10 questions about your company’s systems
Check only what you can confirm with a test or document. Leave unknown answers unchecked: they need clarification, rather than proving a fault. This checklist prepares a support conversation; it does not replace a technical review.
Recovery has been tested
A backup file alone does not prove that working data can be recovered.
Is there a dated restore test confirming that the required data and service work?
Backups are protected separately
Another folder or cloud storage alone does not prevent deletion through a compromised account.
Is there an off-site copy protected from changes or deletion through the production environment?
Critical systems are identified
CRM, accounting, email and files may run on servers or cloud services. Dependencies and recovery order matter.
Are system owners, acceptable downtime and acceptable loss of recent data documented?
Accounts and permissions are separated
Shared passwords make actions harder to trace. Access should match each employee’s role.
Are individual accounts, secure password storage and multifactor authentication used for important access?
Access is reviewed
Permissions change when people leave, change roles or finish a contract.
Is there a current access list and someone responsible for timely revocation?
Network and remote access are restricted
Guest devices should not have unrestricted access to business systems. Having a VPN alone does not establish protection.
Have network separation, remote entry points and administrative access restrictions been reviewed?
Updates follow a plan
Know which versions are supported and verify the system after changes.
Are update owners, timelines and a rollback method defined?
Data exchange is checked
A request, payment or stock movement may fail to reach another system or arrive twice.
Are transfer results reconciled, errors tracked and an owner assigned to investigate?
Someone responds to alerts
Alerts are useful when they reach someone who knows what to do.
Are recipients, response hours and actions for service or backup failures defined?
Documentation supports continuity
System diagrams, supplier contacts and recovery steps should be available to an authorised specialist.
Could another specialist find instructions and obtain access without sharing passwords in plain text?
The number of ticks is not a security rating. Review each unconfirmed item; even 10 out of 10 does not rule out risks.
Discuss the results