Most small businesses do not have an equipment problem: they have a memory problem. The network works, the servers run, but how everything is set up is known by one person. The day that person is not around —holidays, a job change, a provider who left— any small failure becomes a big problem.
An inventory is not red tape. It is what lets anyone fix a failure, keeps the next provider from charging to find out what is there, and lets the company grow without depending on anyone in particular.
No special software is needed: a shared spreadsheet and a drawing of the network are enough. What matters is what it contains and that it is kept up to date.
The equipment
A list of everything, with its owner
Record every device: servers, desktops, laptops, printers, network gear. For each one, at least: a name, what it is, who uses it, where it is, the model and when it was bought.
It is the basis for everything else. You cannot look after what you do not know exists, and something nobody remembered almost always turns up.
The network, drawn out
It does not need to be a professional diagram: a clear drawing will do. Where the internet comes in, where the router is, which switches there are and what each one connects, where the wifi access points are and which networks exist —the office one, the guest one, the cameras one—.
When something fails, troubleshooting starts here instead of figuring out what is connected. A problem of minutes stops being one of hours.
What is critical, with an expiry date
For the equipment operations depend on —the server, the router, the firewall— record its age and until when it has warranty or manufacturer updates. That way it gets replaced before it fails, with time to choose, and not afterwards, in a rush.
What happens if the power or internet goes down
Is there a UPS? How long does it last? Is there a second internet link? What keeps working and what stops? Knowing beforehand is the difference between a scare and a halted operation.
The access
Passwords, in a password manager
Admin passwords —for the router, the servers, email, the cloud— belong in a company password manager, with at least two people able to get in. Not on a note stuck to the monitor, and not in a single person’s head.
Who has access to what
A simple table: each person and which systems they can get into. And, above all, who grants access when someone joins and who removes it when they leave. Accounts of people who have left are one of the most common doors for an attack.
Company accounts, in the company’s name
The domain, hosting, internet service, licences, the cloud: all in the company’s name, with a company email address and with their renewal dates written down. An expired domain, or one registered to a former provider, can leave the company without email overnight.
Getting in from outside
If the systems can be reached from outside the office, record how: VPN, remote desktop, cloud applications. And with what protection: two-factor authentication should be switched on wherever it is available. Remote access is how most attacks get in.
The data
Where it lives
List the important data and where each piece lives: the management system, shared folders, the cloud, email. Pay attention to whatever lives on a single computer: it is lost along with it.
Backups: what, how often and where
For each important piece of data: whether it is backed up, how often and where the copy is kept. A simple rule that works is 3-2-1: three copies of the data, on two different media, with one of them off site.
A backup kept in the same place as the original does not survive the same problem: a fire, a theft or an attack that encrypts everything it finds.
Test a restore
Record when a backup was last test-restored, and test it every so often. A backup that was never restored is a hope, not a backup: you only find out whether it works on the day you need it.
The applications you depend on
The management system, invoicing, email, whatever operations need in order to run. For each one: who maintains it, how to reach them and what stops if it goes down.
When something fails
Whom to call
A short list, at hand and also printed: for the internet, the provider and the account number; for the equipment, the technician or company that maintains it; for each application, its support. In the middle of an outage nobody has time to look up a contact.
The steps for the most common cases
Internet is down, email is not working, a computer broke, someone received a suspicious email. For each case, three or four written steps. Anyone can fix the simple things if they are written down, and whatever cannot be fixed gets escalated faster.
Who keeps it up to date
An outdated inventory is almost as dangerous as not having one, because it builds confidence in data that is no longer true. Name one person responsible, review it every three or six months, and update it every time a device or a person comes or goes.
The checklist, on one page
The equipment
- A list of every device, with who uses it and where it is.
- The network drawn out: what connects to what.
- Age and warranty of what is critical.
- What happens if the power or internet goes down.
The access
- Admin passwords in a password manager, with at least two people.
- Who has access to what, and who grants and removes it.
- Domain, internet, licences and cloud in the company’s name, with renewal dates.
- How people get in from outside, with two-factor authentication.
The data
- Where each important piece of data lives.
- What is backed up, how often and where: three copies, two media, one off site.
- When a restore was last tested.
- The applications operations depend on, and who maintains them.
When something fails
- Whom to call for each thing, with the numbers at hand.
- The steps for the most common problems.
- Who keeps this inventory, and how often it is reviewed.
Building it the first time takes work; keeping it up takes very little. If you would rather we assessed it for you, we leave it complete, documented and ready for your team to use: tell us how your network is doing.