Today is the last day of Q3. For most of our clients, October through December is the busiest stretch of the year, and technology planning usually slides to January.
I'd argue Q4 is the best quarter to do it. Budgets are still open, renewals cluster between now and March, and your busiest weeks are about to test whatever has been put off. Here is the checklist I would work through.
Find every renewal between now and March
Make one list of every technology renewal that lands before the end of March: Microsoft 365, other software subscriptions, backup services, security tools, domain names, SSL certificates, internet and phone contracts, and hardware warranties or support agreements.
In our experience, two things turn up every time. Something is auto-renewing that nobody has used in a year, and something you depend on renews in your busiest month. That's the worst time to find a price increase or an expired card on file.
If you only do one item on this list, I'd make it this one. It takes an afternoon, and it is the one that reliably pays for itself.
Decide what expiring budget should buy
If this year's budget does not carry forward, decide now what it is for. Wait until December and a planned purchase turns into whatever can ship before December 31.
This is the order I'd spend it in:
- Replace the machines that are already costing people time.
- Move anything still on Windows 10 onto a supported version.
- Close a security gap you already know about.
- Pay for documentation or an assessment if nobody can tell you what you own today.
I wouldn't spend it on hardware you don't need yet. Next year it is a year older, and you've paid for a year of warranty you didn't use.
Confirm who covers the holidays
Work out now who is available between mid-December and the first week of January, on your side and on your provider's. Be specific. If something stops working on December 27, who picks it up, how do they get reached, and does the person in your office who'd notice first know that?
When I've seen holiday coverage fail, it was almost always because the person who spotted the problem did not know who to call.
Walk around and look at the machines
Go look at what people are actually working on. For each machine, ask how old it is and whether it slows anyone down. The ones that cost someone 15 minutes a day are more expensive than they look, and they rarely generate a ticket.
Note anything still running an operating system that no longer gets security updates. Windows 10 stopped getting them on October 14, 2025, unless you paid for Extended Security Updates. That is a risk and cyber insurance question, separate from speed.
Make sure a backup has actually been restored
Backups running is not enough. What you want to know is that someone restored something from a backup recently, on purpose, and can tell you how long it took.
It is the most common gap I see when we take on a new client, and I'd check it every quarter.
Ask your provider for the year on one page
Ask for a short written summary of the year: what got done, what broke, what they recommended that wasn't approved, and what they think you should plan for in 2027.
The document is useful, and so is how fast it shows up. A provider who has been paying attention can turn it around quickly, because they have been keeping the record all year.
Write down your Q1 priorities now
Skip the full roadmap. Write down the few items that matter most for Q1, with rough costs.
Doing this in October means the money is in next year's budget instead of competing with an emergency, and the work lands in a quiet month. Once the renewal list and the machine walk are done, most businesses find the priorities pick themselves.
Two risks to close before the busy season
If this list gives you more than you can get to, I'd close these two first. Both get worse under seasonal pressure.
Anything that depends on one person. If one person holds a password, an account, or knowledge that is not written down anywhere, the busy season is when it shows. Writing it down costs nothing.
Anything a phishing email could turn into a payment. Invoice fraud and fake supplier emails go up in Q4, because there are more legitimate unusual requests and everyone is moving faster. The fix is one rule about how payment details get changed, and everyone who could act on a request needs to know it.
If you only have a couple of hours
In my experience, most businesses won't get to all seven. If you do the renewal list and the backup restore test, you've covered most of the real risk in a couple of hours.
If you'd rather go through it with someone, a written assessment of what you have covers every item here and only needs a couple of conversations with your team. If you're in decent shape, that is what it will say. Or book a free 15-minute call and we'll talk it through.