January arrives with a natural reset point. Most SMEs do not stop operating over the holidays, but the run-up to Christmas and the period afterwards is when small IT gaps accumulate: accounts left open, updates deferred, old equipment still in circulation, and security settings that drift while everyone is busy elsewhere.

A January IT review does not need to be elaborate. It is about looking at the systems your business depends on — particularly Microsoft 365, your devices, your backups and your access controls — and making sure they have not slipped since the last proper check.

This checklist is written for owner-managed SMEs with roughly 10 to 25 people. It covers the practical areas any managing director can review, even without technical expertise.

What should be on a January IT checklist for SMEs?

A January IT checklist is not about installing new tools or undertaking a major project. It is a structured review of the things you should already have in place, focused on four areas that tend to degrade quietly during quieter months.

1. User accounts and access

The most common source of risk in a small business is not a sophisticated attack. It is stale accounts, shared passwords and permissions that have accumulated over time.

By January, your access list should be current. The checks are straightforward:

• Are there leavers from the autumn or holiday period whose accounts are still active in Microsoft 365 or on any shared systems?

• Do any former employees retain access to email, file shares, cloud storage or admin consoles?

• Are shared or service accounts in use where they should be replaced with named user identities?

• Is multi-factor authentication (MFA) enabled for every account that can access business data?

Microsoft recommends MFA for all user accounts as a baseline control. The NCSC's guidance for small businesses includes the same recommendation: stronger sign-in protection is one of the easiest improvements a business can make.

If you cannot produce a clean list of active accounts within a few minutes, that itself is a signal that access control needs attention.

2. Security updates and patching

Patching does not require complex tools. It requires a rhythm: someone knows what needs updating, the updates are applied within a reasonable window, and failures are visible.

After the festive period, patching often falls behind. Two or three weeks of deferred updates can introduce vulnerabilities that would otherwise have been closed.

Your January patching review should confirm:

• Are all business devices (workstations, servers, network devices) on supported operating systems?

• Are critical and high-security updates applied within your agreed window?

• Are update failures flagged somewhere that someone actually sees them?

• Do you have a plan for any unsupported machines — either replacement or removal from the network?

Unsupported operating systems remain a persistent issue for UK SMEs. The National Cyber Security Centre flags this explicitly: businesses running unsupported software are operating outside recommended practice and accepting elevated risk by default.

3. Backups and recovery confidence

Backups are not one of the official Cyber Essentials controls, but they are part of what makes an SME environment supportable. If data is deleted, corrupted or affected by ransomware, the business needs a reliable route to recovery.

Many SMEs have a backup tool installed. Few test restores with any regularity. A backup that exists but is never verified creates false confidence — and that confidence evaporates when it is needed most.

Your January backup checks should answer:

• What data is actually being backed up?

• When did the last backup run successfully?

• When was the last time a restore was tested?

• Are backup failures or gaps tracked to resolution?

Microsoft 365 retention and recycle-bin features are not a substitute for an independent backup copy. They are platform-level safeguards, not an owned, verifiable recovery point. If your backup data lives inside the same Microsoft 365 tenant, it is reachable by the same credentials and the same threat actor. An independent backup — held outside the tenant — is what makes a backup genuinely resilient.

The NCSC's small-business checklist includes backup and recovery as a fundamental area of attention. The practical question for any SME is whether that backup can actually be used when needed.

4. Device and endpoint management

Every device that connects to your business network is a potential entry point. In 10 to 25 seat businesses, the number of devices in circulation tends to grow faster than the processes meant to manage them.

January is a natural point to check:

• Do you have an up-to-date list of devices on the network?

• Are all devices using supported operating systems?

• Is malware protection active on every in-scope endpoint?

• Are devices built to a standard configuration, or does each laptop differ from the next?

• Are local administrator rights controlled or delegated freely?

Device standardisation — having a known baseline build that every new device follows — is one of the simplest ways to reduce security risk without adding cost.

5. Email security settings

Email is the primary attack surface for most SMEs. Phishing remains the most common initial vector, and weak email authentication makes it easier for attackers to impersonate your business.

By January, you should be able to confirm:

• Is SPF configured for your primary domain?

• Is DKIM enabled?

• Is a DMARC policy in place, or at least monitoring mode, for your domains?

