Year-End IT and Security Checklist for Small Firms: What to Finish Before January
Updated: 2 days ago
Short answer: Before January, a small firm should finish five things: replace or plan off any Windows Server 2016 machines (Microsoft support ends January 12, 2027), gather the proof your cyber insurer will ask for at renewal, review who has access to what and remove what's stale, run a real restore test and write down the result, and confirm MFA, updates and your incident contacts still hold up over the holidays. Keep a dated record of each one. That record is what your insurer, your examiner or your biggest client will ask to see.
Why does year-end matter for IT at a small firm?
Year-end is when several things land at once. Cyber insurance renewals, client security questionnaires and new-year audits tend to cluster in the first quarter, and each one asks you to show what you did, not just say it. The holidays also thin out staff, which is exactly when a phishing email or a failed server gets noticed late. And this year there is a hard date: Windows Server 2016 stops getting security updates in January.
This checklist is written for owners, managing partners, office managers and CCOs at small firms in Colorado and Texas. Every item ends with what to keep as proof, because that is the part people forget.
Is Windows Server 2016 reaching end of support?
Yes. According to Microsoft's lifecycle page, extended support for Windows Server 2016 ends on January 12, 2027 (US time). After that date, Microsoft stops releasing security updates for it.
What changes on January 12, 2027
Nothing visible, and that is the trap. The server keeps running, your files are still there and your apps still open. What stops is the flow of security fixes, so any new weakness found after that date stays open on your machine.
How to find out if you still run it
Check every server, physical or virtual. The usual places Server 2016 hides:
The file server everyone maps a drive to
A domain controller that handles logins
A line-of-business application server (accounting, document management, CAD licensing)
An old virtual machine nobody remembers setting up
Proof to keep: a dated list of each server, its Windows version, what it does and who owns it.
Your options
You have three choices for each Server 2016 workload: move it to the cloud (for example, files into Microsoft 365), upgrade to a supported Windows Server version, or retire it if nothing really depends on it any more. Pick one per server and set the plan before the holiday change freeze.
Still running Windows Server 2016? We'll help you plan the move before support ends. Talk to 24uNet.
What proof will your cyber insurer ask for at renewal?
Renewal applications have become more detailed, and the questions are about controls you can show.
The questions that usually show up
Insurers commonly ask about:
MFA on email, remote access and admin accounts
Backups kept separate from the network, and whether you have tested a restore
Endpoint protection on every computer and server
How you keep systems patched
Security awareness training for staff
A written incident response plan
How admin accounts are controlled
Answer with evidence, not just "yes"
For each question, gather something you could hand over: a screenshot of MFA settings, a patch report, a dated restore result, a training completion list. A "yes" on an application that turns out to be wrong can cause trouble later, at claim time, when it matters most. If the honest answer is "partly," fix it before you sign or describe it accurately.
Proof to keep: a folder with the completed application and the evidence behind each answer, dated.
How do you run a year-end access review?
An access review checks every account against who still works for you and what they actually need.
Compare your user list in Microsoft 365 and on your servers to current payroll. Remove anyone who has left. Our Microsoft 365 employee offboarding checklist covers the steps.
Find shared and service accounts and confirm each still has an owner.
Cut standing admin rights. People should use a separate admin account only when they need it.
Check external sharing and guest users in Microsoft 365 and remove what is no longer needed.
Confirm MFA is on for every account, not just most. Then make sure people know MFA alone is not the finish line; see device code phishing: when MFA is not enough.
If passwords are still kept in spreadsheets, plan a password manager rollout.
Proof to keep: the before-and-after user and admin lists, with the date and who did the review.
How do you know your backups will actually restore?
You only know when you try. A backup that has never been restored is a hope, not a plan.
Restore a real file set and one full system
Pick a folder people actually use and restore it to a separate location. Then restore one full system, such as a server or a key virtual machine. Record what you restored, when, how long it took and who checked that it worked.
Make sure one copy can't be reached from the network
At least one backup copy should be separate or offline, so ransomware that reaches your network can't reach it too. Not sure what to ask? Start with these questions to ask your IT provider about backup and recovery, and check whether Microsoft 365 backs up your data (the short answer surprises people). For bigger recovery planning, see hot site, warm site and cold site options and our business continuity service.
Proof to keep: a dated restore log and a note of where the separate copy lives.
What else belongs on a year-end IT checklist?
Holiday coverage and incident contacts. Who do staff call if something looks wrong on December 26? Print the list, because email may be the thing that is down.
Payment-callback rule. Remind everyone: any change to wire or payment details gets a call back to a known number before money moves. Holiday wires are a favorite target; see deepfake voice and wire fraud at small firms.
Device inventory. List laptops, desktops and anything else aging out of support, not only servers.
Firewall and router firmware. Update it and note the version.
Domain and certificate renewals. List what renews in the new year and who gets the reminder.
Security training refresher. A short session before the holidays.
Written policies. Review them, update them and put a new date on them.
Proof to keep: the inventory, the renewal list, the training record and the re-dated policies.
What should RIAs, law firms, A&E firms and defense contractors add?
RIAs and financial advisers. Examiners ask your IT provider pointed questions, so line up your evidence with what SEC examiners ask your IT provider.
Law firms. If you are piloting AI tools or Microsoft Copilot in the new year, check permissions first: law firm AI ethics and Copilot readiness.
Architecture and engineering firms. Your CAD and project files are what ransomware goes after. Review ransomware protection for architecture and engineering firms.
Defense contractors. Year-end is a good time to revisit your CMMC Level 1 self-assessment and SPRS annual affirmation.
Texas firms. Read how Texas SB 2610 works and see Lone Star Assurance, our Texas cybersecurity program. Colorado firms, see cybersecurity in Denver.
How does 24uNet help?
Our Security Baseline maps directly to this list: MFA, admin rights, patching, backups and restore tests, incident contacts and the written record behind each one. We can work under a master services agreement or a simple service authorization for a single project, such as a Server 2016 move. Texas businesses can use Lone Star Assurance, our Texas-only program for Chapter 542.
Still running Windows Server 2016? We'll help you plan the move before support ends. Talk to 24uNet.
FAQ
When does Windows Server 2016 support end?
January 12, 2027. After that, Microsoft stops releasing security updates for it.
Will our Windows Server 2016 machine stop working on January 12?
No. It keeps running, but it stops getting security fixes, so new weaknesses stay open.
What do cyber insurers ask for at renewal?
Commonly: MFA on email, remote access and admin accounts; backups kept separate from the network and tested; endpoint protection; patching; staff training; and an incident response plan. Expect to show proof.
How often should a small business test a restore?
At least once a year and after major changes; year-end is a natural time. Write down what you restored and whether it worked.
What is an access review?
A check of every account against who still works for you and what they need, removing stale accounts and extra admin rights.
Can we do this checklist ourselves?
Yes; the download is built for that. An IT provider can run it and keep the evidence for you.
Get the checklist and the next step
Download the free one-page Year-End IT & Security Checklist (PDF) It is a one-page PDF with a Task and Proof to keep column for each item. No form, no sign-up.
Want the full 24-line version? Get the Security Baseline checklist.
Questions? Call Denver (303) 468-5515 or College Station (979) 256-5100, or email sales@24unet.com. Existing clients can reach support at support@24unet.net.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. Cyber AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments