← All Blogs

What good IT documentation looks like when you open it

By Best IT MSP Editorial Team - Updated October 22, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What does good IT documentation look like when you open it?

Good IT documentation passes five tests you can run without understanding a word of the technical content. It carries a date later than the last change you know about. It names a person. It enumerates the items published guidance says that document type contains. It gives a second engineer enough to act on. And it sits somewhere you can still reach when the systems it describes are down.

Your provider says everything is documented, a document arrives, and you have no way to grade it. The low base rate is the reason to check. The UK government's annual survey found formal incident response plans at 25 percent of businesses, and 21 percent of micro businesses. Among small firms it found business continuity plans that address cyber security down to 44 percent from 53 percent in a year.

This is the question after 8 documents your MSP should be able to hand you, which tells you what to request. Here the thing is already in your hand. Each test below says what it checks and whether a published rule demands it or we are telling you it is sensible. Keep that distinction, because most of what gets sold as a documentation standard is practice rather than requirement.

• Read the date first, then compare it against a change you know happened.
• Find the owner, by human name and role, not by company.
• Check the contents against what published guidance says that document type holds.
• Test the usability by asking whether a second engineer could act on it alone.
• Locate the copy, and ask whether that location survives the outage the document exists for.

Does any published rule say IT documentation must be kept current?

Yes, and the strongest wording attaches a trigger rather than a calendar. The HIPAA Security Rule tells covered organizations to review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the protected data. Read that twice. The clock is not annual. It starts when something in your business changes.

Three rules set three different tests, and the difference decides what you may accept. The FTC Safeguards Rule runs on intervals, requiring a risk assessment that shall be written, further assessments performed periodically, and a report to the governing body regularly and at least annually. CISA asks for both at once, wanting accurate documentation describing current network topology that is updated when network topology changes are made, with network reviews performed and tracked on an annual basis.

A trigger beats an interval for your purposes. An annual review is satisfied by opening a file and closing it. A trigger gives you a checkable claim, because you can name a change and then look for it. Scope matters before you quote any of this. HIPAA binds covered entities and business associates, the Safeguards Rule binds non-bank financial institutions, and CISA's performance goals are voluntary. None of them governs a 20-person firm's network diagram. They are simply the clearest published statements of the test.

Test 1. Is the date later than the last change you know about?

Start with the date, because every other test depends on it. Name three changes you know happened in the past year, such as a new server, an office move, a staff departure, or a line of business you added. If the document predates all three and mentions none of them, it describes a company you no longer run.

No rule we could find requires a date stamp on an IT document, and that is worth saying plainly. The rules assume one instead. HIPAA's retention clause runs for six years from the date of its creation or the date when it last was in effect, whichever is later, which cannot be computed on an undated file. New York's financial regulator requires that current copies of the plans or relevant portions therein are distributed or are otherwise accessible to the employees who need them, and current is a claim about time. The date is the practice that makes the requirement checkable. One limit on that, stated so you can weigh it. The obvious place for a document-dating rule to live is ISO/IEC 27001, whose clause on documented information is the closest thing the field has to a general standard for this. Its clause text sits behind a paywall, so we could not read it and we make no claim about what it does or does not require. Everything above is what the freely published rules say. If your provider cites a standard at you, ask which clause and read it yourself before accepting it.

Two dates beat one. A created date tells you when the work was done, and a last-reviewed date tells you whether anyone has looked since. Where only one appears, assume it is the first. The network diagram is usually the artefact that goes stale first, because it changes whenever somebody touches the network and nothing breaks when it stops matching. CISA names that exact failure in asking for documentation updated when network topology changes are made.

Test 2. Does the document name a person rather than a company?

Look for a human name and a role. A document owned by your provider is owned by nobody, because a company cannot be asked why a section is wrong.

Published guidance is unusually direct here. New York's rule requires an incident response plan to address the definition of clear roles, responsibilities and levels of decision-making authority, and requires the continuity plan to identify the supervisory personnel responsible for implementing each aspect. The federal quality-assurance rule for nuclear plants states document control more plainly than any IT standard we could reach, requiring that documents be reviewed for adequacy and approved for release by authorized personnel and that revisions be reviewed and approved by the same organizations that handled the original approval.

Nuclear quality assurance is not your industry and we are not pretending it binds you. It is quoted because it says in one sentence what document control means anywhere. Somebody with authority approved this version, and the same authority approves the next one. A document that names no approver is a document nobody has taken responsibility for. Ask who signs each one off and who signs it off when that person is away. The staffing dependency behind that answer sits in who is your named engineer, and what happens when they leave.

Test 3. Does it contain what guidance says that document contains?

Compare the document against a published list of its parts, because contents is the one quality test a non-technical reader can score accurately. Two document types a small business actually receives have published contents lists.

The incident response plan

New York's cybersecurity regulation enumerates nine matters an incident response plan shall address, counted off the rule itself. They run from the plan's goals and internal response processes, through roles and decision authority, internal and external communication, remediation of weaknesses, documentation and reporting, recovery from backups and root cause analysis, to updating of incident response plans as necessary. Score the plan you hold against those nine. Provider plans usually cover the provider's own process and stop short of the communication plan, the root cause analysis and the update clause.

