IT Maintenance Checklist for Small Businesses (Weekly, Monthly, Yearly)

What should an IT maintenance checklist include for a small business? The short answer is 20 tasks, split across weekly, monthly and yearly routines. Most take minutes. Skipping them is how small problems turn into outages, lost files and security incidents.

This guide gives you the full checklist, explains who should own it, and covers the mistakes that quietly undo good maintenance.

Key Takeaways

• The checklist has 20 tasks. Five are weekly, seven are monthly and eight are yearly.
• Weekly tasks are quick checks. They cover backups, security alerts, pending updates, sign-ins and device health.
• Monthly tasks keep systems current. They cover patching, account clean-up, restore tests, firmware, licences, storage and Secure Score.
• Yearly tasks are about planning. They include a full recovery test, hardware and end-of-support reviews, access and policy reviews, and the IT budget.
• Some dates are close. Windows 10 reached end of support on 14 October 2025, and Windows Server 2016 extended support ends on 12 January 2027.
• Someone must own it. Without a named owner, maintenance is the first thing skipped when the business gets busy.

Quick Answer

An IT maintenance checklist is a recurring list of checks that keeps business technology secure, updated and recoverable. For a small business, it should cover backups, security updates, user accounts, devices, networks, licences, planning, and any supporting facilities where relevant.

Run quick checks weekly, patching and account reviews monthly, and full recovery tests and hardware reviews yearly. Many Brisbane SMBs hand the routine to a managed IT provider so it happens on schedule.

What Is IT Maintenance, and Why Does It Matter?

IT maintenance is the routine work that keeps your systems secure, current and recoverable, but it is also a repeatable process for maintaining the technology and infrastructure your business depends on.

It covers updates, backups, monitoring, account management and the planned replacement of ageing equipment across your wider infrastructure and related components, with the goal of keeping business operations running smoothly. Done well, nobody notices it. Done badly, everybody notices the outage.

Preventive Maintenance vs Reactive Maintenance

Preventive maintenance is scheduled. A preventive maintenance checklist turns recurring work into a defined maintenance task with a set frequency. You check backups before you need them, install updates before attackers exploit the gap and replace a failing drive before it dies. Reactive maintenance starts after something breaks.

Reactive work usually costs more because the problem arrives with downtime attached. Staff cannot work, customers wait and the fix happens under pressure. Following a maintenance schedule moves the same work to a calm Tuesday morning.

What Neglected IT Costs a Small Business

The cost shows up in two places. The first is lost working time, which our guide to IT downtime cost for Brisbane small businesses breaks down in detail. Routine maintenance also helps businesses save money by catching small issues early before they turn into bigger failures.

The second is security. The Australian Signals Directorate’s Annual Cyber Threat Report 2024-25 found that Australian small businesses paid an average of AU$56,600 per self-reported cybercrime report, up 14% on the year before.

Neglected maintenance can also lead to costly downtime and higher repair costs when preventable issues are left to escalate. Unpatched software, untested backups and unmanaged accounts are the kinds of gaps routine maintenance is designed to close, while also helping support relevant safety standards.

IT Maintenance Checklist and Maintenance Schedule: Weekly, Monthly and Yearly Tasks

Use the 20 tasks below as a reusable IT maintenance checklist template and maintenance plan. Copy it into a shared document or ticketing tool, give each task an owner, set a frequency, and include enough detail to track maintenance activities over time. The tasks are numbered 1 to 20 so you can track them easily.

Weekly IT Maintenance Checklist (5 Tasks)

Weekly checks are quick. Their job is to catch problems before your staff do.

• 1. Check that backups ran. Confirm every backup job completed, and investigate any failure the same day. A backup that has been failing for three weeks is not a backup. If you are still choosing a service, see our guide to cloud backup and disaster recovery solutions.
• 2. Review security alerts. Check your endpoint protection and email security consoles for detections, quarantined items and devices that have stopped reporting. A device that has gone quiet may be unprotected.
• 3. Look for urgent updates. Some security fixes cannot wait for the monthly cycle. Check for critical updates, and for devices that are waiting on a restart to finish installing.
• 4. Review sign-in and admin alerts. Look for repeated failed sign-ins, logins from unexpected countries, new administrator accounts and changes to security settings. Confirm that multi-factor authentication is still enforced for everyone.
• 5. Check device and server health. Look for low disk space, offline devices, failing drives, error reports from servers or network equipment, and unusual CPU or RAM usage that may affect server performance. Include a visible hardware check for dust buildup and signs of overheating. If one person’s computer is running slowly, our guide on how to clean up your computer covers the basics.

Monthly IT Maintenance Checklist (7 Tasks)

Monthly tasks keep your systems current and tidy. Microsoft releases security updates every month, so it helps to schedule these tasks around that cycle.

• 6. Patch the operating system and applications. Install the month’s security updates on workstations, servers and network devices, then check that they actually applied; these software updates improve security and stability. The Australian Signals Directorate counts patching applications and patching operating systems as two of the Essential Eight mitigation strategies, with the tightest deadlines for internet-facing systems and critical vulnerabilities. Our guide to patch management for SMBs explains how to automate it.
• 7. Review user accounts. Disable accounts for people who have left, set up new starters correctly and remove accounts nobody uses. Check shared mailboxes and any account with administrator rights.
• 8. Test a restore. Restore a few files or one mailbox from backup and confirm they open. It is a small test, and it proves the backup works before you need it.
• 9. Update firmware and check network equipment. Look for firmware updates and error logs on firewalls, switches, Wi-Fi access points and routers. Network equipment is easy to forget because it works until it suddenly does not.
• 10. Review licences and storage. Check that your licences match your active users, cancel subscriptions nobody uses and look at storage trends on servers and in the cloud. Monitoring storage capacity helps prevent performance issues when space runs low. Running out of space usually happens on the busiest day.
• 11. Review Microsoft 365 security. Check your Secure Score, administrator roles and sharing settings. Our guide to Microsoft 365 security best practices lists the settings worth checking.
• 12. Update documentation and the asset list. Record new devices, retired equipment, system changes and who has access to what, which also helps with compliance. When something fails, good documentation is the difference between a quick fix and a long guess.

Yearly IT and Server Maintenance Checklist (8 Tasks)

Yearly tasks are about planning, and about proving that your recovery plans work. Schedule them for a quiet time of year, ideally before you set the next budget, as regular maintenance also supports compliance with ISO 9001 standards.

• 13. Run a full recovery test. Restore an entire system or key server from backup and time how long it takes. Then compare that time with how long your business can realistically afford to be offline.
• 14. Review hardware age and warranties. List every device with its purchase date and warranty end date. Review criteria can vary by equipment type. Many businesses plan to replace laptops and desktops every three to five years, so this list lets you budget before something fails.
• 15. Check end-of-support dates. Unsupported systems stop receiving security fixes. Windows 10 reached end of support on 14 October 2025, so any device still running it is relying on Extended Security Updates or is unpatched. Microsoft has also confirmed that extended support for Windows Server 2016 ends on 12 January 2027, so servers on that version need a plan now.
• 16. Review access and permissions. Check who can reach shared folders, SharePoint sites, guest accounts and administrator roles, and remove anything that is no longer needed. If you can, do this every quarter instead.
• 17. Review security policies and staff training. Update your cybersecurity and acceptable use policies, and refresh staff training. Our guide to phishing attacks on SMBs in Australia is a good starting point for what to cover.
• 18. Review the firewall, remote access and network. Check firewall rules, remove old remote access and VPN accounts, and confirm the network still matches how your office actually works.
• 19. Review contracts, licences and suppliers. Check renewal dates for internet, software and support contracts, and confirm each service is still needed and fairly priced.
• 20. Update your IT roadmap and budget. Use what the checklist found to plan next year’s replacements, upgrades and projects. This yearly review helps determine priorities, time and resources for the next maintenance plan. Our guide on how to create an IT roadmap shows how.

Who Should Handle Your IT Maintenance?

The checklist only works if one person or team is managing it. Small businesses usually choose between three options, and the right choice depends on your maintenance goals.

Do It Yourself or Use an In-House Person

This can work for a very small team with a simple setup. The risks are that one person is stretched across every task, nobody covers when they are away, and maintenance slips whenever urgent work arrives. Therefore, the owner should also document the maintenance schedule and adjust it if tasks are being missed.

If you go this route, write the checklist down, set calendar reminders and record the date each task is done.

Pay as You Go With Break-Fix Support

With break-fix support, a technician is paid by the hour when something goes wrong. Routine maintenance rarely happens under this model, because nobody is paid to do it. Our guide to IT support vs managed IT services compares the two approaches in detail.

Use a Managed IT Provider

A managed IT provider runs the routine for a fixed monthly fee, usually charged per user. Monitoring tools check backups, patching and alerts continuously instead of once a week, and a technician acts on what they find.

Managed providers also support IT teams by using tools to coordinate maintenance operations across client infrastructure.

If you take this route, ask for a server maintenance checklist or similar written task list, and for a monthly report showing what was done. Our list of questions to ask a managed IT provider covers what to check before you sign.

Common IT Maintenance Mistakes

A checklist can fail in quiet ways. Its effectiveness improves preventive maintenance only when people follow it consistently. These are the mistakes that most often undo good intentions.

• No named owner. When everyone is responsible, nobody is. Give each section of the checklist to one person, with a backup for when they are away.
• Backups that are never restored. A backup job can report success while the data cannot be recovered. The monthly restore test and the yearly full recovery test exist to catch exactly this.
• Patching only when something breaks. Updates installed whenever someone remembers leave gaps that attackers look for. A fixed monthly cycle, plus a weekly check for urgent fixes, removes the guesswork.
• Forgetting the equipment nobody sees. Firewalls, switches and Wi-Fi access points run quietly until they fail or are exploited. Put them on the monthly list, not the “when we have time” list.
• Running unsupported software. Once a product reaches end of support, new security flaws stop being fixed. Check end-of-support dates every year, before the deadline arrives.
• Keeping no record. Without dates and notes, you cannot show that maintenance happened. A written record also helps when a customer, insurer or auditor asks how you manage cybersecurity risk, and it supports frameworks such as the Essential Eight. Our Essential Eight guide for SMBs explains what that involves.

How XCD IT Handles IT Maintenance for Brisbane SMBs

The checklist is simple. Doing it every week, month and year without fail is where maintenance teams often struggle more with consistency than knowing what to do. That is where a local provider helps.

Monitoring and Maintenance From a Local Team

XCD IT provides IT monitoring and maintenance for businesses across Brisbane, the Gold Coast and the Sunshine Coast.

A managed service like this is designed to run tasks such as backup checks, patching and alert reviews on a schedule to reduce downtime across client infrastructure. It helps keep operations running smoothly so they do not depend on whoever has spare time. Documented checklists also help track assets as systems change over time.

See our IT monitoring and maintenance services in Brisbane for what is covered.

Bundled With Cybersecurity

XCD IT’s managed IT and cybersecurity plans are commonly priced between AU$100 and $250 per user per month. XCD IT holds SMB1001 Gold certification and is a Microsoft Partner.

Don’t have time to run this checklist yourself? Our managed IT support in Brisbane handles it for you.

If you would like a free comparison of your current routine against this checklist, call the team on 07 3085 7447.

Frequently Asked Questions