT — they need evidence that you understand what you run and can produce it when asked. A basic year-end evidence pack usually includes:

• A current device and asset inventory (who owns what, where it sits, which OS it runs)

• A list of active user accounts with their roles, especially admin access

• Patch and update status showing that systems are kept current

• Evidence that backups exist and have been tested

This is not a Cyber Essentials assessment. It is a practical check that you can answer three questions clearly: what do we run, who has access to it, and can we recover from failure?

If you rely on memory or tribal knowledge rather than documented records, your accountants will notice. That does not mean you are doing badly — it means you have not made it easy for yourself.

2. User access and leaver management

The most common reason SMEs struggle with evidence production is not a broken system. It is a messy access list.

By February, you should be able to confirm:

• Every leaver from the past six months has had their Microsoft 365 and shared system accounts disabled

• No former employee retains access to email, file shares, cloud storage or admin consoles

• Shared or service accounts are identified and reviewed — they are not permanent workarounds

• Multi-factor authentication (MFA) is active for every account with access to business data

The National Cyber Security Centre includes stronger sign-in protection — MFA, access reviews, removal of stale accounts — as fundamental controls for small businesses. These are not optional extras; they are part of what any reasonable auditor will expect to see.

If you cannot produce a clean list of active accounts within a few minutes, you already know that access control needs attention.

3. Backup health and restore testing

Backups are not one of the five official Cyber Essentials controls. They are, however, one of the first things any insurer or prospective client will ask about, and they are the difference between a recoverable incident and a fatal one.

Most SMEs have a backup tool installed. Far fewer test restores. A backup that exists but has never been verified gives a false sense of security — and that security evaporates the moment you need it.

Your February backup checks should answer:

• What data is actually being backed up? (Microsoft 365 mailbox data, SharePoint, OneDrive, local files — or just a subset?)

• When did the last backup run complete successfully?

• When was the last time a restore was tested?

• Are backup failures or gaps tracked to resolution?

Microsoft 365 retention features and recycle-bin tools are platform-level safeguards, not a substitute for an independent backup copy. If your backup data lives inside the same Microsoft 365 tenant, it is reachable by the same credentials and the same threat actor. An independent backup — held outside the tenant — is what makes recovery genuinely resilient.

The NCSC's small-business checklist includes backup and recovery as a fundamental area. The practical question for any SME is whether that backup can actually be used when needed.

4. Patching status and unsupported devices

Patching does not require expensive tools. It requires a rhythm: someone knows what needs updating, updates are applied within a reasonable window, and failures are visible.

Around February, you should be able to confirm:

• All business devices are on supported operating systems

• Critical and high-security updates have been applied consistently

• Update failures are flagged and actioned

• Unsupported machines have a documented replacement or decommissioning plan

Unsupported operating systems remain a persistent issue for UK SMEs. The NCSC flags this clearly: businesses running unsupported software are operating outside recommended practice and accepting elevated risk by default. Before 6 April, this is not just a security question. It is a question your insurer and your accountants will want answered.

5. Email security authentication

Email is the primary attack surface for most SMEs. Phishing is the most common initial attack vector. Weak email authentication allows anyone to send messages that appear to come from your domain.

Before the tax year changes, confirm:

• SPF is configured for your primary domain

• DKIM is enabled

• DMARC is in place, at least in monitoring mode

• Inbox rules on key accounts (finance, senior management) are reviewed periodically

Microsoft's own guidance on email security for organisations treats SPF, DKIM and DMARC as essential foundation steps. Without them, anyone can impersonate your business in email.

6. Making Tax Digital readiness

Making Tax Digital for Income Tax Self Assessment (MTD for ITSA) is rolling out in phases. From 6 April 2026, businesses and sole traders with income above £50,000 must use MTD-compatible software. The threshold drops to £30,000 from April 2027, then £20,000 from April 2028.

If your business falls into scope, February is the month to check:

• Are you already using MTD-compatible accounting software?

• If not, is there enough time to switch and understand the new record-keeping requirements before the deadline?

