Kids went back with supply lists. Your business did not. September is still the right reset, because summer is when small shops get sloppy and Q4 is when you stop having time to fix it. National Preparedness Month is a convenient label. The work is ordinary: backups that restore, accounts that still belong to the right people, and a plan for a down day that does not depend on one person's memory.
You need six boxes an owner can mark green or red at the Monday meeting.
1. Backup that restores
A green icon in a backup tool is not a recovery. Restore one real folder or mailbox this month and open the file. If you cannot, the box is red.
Write down what you would need on a bad morning: accounting, customer list, current work, email. If those live only on one laptop, you do not have a backup. You have a single point of failure with a charger.
2. Who is still on the accounts
Former staff, the web person, the CPA, a family member who helped with IT, a vendor who set up email two years ago. Pull the list for email, banking, the password manager (if you have one), social, and the shared drive. Remove what should not be there.
If you cannot produce the list, that is the first task. You cannot lock a door you have not found.
3. The tools you pay for
Q4 is a bad time to keep paying for two products that do the same job. List subscriptions. Mark the ones nobody opened in August. Pick a kill date or a keep date.
Fewer tools means fewer passwords, fewer invoices, and fewer ways to lose a file. This is one of the few checklist items that can return cash the same month.
4. Devices
Updates, disk encryption if the machine holds customer or payroll data, and the one computer that still has the company on the desktop. If a laptop went to the beach and came back, assume it needs a look.
You do not need an enterprise image. You need to know which machines exist, who uses them, and whether they still get patches.
5. The down-day card
One page. Who you call (IT partner, accountant, payment processor, landlord if the issue is the office). What you tell customers. What you can still do with phones and paper. Where the last known-good files live.
Put it in a drawer and on your phone. If the only copy is in the email system that just died, the card failed its first test.
6. Insurance questions before the claim
You do not need a new policy for this checklist. You need to know what your current policy will ask after an incident: proof of backup, multifactor, who had access. If you cannot answer those today, you will not enjoy answering them after the fact.
Call the agent with three questions, or put those three questions on the September list. Do not wait for a claim to read the PDF.
How to run the list without making a project out of it
Print the six lines or put them in a note. The owner marks color. Someone else gets the red items. Twenty minutes. Two-week follow-up.
If two or more boxes are red, you do not need a strategy deck. You need a partner who does backup, disaster recovery, and cybersecurity for shops like yours. NewPush has done that work with 5,000+ SMBs.
What this is not
It is not a request to buy a platform. It is not a survey result. It is the minimum an owner should be able to say out loud before the year-end rush: we can restore, we know who is on the accounts, we can work for a day if the systems do not.
After the boxes are marked
Green boxes get a date to recheck in January. Red boxes get an owner this week. Anything that requires a product decision waits until the restore and the access list are honest.
If two or more boxes are red, treat that as a preparedness gap.
The checklist tells you if the shop can finish the year. It does not tell you how ready the company is for AI.
If you want an honest read on that, start Phase 0. Take the AI readiness assessment. You get a Trainer login and a next step you can actually use.
