IT Network Assessment Checklist Template

• Qualify the prospect — size, sites, users, current IT arrangement and the reason they are looking now
• Agree the scope — sites, internal and public IP ranges, the Microsoft 365 or Google Workspace tenant, and anything excluded
• Identify who can authorise — the person entitled to consent for each system, and any systems hosted or managed by a third party
• Agree how to handle the current provider — whether they are told, and who explains scan alerts if their tools raise them
• Send the pre-assessment questions — locations, key applications, known problems, upcoming contracts and who to contact on the day

No scan, login or collector install happens until the signed authorisation is attached to this phase.

• Send the authorisation letter — scope, methods, dates and times, data handling, exclusions and an emergency contact on both sides
• Get it signed by someone entitled to consent — usually an owner or director; anyone else needs written delegation
• Confirm the exclusions — systems that must not be touched, such as hosted servers or a landlord’s network, recorded by name
• Set up temporary read-only tenant access — a named Global Reader account protected by MFA, with an agreed removal date
• Record where assessment data will be kept — storage location, who can see it, and deletion if the prospect doesn’t sign

• Run the internal discovery scan — non-intrusive discovery inside the agreed window, from a device or collector you control
• Scan the external attack surface — open services on the prospect’s own public IP addresses, as listed in the authorisation
• Walk the site — comms cabinet, firewall, switches, Wi-Fi, UPS, printers and the physical security of equipment
• Talk to a few users — what slows them down, workarounds, personal devices and software bought outside IT
• Record what you could not assess — and why, so the report doesn’t imply coverage it doesn’t have

• Review sign-in protection — security defaults or Conditional Access, and the share of users actually registered for MFA
• Review admin roles — number of Global Administrators, shared or unnamed admin accounts, and accounts belonging to past providers
• Review email authentication and mailbox rules — SPF, DKIM and DMARC for each domain, and external forwarding rules
• Compare licences with users — unassigned licences, licensed accounts for people who have left and mismatched plans
• Run a baseline configuration check — Microsoft Secure Score or the CISA SCuBA baselines, with results saved as evidence

The internal review is an approval step. The findings meeting stays locked until a second person has approved the report.

• Rate each finding — critical, high, medium or low, judged by business impact rather than by the scanner’s score
• Write the executive summary — one page, the three biggest risks first, in language the decision-maker uses
• Separate onboarding fixes from projects — what the managed service resolves and what needs separately priced work
• Approve the findings report internally — a second reviewer checks accuracy, tone, overstated findings and any sensitive data in the report
• Prepare the proposal — managed service pricing, the remediation projects and the onboarding timeline

• Present the findings to the decision-maker — the summary and top risks first, technical detail only on request
• Present the proposal — what changes in the first 30 days, what it costs and what each risk costs if it is left
• Record the outcome — signed, declined or still deciding, with the reason and a follow-up date
• Remove assessment access — disable the temporary tenant account, remove any collectors and delete data as the authorisation says

Shown only when the prospect signs. Conditional logic keeps it out of assessments that end without a contract.

• Hand the assessment pack to onboarding — inventory, findings, contacts, site notes and anything promised during the sale
• Mark findings that need action in week one — exposed services or admin accounts without MFA go first
• Launch the client onboarding checklist — with the assessment attached and the target go-live date agreed in the proposal
• Brief the account manager — the findings the client cared most about, so the first QBR can report progress on them