• Do your digital records meet the basic requirements set by HMRC for MTD compliance?

This is not just about your accountant. It is about your day-to-day IT systems and whether they can produce the digital records HMRC expects. Making the switch in February gives you the buffer to resolve questions before your first MTD quarterly submission.

How does this relate to Cyber Essentials?

February is not a Cyber Essentials deadline. But it is a sensible month to check whether your controls are maintained throughout the year rather than prepared once a year for an assessment.

Official Cyber Essentials remains a five-control scheme: firewalls, secure configuration, security update management, user access control and malware protection. For SMEs, the value comes from translating those five controls into practical operating habits — knowing who owns each area, how often it is checked and what evidence can be produced when a customer, insurer or supplier asks.

If you hold Cyber Essentials, February is a good month to pull together a basic evidence pack. If you have not yet established your baseline against Cyber Essentials requirements, the starting point is a Security Triage Call, where those gaps are assessed without commitment.

Book a Security Triage Call

What is the difference between a February IT review and a January review?

January is about resetting after the holidays. February is about preparing for the tax year change. The focus shifts from general housekeeping to evidence, compliance and year-end readiness.

A January review might check whether holiday-period updates were applied and whether new equipment from the autumn has been properly onboarded. A February review checks whether you can actually produce the evidence an auditor, insurer or prospective client would ask for. It is more specific, more compliance-focused and directly tied to the 6 April deadline.

If you did a January review and followed through on what you found, a February review takes roughly half the time. If you skipped January entirely, treat February as your reset point.

Can an owner-managed SME run this checklist themselves?

Yes. This checklist does not require technical qualifications. It requires honesty and a willingness to look at what is actually in place, rather than what should be in place.

If you are comfortable answering the checks above, your February review is complete. If several areas raise questions or uncertainties, that is a perfectly reasonable outcome — it simply means you know what needs attention before April arrives.

The alternative — finding out what is missing because something broke, an insurer refused a claim or a customer asked for evidence you could not produce — is the option most businesses prefer to avoid.

Download the IT Security Baseline Checklist

February IT checklist FAQ

Why is February different from January for an IT checklist?

January is a post-holiday reset. February is preparation for the 6 April tax year change. The February checklist focuses on evidence, compliance readiness and year-end documentation — what you can actually produce when your accountant, insurer or a prospective client asks. January checks whether systems survived the festive period. February checks whether they will survive scrutiny.

How long does a February IT review take for a small business?

For a 10 to 25 seat SME, a focused February review should take between 45 minutes and 90 minutes. It is longer than a standard monthly check because it includes evidence gathering and compliance considerations. If it is taking much longer than that, the issue is usually a lack of existing documentation, which is exactly why the exercise matters.

Does this checklist replace a Security Triage Call?

No. This checklist is a self-service review. A Security Triage Call is a structured conversation with Infinite Cloud IT to understand where your baseline stands against a recognised security framework. Use the checklist to identify what needs attention. Use the Triage Call to get a professional assessment of those gaps.

What happens if we find gaps during the February review?

That is normal. Most SMEs will have at least a few areas that need attention. Prioritise active access issues and data recovery first, then work through patching, device standardisation and email security. A Security Triage Call is the approved starting point for businesses that want to understand their gaps against a recognised security baseline and get a clear plan to address them.

What next?

February gives you time. Use it.

Run through this checklist with whoever handles day-to-day IT in your business. Make a list of what checks out and what does not. Address access and recovery issues first, then work through the rest in sequence.

If you want an independent assessment of where your baseline stands before 6 April, book a Security Triage Call. It is a structured conversation about where you are, what gaps exist and what a proper IT Security Baseline would look like for your business. There is no obligation attached.

For SMEs in Sussex and Kent looking for a managed IT partner that treats security as a standard, not an add-on, it is worth reviewing what a proper operating relationship looks like. Infinite Cloud IT's Managed IT Services are structured around maintaining a security-aligned baseline — identity, devices, patches, backups and access control — with clear ownership and monthly reporting.