Managed IT Services Tech Stack Audit for Lake Forest Businesses

Continuously monitors endpoints for suspicious activity and provides automated threat containment and remediation.

• •Is EDR deployed on 100% of managed endpoints including remote devices?
• •Are detection rules updated and tuned at least monthly?
• •Does the solution provide real-time alerting with mean response times under 15 minutes?

Enforces security policies, manages app deployments, and enables remote wipe capabilities across all mobile devices.

• •Are all company-owned and BYOD devices enrolled in MDM?
• •Can devices be remotely locked or wiped within minutes of a reported loss?
• •Are OS and app patch compliance rates tracked and above 95%?

Ensures that all endpoint storage is encrypted and systems are configured to minimize attack surface.

• •Is full-disk encryption enabled on every managed device?
• •Are unnecessary services and ports disabled by default?
• •Are hardening baselines benchmarked against CIS or NIST standards?

Provides real-time visibility into network performance, bandwidth utilization, and anomalous traffic patterns.

• •Does the monitoring tool cover all switches, routers, firewalls, and access points?
• •Are automated alerts configured for latency spikes, packet loss, and device failures?
• •Is historical performance data retained for at least 12 months for trend analysis?

Inspects traffic at the application layer, blocks intrusions, and enforces granular security policies across the network perimeter.

• •Is the firewall firmware current and within the vendor's active support lifecycle?
• •Are intrusion prevention signatures and threat feeds updated automatically?
• •Is network segmentation enforced between guest, corporate, and server VLANs?

Optimizes connectivity between Lake Forest offices, cloud applications, and remote sites for improved performance and redundancy.

• •Is there automatic failover between primary and secondary internet circuits?
• •Are cloud application traffic policies prioritized for critical SaaS tools?
• •Is WAN performance benchmarked quarterly against SLA targets?

Delivers secure, high-performance wireless connectivity for employees and guests across all business locations.

• •Are access points running Wi-Fi 6 or later with WPA3 encryption?
• •Is a separate guest network isolated from internal resources?
• •Are rogue access point detection and alerting enabled?

Performs scheduled backups of critical servers, workstations, and cloud data to ensure recoverability in any failure scenario.

• •Are backups running daily with both on-site and off-site or cloud copies?
• •Is backup success and failure monitored with daily verification reports?
• •Are backup retention policies documented and compliant with industry requirements?

Defines recovery time objectives (RTO) and recovery point objectives (RPO) and validates them through regular failover testing.

• •Has a DR plan been documented and reviewed within the last 12 months?
• •Are DR failover tests conducted at least semi-annually with documented results?
• •Can critical systems be restored within the defined RTO of 4 hours or less?

Provides independent backup of cloud-hosted email, files, and collaboration data that native retention policies do not fully protect.

• •Are Exchange Online, SharePoint, OneDrive, and Teams data backed up independently?
• •Can individual items be restored granularly without full tenant recovery?
• •Is backup data stored in a separate cloud environment from production?

Requires a second form of verification beyond passwords to protect user accounts from credential-based attacks.

• •Is MFA enforced for all users across email, VPN, and cloud applications?
• •Are phishing-resistant MFA methods like hardware keys or authenticator apps used instead of SMS?
• •Is MFA enrollment monitored with exceptions flagged and remediated within 48 hours?

Centralizes authentication across multiple applications to reduce password fatigue and improve access visibility.

• •Are all major business applications integrated into the SSO platform?
• •Is conditional access configured based on device compliance, location, and risk level?
• •Are SSO login events centrally logged and reviewed for anomalies?

Secures and audits administrative accounts that have elevated permissions to critical systems and data.

• •Are admin accounts separated from daily-use accounts for all IT staff?
• •Is just-in-time access provisioning used for privileged operations?
• •Are privileged session recordings or audit logs maintained for at least 90 days?

Streamlines onboarding, role changes, and offboarding to ensure access rights are always accurate and promptly revoked.

• •Are new hire accounts provisioned through an automated workflow tied to HR systems?
• •Is access revoked within 1 hour of an employee's termination?
• •Are quarterly access reviews conducted across all critical applications?

Provides centralized remote access, system health monitoring, and automated maintenance across all managed devices.

• •Are all desktops, laptops, and servers enrolled in the RMM platform?
• •Are automated scripts used for routine tasks like disk cleanup, reboots, and log collection?
• •Does the RMM platform integrate with ticketing and alerting systems for seamless workflows?

Automates the deployment of OS and third-party application patches to close known vulnerabilities quickly.

• •Are critical patches deployed within 72 hours of release?
• •Is patch compliance tracked with a target rate above 95%?
• •Are third-party applications like browsers, Java, and PDF readers included in the patching scope?

Maintains centralized, up-to-date documentation of network configurations, credentials, procedures, and vendor contacts.

• •Is documentation stored in a secure, version-controlled platform accessible to the IT team?
• •Are network diagrams, IP schemas, and escalation procedures current within the last 6 months?
• •Are password and credential vaults integrated with documentation for secure retrieval?

Continuously assesses cloud environments like Azure and AWS for misconfigurations, compliance violations, and security risks.

• •Are cloud resource configurations scanned weekly against security benchmarks?
• •Are alerts generated for publicly exposed storage, overly permissive roles, or unencrypted resources?
• •Is a cloud security score tracked and reviewed in monthly IT reviews?

Filters inbound and outbound email for phishing, malware, spam, and business email compromise attempts.

• •Is advanced threat protection enabled with sandboxing for suspicious attachments?
• •Are DMARC, DKIM, and SPF records properly configured and monitored?
• •Are end-user reported phishing emails triaged and responded to within 2 hours?

Applies recommended security configurations to the Microsoft 365 tenant to reduce exposure from default settings.

• •Has the Microsoft Secure Score been reviewed and is it above 75%?
• •Are legacy authentication protocols disabled across all services?
• •Are data loss prevention policies configured for sensitive data like PII and financial records?