Something in most buildings is older than the person who has to use it. It usually still works, which is exactly why nobody has dealt with it. Here is what dealing with it actually looks like.
How old is the equipment, what is still under support, and what happens to the work if any of it stops today.
What is connected, what can reach what, and whether the network still reflects how the business is actually laid out.
Not whether something is backing up. Whether somebody has restored from it on purpose and knows what came back.
Where multi-factor authentication is genuinely switched on, and where it is described as mostly rolled out.
Every machine, what is on it, how old it is, and what still depends on it. You keep that document whatever you decide.
What is fine, what is near the end of its life, and what we would deal with first, with the reason next to each one.
A written refresh schedule with a number against each year, so this never becomes an emergency purchase again.
Tell us what is still in service and we will tell you what we would do about it, whether or not you hire us.