Documenting your IT environment

Why documentation gets skipped

In many small organizations, IT knowledge lives in one person's head. That might be an owner who set up the network years ago, a long-serving office manager or a former IT contractor. Everything works until that person is on vacation, leaves the company or is unavailable during an emergency, and then simple problems take hours or days to solve.

Documentation feels like a low priority because it does not fix anything today. Its value appears during incidents, staff changes, insurance renewals, privacy breach investigations and when you switch IT providers. A modest amount of effort to record the essentials pays back many times over the first time something goes wrong outside normal hours.

What to record

Start with the information you would need if your main IT contact disappeared tomorrow. You do not need a perfect manual. A structured set of notes that covers the essentials, kept up to date, is far more useful than a detailed document that was accurate three years ago and has not been touched since.

Include contract numbers, support phone numbers and account numbers for each vendor, since these are often what you need most urgently when a service is down and the person who usually calls is unavailable. Note renewal dates too, so that important services such as your domain name and security certificates do not lapse without anyone noticing.

• Network diagram showing internet, firewall, switches and Wi-Fi
• List of servers, computers and key devices with purchase dates
• Internet, phone and software vendors with support contacts
• Domain registrar, DNS and website hosting details
• Microsoft 365 or Google Workspace administrator accounts
• Backup systems, schedules and how to restore
• Line-of-business applications and who owns each one

Store credentials safely

Passwords and administrator credentials need special care. Do not keep them in a spreadsheet on a shared drive, in email or on sticky notes. Use a business password manager with multi-factor authentication, shared vaults for teams and an access log that shows who viewed what. This protects credentials while still making them available to the people who need them.

Make sure at least two trusted people in the organization, usually an owner and a senior manager, can reach the most critical credentials, such as the domain registrar and the global administrator account. Many organizations have lost control of their own domain or cloud tenant because the only person with access left, or because an outside contractor registered it under their own name.

Who owns the documentation

If you work with a managed IT provider, they will usually keep detailed technical documentation in their own system. That is useful, but you should also have access to it, or receive a regular export. Your contract should state that documentation and credentials belong to you and must be handed over promptly if the relationship ends.

Inside your organization, assign one person to own the business-side documentation, such as vendor contacts, contracts and application owners. Ownership does not mean doing all the work. It means making sure updates happen and that the information is reviewed on a schedule rather than only when someone urgently needs it.

Keep it current

Documentation is only useful if it is accurate. Build updates into existing processes: when a computer is purchased, add it to the asset list; when a vendor changes, update the contact sheet; when a new application is adopted, record its owner and administrator. Small updates as you go are much easier than a large clean-up every few years.

Review everything at least once a year, ideally alongside your IT budget planning. Keep a printed or offline copy of the most important information, such as emergency contacts and recovery steps, in a secure location. During a ransomware incident or a long outage, you may not be able to reach documents stored on the systems that are affected.