Practical IT Documentation Checklist for Florida Small Businesses

Most small businesses have no written record of their technology environment. Ask who has administrative access to your Microsoft 365 tenant, what software licenses you are paying for, or what the recovery procedure is if your main server fails — and the answer is often "whoever set it up knows" or "we would have to figure it out." That is a business risk, not just an IT problem.

This checklist covers the minimum documentation every small business should maintain. It is organized by category so you can work through it incrementally rather than trying to document everything at once.

1. Technology Inventory

Before you can manage your technology, you need to know what you have. A technology inventory should be a living document — updated whenever something changes, not recreated from scratch when something breaks.

Computers and devices:

• List of all computers (desktops, laptops) with make, model, and serial number
• Operating system version and whether it is receiving updates
• Assigned user (or "shared" designation)
• Approximate purchase date and warranty status

Network equipment:

• Router(s) — make, model, firmware version, location
• Switches — make, model, number of ports, location
• Wireless access points — make, model, location, SSID names
• Firewall — make, model, last configuration review date

Software and SaaS subscriptions:

• All software licenses in use — including Microsoft 365 plan, license count, and renewal date
• SaaS tools (CRM, accounting software, project management, industry-specific tools)
• Who manages each tool and the account contact information
• Monthly and annual costs for budgeting purposes

2. Access and Identity Records

Access documentation answers the question "who has access to what" — and it is the first thing an auditor, a new IT provider, or an incident response team will ask for. Most small businesses cannot produce this quickly.

Microsoft 365 accounts:

• List of all user accounts with the associated employee and their role
• Which accounts have administrative access and at what level (Global Admin, Exchange Admin, etc.)
• Shared mailboxes — what they are, who has access
• Guest accounts and what they can access
• Service accounts used by applications or automations

Other system access:

• Who has administrator access to each major system (accounting software, CRM, etc.)
• Vendor and contractor accounts — current access level and whether they should still be active
• Physical access — building codes, key fobs, server room access

3. Vendor and Contract Records

When something breaks, you need to know who to call. Vendor documentation consolidates this information in one place so that any staff member can locate the right contact without spending time searching.

• Internet service provider — account number, support phone, contract term, monthly cost
• Microsoft 365 — licensing source (direct or through reseller), support contact, renewal date
• Managed service provider (if applicable) — contract terms, escalation contacts, what is and is not included
• Line-of-business software vendors — support contacts, maintenance renewal dates
• Hardware maintenance agreements — what is covered, what is not
• Domain registrar — account access, renewal date (domain expiration is a common, preventable problem)
• Website hosting — account access, renewal date

4. Backup and Recovery Documentation

Backup documentation is among the most important — and most commonly absent — IT records in small businesses. The questions to answer are: what is backed up, how often, where to, and how would you recover if the backup were needed?

• What systems are backed up (servers, workstations, Microsoft 365 data)?
• Backup software or service in use, with account credentials documented securely
• Backup frequency and retention period
• Backup storage location (local, cloud, offsite)
• Last successful backup verification date
• Recovery procedure — step-by-step, with who to contact and in what order
• Estimated recovery time for each major system

A backup that has never been tested is not a reliable backup. If you cannot produce a record of when a restoration was last tested successfully, add that to the to-do list before the next review.

5. Onboarding and Offboarding Runbooks

Employee transitions are among the most common sources of IT problems at small businesses. Onboarding without a checklist leads to employees starting work without the access they need. Offboarding without a checklist leads to departed employees retaining access longer than they should.

Onboarding checklist should include:

• Microsoft 365 account creation and license assignment
• MFA enrollment before account is actively used
• Group memberships and shared mailbox access
• Device setup and enrollment in device management (Intune if applicable)
• Software access provisioning for each relevant system
• Physical access provisioning

Offboarding checklist should include:

• Microsoft 365 account deactivation (block sign-in before license removal)
• Email forwarding or backup setup during transition period
• Access removal from all other systems — listed explicitly by system
• Device collection and remote wipe if applicable
• Password changes for any shared accounts the employee had access to
• Review and removal of any email forwarding rules the employee may have created

6. System Configuration Notes

Configuration documentation does not need to be comprehensive to be useful. The goal is to capture enough information that someone unfamiliar with your setup could understand what exists and make informed decisions about changes.

• Network diagram or description — what connects to what, IP address ranges used
• Wi-Fi SSID structure — what networks exist, what they are for, who has the passwords
• Email platform settings — key Exchange configuration decisions
• Line-of-business application configuration notes — anything non-standard that someone would need to know

Making Documentation a Practice, Not a Project

The most common mistake with IT documentation is treating it as a one-time project. Documentation becomes stale quickly in environments that change — and all business environments change. The most useful approach is to integrate documentation updates into the processes that drive change: when you hire someone, the onboarding runbook gets followed and the inventory gets updated. When a vendor is added or changed, the vendor list gets updated. When a new tool is adopted, the software inventory gets updated.

If you want help creating initial IT documentation for your business — starting with the current state and producing records that belong to you in formats you control — that is a service Morse Technology Group provides for Florida small businesses.