SAMPLE. Cabinet Exemple inc. does not exist. The findings, numbers, and names are invented to show the shape of the report. A real report contains your findings and screenshots.
Cabinet Exemple Inc.: one-day IT health check
Office of 8 computers, Microsoft 365 Business Standard, one shared printer, one office Wi-Fi. Prepared by Yazan Rajabi. Read-only access to your accounts, nothing was changed.
On one page
FixEmail
FixAccess and security
FixBackups
WatchLicences and computers
WatchWebsite and Law 25 (IT)
WatchNetwork and Wi-Fi
Three items are urgent and take about one day in total. Five others can wait for the month that follows. The detail of each finding follows.
The findings, most urgent first
1. MFA is not required for 3 of 8 accounts, including the owner’s
- Found
- The sign-in log shows password-only sign-ins for 3 accounts.
- Why it matters
- A stolen password is the most common way in. Microsoft says MFA and blocking legacy authentication stop more than 99.9% of common identity attacks.
- Fix
- Turn on security defaults, register Microsoft Authenticator for each account, create two emergency access accounts.
- Effort
- 1 h, plus 10 min per person
- Who
- Me, with the owner
2. Two SPF records and no DMARC
- Found
- The domain publishes two SPF records (one added by the newsletter tool) and no DMARC record.
- Why it matters
- Two SPF records make the check fail, so the office’s email can land in spam, and anyone can send email that looks like it comes from the domain.
- Fix
- Merge into one SPF record, turn on DKIM in Microsoft 365, publish DMARC in monitoring mode (p=none) with reports, then tighten.
- Effort
- 1 to 2 h, then 2 to 4 weeks of monitoring
- Who
- Me
3. The shared folder lives on one computer with no copy elsewhere
- Found
- Client folders sit on the receptionist’s PC. No restore has ever been tested.
- Why it matters
- One failed disk or one ransomware infection is enough to lose everything.
- Fix
- Move the folders to SharePoint or OneDrive with version history, add a Microsoft 365 backup, test a restore.
- Effort
- Half a day
- Who
- Me
4. Two former employees still have an active account and a paid licence
- Found
- Two accounts of employees who left over 90 days ago can still sign in.
- Why it matters
- A monthly cost for nothing, and an open door.
- Fix
- Block sign-in, convert to a shared mailbox or archive, remove the licence, adopt an offboarding checklist.
- Effort
- 1 h
- Who
- Me or the owner
5. 3 of 8 computers run Windows 10 and 2 are not encrypted
- Found
- Windows 10 has had no support since October 14, 2025. Two laptops have no disk encryption.
- Why it matters
- Without updates, a computer is exposed. A lost laptop without encryption exposes client data.
- Fix
- Move to Windows 11 or replace computers that do not qualify, turn on BitLocker, set updates.
- Effort
- 2 to 3 h per computer
- Who
- Me
6. 5 users are administrators on their own computer
- Found
- Five staff accounts have local administrator rights.
- Why it matters
- Malware opened by mistake can then install itself anywhere.
- Fix
- Standard accounts for everyone, one separate admin account.
- Effort
- 1 h
- Who
- Me
7. One Wi-Fi password for staff, visitors, and the printer
- Found
- The password has not changed since installation. No guest network.
- Why it matters
- Any device that knows the password sees the office network.
- Fix
- Separate guest network, new password, router firmware update.
- Effort
- 1 h
- Who
- Me
8. An analytics tool loads without a notice, and no incident register exists
- Found
- The site loads an analytics tool without telling visitors. The privacy page names no person in charge. There is no incident register.
- Why it matters
- These are Law 25 obligations that are partly handled on the IT side.
- Fix
- Add a notice or remove the tool, name the person in charge, open a simple register. The legal wording is for a lawyer.
- Effort
- 2 h
- Who
- Me for the IT part, a lawyer for the wording
What this report is not
It is not legal advice. For Law 25, I handle the technical controls and tell you what needs a lawyer. See the Law 25 guide.
What happens next
I go through the report with you for 30 minutes. You then decide what to fix, with me or without me. The review costs CAD 500, credited toward a project decided within 30 days.