Your checklist is ready

the checklist

10 questions to ask your IT company

Here they are, with what a good answer sounds like. Bring them to your next IT check-in. If an answer is unclear, ask who will verify it, and by when. Mark each one as you go.

When someone leaves, how fast is their access shut off?

A good answer: the same day, from a written offboarding checklist, and they can show you the last time it happened.

Who has an active login to our email and files right now?

A good answer: a current list of every account, matched against your actual staff, with no names you don't recognize.

Is any mailbox forwarding email outside the firm?

A good answer: they check for outside forwarding regularly, block it by default, and get alerted when someone sets it up.

Whose phones can still approve sign-ins to our accounts?

A good answer: sign-in approval devices are removed the day someone leaves, and lost or replaced phones are cleared too.

Who can open our shared folders, including people outside the firm?

A good answer: a report of who can see client folders, plus a habit of expiring outside sharing links.

Do former staff still have logins to our other apps?

A good answer: billing, e-signature, practice management, and bank portals are on the offboarding list, not just email.

Who holds the master keys to our systems?

A good answer: a short, named list of admin accounts, none of them shared or tied to someone who no longer works with you.

Are firm files still synced to laptops or phones we don't control?

A good answer: they can remotely wipe firm data from any device, including personal phones, when someone leaves.

If a former employee logged in tonight, would anyone notice?

A good answer: suspicious sign-ins trigger an alert that a real person reviews, day or night.

When was our last access review, and can we see it?

A good answer: within the last quarter, documented in writing, ready to hand to your insurer or a client's security questionnaire.

Your IT access checklist is ready.