This free monthly IT maintenance checklist gives an internal IT team, or an MSP running it once per client, one routine across the whole estate. It covers endpoints, servers, backups, network and firewall, accounts, the SaaS tenant, expiry dates and documentation. It does not redo specialist work: patching, server maintenance, restore tests and account cleanup keep their own checklists, and this run confirms they happened and takes their figures. It ends with a one-page summary signed off by a named approver and, for MSP clients, a report the client can act on.
Most IT teams already have owners for the big recurring jobs. Someone runs the patch cycle, someone looks after the servers, someone tests restores. What nobody owns is the month-end question: did all of that happen, and what sits outside every one of those jobs? Network appliances, the Microsoft 365 or Google Workspace tenant, MFA exclusions, domain renewals and paid seats held by people who left belong to no server group or patch ring, so they get checked when someone remembers.
This checklist is that month-end question, written down. It is deliberately shallow where another checklist goes deep, and thorough where nothing else looks.
Examples: the patch cycle, server maintenance, restore tests, directory cleanup.
Depth: every server, every ring, every restore, with the evidence attached.
Blind spot: anything outside its own scope.
Output: a signed record of one job.
Examples: firewall firmware, MFA coverage, admin roles, expiry dates, SaaS seats.
Depth: confirms the specialist runs happened and takes their figures, then checks what they leave out.
Blind spot: it does not patch, restore or clean anything up itself.
Output: a one-page monthly summary with a named sign-off.
Timing matters. Microsoft releases security updates on the second Tuesday of the month, and a cycle with test and pilot rings needs time to reach every device. Scheduling this run in the last week of the month means the cycle report, the server runs and the backup reports it relies on already exist.
Seven phases, once a month per estate. A named approver signs off before anything is sent, and the client report appears only on MSP client runs.
Two answers on the first task, MSP client and servers, decide what appears in Phases 2 and 7.
The first task appears only when the estate has servers. The rest runs everywhere: cloud-only estates still have data to protect.
The named approver signs off the month. The checklist halts at the sign-off task, so nothing reaches a client until the numbers have been checked.
Its tasks appear only when the run is for an MSP client. Internal IT teams stop at the Phase 6 sign-off.
The table marks the boundary between this routine and the checklists beside it. Frequencies set by a framework or vendor are shown; the rest are defaults to tune.
| Area | This run checks | Where the work is done | Reference point |
|---|---|---|---|
| Endpoints and patching | Compliance figure, protection, encryption, expiring exceptions | Patch Management Checklist | CIS Safeguards 7.3 and 7.4: monthly or more often; 3.6: encrypt end-user devices holding sensitive data |
| Servers | That each group’s run was completed and its findings ticketed | Server Maintenance Checklist | Weekly, monthly and quarterly runs per group |
| Backups | The month’s job results, new coverage, restore test done | Backup Verification & Restore Test Checklist | CIS 11.2: back up weekly or more often; 11.5: test recovery quarterly or more often |
| Network devices | Firmware, configuration backups, firewall rule changes | This checklist, Phase 3 | CIS 12.1: review network software versions monthly or more often |
| Accounts | Leavers, MFA coverage, admin roles, emergency accounts | This checklist, Phase 4; dormant accounts go to the AD & Entra ID Account Cleanup Checklist | CIS 5.3: 45 days of inactivity; Microsoft: fewer than five Global Administrators, emergency accounts tested at least every 90 days |
| SaaS tenant | Service health, message centre posts with act-by dates | This checklist, Phase 4 | Microsoft aims to give at least 30 days’ notice of changes that need admin action |
| Expiry dates and renewals | Domains, certificates, push certificates, contracts, SaaS seats | This checklist, Phase 5 | Apple MDM push certificate: valid 365 days, renewed with the same Apple ID |
For UK organisations certified to Cyber Essentials, several of these checks are now pass-or-fail. Version 3.3 of the requirements, which took effect in April 2026, says authentication to cloud services must always use MFA. It requires inbound firewall rules to be approved and documented by an authorised person with the business need recorded, and unneeded rules removed. It also counts router and firewall firmware as software, so critical and high-risk fixes for them fall under the same 14-day deadline as operating systems. A monthly look at MFA exclusions, rule changes and firmware keeps you inside those lines between assessments.
A monthly recurring schedule starts the run in the last week of every month and assigns it to the estate’s owner. For an MSP, each client gets its own schedule from the same template, and conditional logic hides the server task and the client report where they do not apply.
Patch compliance, backup success and MFA coverage go into a table inside the summary task, next to last month’s value and the target. The patch cycle report and backup report attach to the tasks that quote them, so every figure can be traced to its source.
The sign-off task goes to the approver picked in Phase 1, and the checklist waits there until they record a decision. The activity trail shows who completed each check and when, and tags per client or site make any month easy to find at audit time.
This run confirms the specialist work rather than repeating it. Server checks live in the Server Maintenance Checklist, the monthly update cycle in the Patch Management Checklist, restore tests in the Backup Verification & Restore Test Checklist and stale accounts in the Active Directory & Entra ID Account Cleanup Checklist. Growth trends spotted here feed the quarterly IT Capacity Planning Checklist.
A monthly routine only works if it starts without anyone remembering to start it. Our guide to recurring checklists explains why a document on a shared drive stops being a reliable control once more than one person runs it, and CheckFlow’s recurring checklist software shows how schedules, assignments and reminders work.
Everything that goes wrong too slowly for monitoring and too quickly for an annual review: endpoint patch compliance, protection and encryption, confirmation that server maintenance and restore tests ran, backup results, network firmware and firewall rule changes, leavers, MFA coverage and admin roles, SaaS tenant notices, and dates that expire, such as domains, certificates and contracts. It should end with a signed summary compared with last month.
Weekly work is about things that break in days: alerts, disk space, backup job failures. Monthly work suits things that follow a monthly rhythm or change slowly: the vendor patch cycle, network firmware, account and licence changes from joiners and leavers, and anything with an expiry date. CIS Controls v8.1 sets monthly as the minimum for patching operating systems and applications and for reviewing network infrastructure software versions.
From one standard template with a schedule per client, so every client gets the same checks and every report has the same shape. Scope questions at the start hide what a client does not have, such as servers. Identical summary figures make clients comparable, and the client report phase turns findings into recommendations with a cost and a decision date.
A handful of figures with last month beside them: patch compliance, backup success, the latest restore test result, MFA coverage and open exceptions. Then the findings with ticket numbers, what expires in the next two months and the decisions needed from management or the client. One page is enough.
In the Microsoft Entra admin center, the authentication methods activity report lists which users are MFA-capable, meaning registered for a strong method and allowed by policy to use it. Its usage and insights views need a Microsoft Entra ID P1 or P2 licence. Check policy exclusions too: an excluded account is unprotected however good the registration figure looks.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
