The first weeks of a new year are when IT teams get rare permission to fix what was working but not working well. Use the window. This guide is the practical 10-step IT checklist for U.S. SMBs and mid-market firms entering 2026 — the things you should make sure are tightened up, audited, and updated before the rest of the year buries you in tickets, projects, and incident response.
The 10-Step 2026 IT Checklist
- MFA coverage audit. Pull a coverage report from Entra ID / Okta. Identify and close any gaps on email, VPN, RDP, admin accounts.
- EDR coverage audit. Confirm every endpoint and server is enrolled and reporting. Investigate any “unknown” or “offline” devices.
- Restore-test backup. Pick a non-trivial system and run a full restore-test. Document the time and any issues.
- DMARC policy review. Move from
p=nonetop=quarantineorp=rejecton every owned domain. - Patch compliance review. Pull a 90-day patch report. Triage any criticals older than 14 days.
- License utilization audit. M365, Salesforce, Adobe, Atlassian — most enterprises are 15–30% over-licensed; reclaim the unused seats.
- Stale account cleanup. Disable any accounts with no sign-in for 90+ days. Review service accounts and break-glass accounts.
- Security policy refresh. Update the date and executive signature on your Written Information Security Policy.
- Tabletop exercise. Run a 90-minute tabletop on a ransomware or BEC scenario. Document gaps.
- Cyber insurance prep. If you renew in Q1 or Q2, start the questionnaire and evidence package now.
The 30-Day, 60-Day, 90-Day Cadence
| Window | Focus |
|---|---|
| Days 1–30 | Audits — MFA, EDR, backup, DMARC, patching |
| Days 31–60 | Documentation — policies, runbooks, IR plan, vendor inventory |
| Days 61–90 | Exercises — tabletop, restore tests, cyber insurance prep |
The Strategic Layer — vCIO Topics for 2026
- AI productivity rollout (Copilot, ChatGPT Enterprise) — pilot scope and budget
- ZTNA migration off legacy VPN — multi-quarter project
- Compliance posture: HIPAA Security Rule update readiness, SOC 2 prep, FTC Safeguards
- Cloud cost discipline if AWS/Azure/GCP spend is > $250k/year
- Hardware refresh wave for end-of-life devices
- Cyber insurance market check — every 24 months
Bottom Line
A 90-minute MFA coverage audit, a 60-minute restore test, a 30-minute DMARC review, and a 90-minute tabletop together fix the controls that quietly drift the rest of the year. None of these are exotic — they are just easier to do in January than in November.
Need help running through this checklist? ACS provides annual IT health-check engagements for U.S.-based SMBs and mid-market firms. Contact us.