• Are inbox rules on key accounts (finance, sales, management) being reviewed periodically?

Microsoft's own guidance on email security for organisations covers these three settings (SPF, DKIM and DMARC) as essential foundation steps. Without them, anyone can send email that appears to come from your domain.

What about Cyber Essentials?

January is not a Cyber Essentials deadline — but it is a good month to check whether your controls are maintained, not just submitted once a year.

Official Cyber Essentials remains a five-control scheme: firewalls, secure configuration, security update management, user access control and malware protection. For SMEs, the value comes from translating those controls into practical operating habits — knowing who owns each area, how often it is checked and what evidence can be produced when a customer, insurer or supplier asks.

If you hold Cyber Essentials, January is a sensible month to pull together a basic evidence pack:

• A device and asset inventory

• MFA coverage by user group

• An admin role list

• Patch status or recent patching reports

• Malware protection status across endpoints

• A record of backup health and recent restore-test evidence

None of this needs to be complicated. The difference between a business that passes its annual Cyber Essentials renewal without stress and one that scrambles is usually just whether these items were checked at intervals throughout the year.

If you have not yet established your baseline against Cyber Essentials requirements, the starting point is a Security Triage Call, where those gaps are assessed without commitment.

Book a Security Triage Call

How often should SMEs review their IT setup?

A monthly check is the cadence that most 10 to 25 seat SMEs can sustain. It does not need to be a half-day project. It should be a focused review of four or five items that a managing director can verify without technical expertise:

1. Do backups ran successfully in the past month?

2. Are all staff able to access the systems they need, and no one retaining access they no longer need?

3. Are there any unresolved security alerts or patching failures?

4. Do we have a current count of active devices and user accounts?

5. Are there any exceptions or unsupported systems, and do they have ownership and a resolution date?

A quarterly deep-dive should cover areas such as backup testing, disaster recovery readiness and a more thorough review of your Cyber Essentials evidence.

Can an owner managed SME run this checklist themselves?

Yes. This checklist does not require technical qualifications. It requires honesty and a willingness to look at what is actually in place, rather than what should be in place.

If you are comfortable answering all of the checks above, your January review is complete. If several areas raise questions or uncertainties, that is a perfectly reasonable outcome — it simply means you know what needs attention.

The alternative — finding out what is missing because something broke or a customer asked for evidence — is the option most businesses prefer to avoid.

Download the IT Security Baseline Checklist

January IT checklist FAQ

Why is January a good time for an IT review?

January is when owner-managed businesses return to normal operations after the festive period. Small IT gaps — deferred updates, accounts not retired, drift in security settings — accumulate quietly during quieter months. Addressing them early in the year prevents them from becoming larger problems.

How long should a January IT checklist review take?

For a 10 to 25 seat SME, a focused January review should take between 30 minutes and one hour. It is about checking existing controls, not building new systems. If it is taking longer than that, the issue is usually a lack of documentation or prior review, which is exactly why the exercise matters.

Do we need an IT consultant to do this?

No. This checklist is designed for managing directors and business owners to work through with whoever handles day-to-day IT — whether that is an internal team member, a managed service provider or a part-time IT lead. An independent review is valuable if you want to benchmark where you stand, but the checklist itself does not require external support.

What happens if we find gaps during the review?

That is normal. Most SMEs will have at least a few areas that need attention. The approach is to prioritise: address anything affecting active access or data recovery first, then work through patching, device standardisation and email security in sequence. A Security Triage Call is the approved starting point for businesses that want to understand their gaps against a recognised security baseline.

What next?

A January IT checklist is not a project. It is a point of clarity.

If your systems have held up over the festive period and your controls are in place, the year starts with confidence. If there are gaps — which is normal — knowing about them in January gives you time to address them deliberately, rather than reactively.

The next step is either to work through this checklist with your team or book a Security Triage Call to get a clear picture of where your baseline stands. There is no obligation attached. It is simply a structured conversation about where you are and what a proper security baseline would look like for your business.

For SMEs in Sussex and Kent looking for a managed IT partner that treats security as a standard, not an add-on, it is worth reviewing what a proper operating relationship looks like. Infinite Cloud IT's Managed IT Services are structured around maintaining a security-aligned baseline — identity, devices, patches, backups and access control — with clear ownership and monthly reporting.