September is when the summer noise stops and every SME with employees discovers whether their IT survived the two-month lull. Systems that felt acceptable in July can look very different once people are back at their desks and the holiday backlog hits.

This is not a pre-September checklist. You already know what to do before the break. Article 100 is about the first five working days back — the actions that determine whether September runs smoothly or spirals into emergency IT calls.

What actually breaks when everyone returns?

The pattern is predictable across 10–25 seat businesses. Someone starts a new role with no device waiting. A former employee still has access to shared drives. Software licences purchased in July go unassigned. The week-one IT queue looks nothing like the August inbox, and the people who thought they had time to catch up find out otherwise on day one.

1. Run your joiner, mover and leaver processes

This is the single highest-impact activity in week one. The process should be mechanical, not cultural — anyone leaving or joining should trigger the same checklist regardless of who manages it.

Joiners:

• Device provisioned before day one, not on it

• Email and cloud accounts created and handed over in a single session

• Access to the tools they actually need, not everything available in your tenant

Movers:

• Role changes reflected in access rights within 24 hours

• Shared drive permissions reviewed when someone moves between departments

Leavers:

• Accounts disabled on the day of departure, not the following week

• Devices collected and wiped before any notice period expires

• Licences returned to the pool so they are not paying for someone who no longer exists

If your joiner/mover/leaver process lives in someone's head rather than a checklist, week one is the time to fix that. The cost of a leaver retaining access is not theoretical — it is one of the most common causes of SME data incidents.

2. Audit device provisioning and network access

Every laptop, phone and tablet that returned from summer storage needs a basic health check before it touches live systems. This is not a deep technical audit. It is a three-point verification:

1. Does the device have the latest security patches installed?

2. Is it enrolled in your endpoint management platform?

3. Has its certificate renewed since August?

Devices left idle over the summer miss automatic updates, their certificates expire, and they refuse to connect to Wi-Fi on the first day back. A quick patch-and-sync pass saves hours of troubleshooting.

Your modern workplace baseline should cover this. If you do not have a standardised device build that defines what a properly configured laptop looks like, you will spend every September fixing ad-hoc setups.

3. Review shared access and permissions

Summer is when permission creep becomes a problem. People leave, folders stay shared, contractors retain access they no longer need, and the old "just give them edit access" habit compounds across months of reduced oversight.

Week one is the review point:

• Walk through shared drives and identify folders with access lists longer than five people

• Check whether former employees still appear in any permission groups

• Verify that cloud collaboration links are set to "specific people" rather than "anyone with the link"

This is not a one-off exercise. It should be part of your standard operating rhythm, but September makes it visible because the backlog of changes is fresh.

4. Verify your backup and business continuity posture

Backups tested before August are backups that may have changed since. Storage accounts rotate, credentials expire, and cloud backup providers change their API versions without warning.

Test one restore this week — not from the automated dashboard, but by actually recovering a file and confirming it opens correctly. If your backup strategy has not been tested in the last 90 days, you are operating on trust rather than evidence.

Your backup and business continuity plan should specify who runs the restore test, how often, and what success looks like. If it does not, September is the month to write it down.

5. Check your Cyber Essentials baseline

If you hold Cyber Essentials certification, August is long enough for your security posture to drift from what you declared during your last assessment. New devices on the network, unpatched endpoints, and changed access controls can all move you away from your certified baseline.

A quick verification against your CE requirements — password policies, firewall configuration, malware protection coverage and patch management status — takes under an hour and gives you confidence heading into Q4. If you have not certified yet, understanding where you sit against the CE baseline is a sensible starting point before any year-end audit cycle begins.

6. Set your Q4 IT priorities

September is when Q4 planning crystallises. The question is not what broke in week one — it is what you need to prepare for before the year end.

Typical priorities at this point:

• Budget confirmation for the coming financial year

• Vendor contract reviews (cloud licences, support renewals)

• Timeline alignment to customer requirements

• Staff training schedules for the autumn months

If you do not have a predictable IT model that turns these priorities into a clear action plan, you will react to them as they arrive rather than sequence them. That is the difference between controlled IT management and fire-fighting.

When to call for help

Most first-week-back issues are manageable in-house if you have a process. They become expensive when they are not. Call your IT provider or bring in external support if:

• You cannot locate a list of who currently has access to critical systems

• Your backup restore test fails or produces corrupted data

• Devices are refusing to connect to the network and you have no endpoint management tool

• A leaver's account is still active and you cannot locate the person who last managed it

You do not need an emergency to justify a conversation with your IT provider. A structured review of your first-week-back status is often more valuable than waiting for something to break.

The September IT launch checklist

If you want a single reference point for week one, here is the summary:

• Joiner devices provisioned before day one

• Leaver accounts disabled and devices collected

• Shared drive permissions audited

• One backup restore test completed and verified

• Cyber Essentials baseline checked against current state

• Q4 IT priorities documented and sequenced

Next steps

If your first week back looks uncertain, the most efficient next step is a structured assessment of where you actually stand — not what you hope your systems are doing.

Book a Security Triage Call to get clarity on your current IT posture and a clear action plan for the months ahead.

Alternatively, review our Managed IT Support Standard to understand what a predictable, standards-aligned approach looks like for businesses your size.