Fort Morgan Business IT Audit Checklist: 10 Things to Check Before Ransomware Hits

Quick takeaways

• Backups: test a real restore from Microsoft 365, Google Workspace, workstations, servers, and critical files
• MFA: verify multi-factor authentication on every admin, email, financial, and cloud account
• Email security: check for forwarding rules, stale mailbox permissions, and phishing protection
• Former-user access: remove accounts, licenses, devices, and vendor access for departed employees
• Endpoint protection: confirm EDR or antivirus is installed, updated, and alerting the right people

1. Backups: can you restore from a real test?

A backup report that says 'success' is not the same as a recovery plan. For Fort Morgan businesses, the first audit step is testing a real restore: pick a critical file, a mailbox, a shared folder, or a server, and recover it to a test location. If the restore fails, the backup is useless — no matter what the dashboard says.

Check that backups cover Microsoft 365 or Google Workspace data (email, contacts, calendar, files), shared files, workstations, servers, accounting data, and any cloud databases. Document where the copies live, who receives failure alerts, and how long a restore would take during ransomware, hardware failure, or accidental deletion.

2. MFA: is multi-factor authentication on every critical account?

MFA is the single most effective control against account takeover. Check every admin account, email account, financial system, cloud platform, remote access tool, and vendor portal. If any critical account does not have MFA, that is the first fix.

For Fort Morgan businesses using Microsoft 365 or Google Workspace, MFA should be enforced through conditional access policies — not left to individual users. RightCyber can review MFA status across all accounts and enforce it organization-wide.

3. Email security: forwarding rules, stale permissions, and phishing

Email is the most common entry point for business email compromise. Check for mailbox forwarding rules that send copies to external addresses, stale permissions that let former users read mailboxes, and whether email filtering is catching phishing and spoofing attempts.

For Fort Morgan businesses, a quick email security review can reveal hidden forwarding rules, shared mailbox access that was never cleaned up after a departure, and whether DMARC, SPF, and DKIM records are properly configured to prevent spoofing.

4. Former-user access: what happens when someone leaves?

When an employee leaves a Fort Morgan business, their access should be removed promptly: email account, Microsoft 365 or Google Workspace license, workstation, VPN, shared files, third-party apps, and vendor systems. Too often, access lingers for months or years because nobody owns the offboarding process.

RightCyber helps Fort Morgan businesses build simple onboarding and offboarding checklists so departed employees are cleaned up within 24-48 hours. This also frees up licenses and prevents stale accounts from becoming security risks.

5-10. Endpoint, firewall, Wi-Fi, vendor access, documentation, and response plan

The remaining five items on the Fort Morgan IT audit checklist are: endpoint protection (EDR or antivirus installed, updated, and alerting), firewall configuration (rules reviewed, unnecessary ports closed, firmware current), Wi-Fi security (WPA3 or WPA2-Enterprise, guest network segregated), vendor access (who has remote access and why), documentation (network diagram, password vault, vendor contacts), and ransomware response plan (who to call, what to do first, how to communicate).

Each of these can be reviewed in 15-30 minutes. RightCyber offers a free 15-minute IT risk check for Fort Morgan and Morgan County businesses that covers the highest-impact items and gives you a short cleanup list — no sales pitch, no pressure. Call or text (970) 743-0588 to schedule yours.

FAQ

Related help