Every organization runs on knowledge that lives in someone’s head. The office manager knows which wireless network the point-of-sale system uses. The longest-serving employee remembers the admin password for the phone system. The owner can describe, roughly, how the backups work. That arrangement feels fine right up until the day the person holding the knowledge retires, resigns, wins the lottery or simply forgets. In a region as mobile as Kitchener-Waterloo, where skilled people change roles often, undocumented IT is a genuine business risk. The fix is unglamorous and inexpensive: write it down, keep it current, and keep it somewhere safe. What follows is the documentation every business should maintain, what belongs in each record, and how to stop it from turning into a dusty binder nobody opens.
The Core IT Documentation Every Business Should Keep
Start with the asset register. This is a plain list of every piece of technology the business owns or leases: laptops, desktops, servers, switches, firewalls, wireless access points, printers, network-attached storage, and the monitors and docks that go with them. For each item, record the make and model, serial number, purchase date, warranty expiry, who is currently using it, and where it physically sits. That single document answers questions that otherwise take hours to untangle. When a laptop fails under warranty, you know immediately whether you are covered. When an insurer asks what was in the office after a break-in or a burst pipe, you have an answer. When it is time to refresh aging hardware, you can plan instead of panic.
Next comes network documentation. A simple diagram showing how the internet connection enters the building, what it connects to, and how devices reach each other is worth more than most business owners realize. It should capture the internet and backup circuits with account numbers, the firewall and its rule changes, switch locations and port assignments, the IP addressing scheme, wireless network names, and — critically — how the guest network is separated from the business network. Add a note of where the cabling runs and who installed it. In a multi-floor office in Downtown Kitchener or a warehouse in Huron Business Park, this map is the difference between a twenty-minute fix and a two-hour search through ceiling tiles.
The third essential is an access and credentials register. Passwords belong in a password manager, not a spreadsheet or a sticky note, but the register should also record who has access to what: the Microsoft 365 global administrators, the line-of-business application accounts, shared mailboxes, banking portals, domain registrar, DNS host, and the recovery methods behind multi-factor authentication. Just as important is the offboarding side of the same document — the checklist for disabling accounts, collecting devices, forwarding mail and rotating shared passwords when someone leaves. A departed employee with a live mailbox and cloud storage login is one of the most common and most avoidable security gaps.
Then keep a software and licence inventory: which Microsoft 365 plan each person is on, subscription renewal dates, licence counts, contract terms, and who owns the tenant. Round it out with a vendor and contact directory — internet provider, domain registrar, web developer, software vendors, alarm company, landlord, electrical contractor — along with escalation contacts and expected response times. None of this is glamorous, but together these records form the foundation of every efficient IT decision a business makes.
Documentation That Protects You When Something Goes Wrong
The second category of documentation is the one that earns its keep on the worst day of the year. Begin with backup configuration and a written restore procedure. Record exactly what is backed up, how often, where the copies live, how long they are retained, and who is authorized to restore them. Then document the actual steps to bring back a single deleted file and, separately, to rebuild a server. An untested backup is not a backup; it is a hope. A restore procedure that has never been walked through will always take longer than expected, usually at the least convenient moment.
Alongside it, keep a disaster recovery and business continuity plan. This is less technical and more practical: which systems are genuinely critical, what order they need to come back in, who can work remotely and with what equipment, how phone calls get redirected, and how staff will communicate if email is unavailable. A short, realistic document beats a fifty-page template nobody has read. For a business without in-house IT, this is exactly the kind of work where a partner offering managed it kitchener services can supply templates, ask the awkward questions and rehearse the scenario with you, rather than leaving you to guess under pressure.
Add a security and incident response plan. Document multi-factor authentication coverage, patching responsibilities, endpoint protection, and — importantly — what a staff member should do the moment they suspect a phishing email or a compromised account. Who do they call, in what order, and what should they avoid doing? A one-page “if this happens, do this” sheet prevents the panicked clicking that turns a nuisance into a breach. Wire it into your onboarding so new hires read it in their first week.
Finally, record the escalation matrix: who to contact for what, during business hours and after hours. When the point-of-sale system goes down on a Saturday, nobody should be scrolling through old texts looking for a phone number. A documented support path is a small thing that pays for itself repeatedly.
How to Keep IT Documentation Accurate, Secure and Actually Used
Documentation fails for predictable reasons: it is out of date, nobody can find it, or it is stored somewhere so open that it becomes a roadmap for an attacker. Solve the first problem with ownership and a review cadence. Give every document a named owner, a last-reviewed date and a version number, and revisit the set quarterly or whenever something significant changes — a new hire, an office move, a switch in internet provider, a new application. Retire stale documents rather than leaving them to mislead the next person who reads them. A single source of truth, clearly labelled, beats five conflicting files scattered across shared drives.
Solve the second and third problems with secure, permission-controlled storage. Network diagrams, credential registers and recovery procedures should be available only to the people who genuinely need them, not to every user on the file server. Keep an offline or printed copy of the critical recovery steps, because the moment you most need the digital version is often the moment the network is unreachable. Test that you can still open your documentation when your systems are down; it sounds obvious and it is routinely overlooked.
Scale the effort to the business. A twelve-person professional firm in Belmont Village and a forty-person manufacturer in the Innovation District need the same core records, just at different levels of depth. Start with the asset register and the access register, since those are quick wins with immediate value, then build out the network map and the recovery plan. If documentation feels like a project that never gets scheduled, attach it to events you already have: a new hire, a hardware purchase, a contract renewal. Each one is a natural prompt to update the record while the details are fresh.
There is one more practical point worth raising with any IT provider, whether you are reviewing an existing relationship or considering a change. Ask who owns the documentation. Diagrams, password vaults, licence records and recovery procedures should belong to your business, handed over in a usable format, and updated as part of the service rather than treated as a trade secret. A provider that documents your environment thoroughly and shares it willingly is confident in its work; one that keeps the details to itself is creating a dependency you will eventually pay for.