The contingency or disaster recovery plan

The HIPAA Security Rule splits a contingency plan into five named parts and marks three of them required.

• Data backup plan. Procedures to create and maintain retrievable exact copies of the data. Required.
• Disaster recovery plan. Procedures to restore any loss of data. Required.
• Emergency mode operation plan. Procedures to continue critical business processes while running in emergency mode. Required.
• Testing and revision procedures. Periodic testing and revision of the plans. Addressable, meaning the choice must be assessed and documented.
• Applications and data criticality analysis. A ranking of which systems and data matter most. Addressable.

Count how many of those five your document holds. A disaster recovery plan that covers backup and restore but says nothing about operating in emergency mode has delivered two parts of five. Ask when it was last exercised too, since the same regulator that lists the parts requires covered firms to test the plans periodically, but at a minimum annually with the staff critical to the response, and to revise them as necessary. The asset register has its own contents list and its own article, the IT asset register you can demand from your MSP today.

Test 4. Could a second engineer act on it?

Hand the document the test of a stranger. A document that only works for the person who wrote it is a personal note. You cannot verify the technical content yourself, so verify the shape instead. Look for named hosts, named accounts, steps in order, and decisions marked as decisions rather than left implied.

NIST sets that bar without using the word documentation. A baseline configuration is a documented set of specifications for a system, or a configuration item within a system that has been formally reviewed and agreed at a given point in time, and that changes only through change control. Three properties come with the definition, namely written down, formally reviewed, and version controlled. The same glossary defines configuration control as the process for controlling modifications to hardware, firmware, software, and documentation, which puts the document inside the change process rather than beside it.

The cost of failing this test is measured. Uptime Institute reported that nearly 40 percent of organizations suffered a major outage caused by human error over three years, and that 85 percent of those incidents stem from staff failing to follow procedures or from flaws in the processes and procedures themselves. Those are two separate failures and both are documentation failures. Either the procedure was skipped because it was not usable, or it was followed and it was wrong.

Speed is why this matters on a Tuesday rather than at renewal. Sophos found median attacker dwell time declined to three days across 661 incident response cases. Nobody gets a fortnight to work out what the runbook meant.

A document a second engineer can act on is documentation. A document only its author can act on is a personal note with a company logo.

Test 5. Is it stored where you can reach it when the systems are down?

Ask where the document lives, then ask whether that place survives the event the document exists for. A recovery plan stored on the file server you are recovering is not available on the day you need it.

This is the test with the most published support. New York requires current copies distributed or are otherwise accessible, including during a cybersecurity event, to all employees necessary to implement the plans, which names the exact failure. HIPAA requires covered organizations to make documentation available to those persons responsible for implementing the procedures to which it pertains, and permits the record to be written or electronic. The nuclear rule goes furthest, requiring documents distributed to and used at the location where the prescribed activity is performed and records kept identifiable and retrievable.

Three questions settle it. Who holds a copy outside the systems it describes. Can a named person retrieve that copy without logging into your network. Is the copy they hold the current one. The wider out-of-band problem, including what a usable offline set looks like and who rehearses it, sits in untested incident response plan? ask for the after action report.

Which of these five tests is a published requirement, and which is not

Separate the two before you quote any of this at your provider, because presenting practice as a requirement turns a reasonable request into an argument you lose. None of the rules below binds a general small business unless it is a covered entity under HIPAA, a licensee of New York's financial regulator, or a financial institution under the FTC Safeguards Rule.

• Currency is a requirement in three places. HIPAA requires review and update in response to operational change, the Safeguards Rule requires periodic written assessment, and CISA asks for documentation updated when the topology changes.
• A named owner is a requirement inside specific plans, because New York's rule requires roles, decision authority and the supervisory personnel responsible for each aspect of continuity.
• Accessibility during the event is a requirement, stated almost word for word in New York's rule and supported by HIPAA's availability clause.
• Contents are a requirement for those two document types only. Nobody publishes a contents list for a runbook or a password vault export.
• A date, a version number and a change record are practice, not published requirements for IT documentation. The rules assume a date and regulate document control in other industries.

Read that last line as the honest limit of this article. A provider who declines to date a diagram is not breaking a rule. They are declining to make their work checkable, which is a fair thing to raise at renewal and a reasonable line to put in a service level agreement.

Four things to send your provider this week

Send four requests rather than a complaint, because each has a factual answer and a date.

• Ask for the network diagram and the asset register with their last-reviewed dates, then name three changes from the past year and look for them.
• Ask who approves each document, by name and role, and who approves it when that person is unavailable.
• Ask for the incident response plan and the disaster recovery plan, and score each against the published contents lists above.
• Ask where a current copy is held outside your network, and who can retrieve it during an outage.

Run the checks soon rather than at renewal, because the evidence trail expires faster than the contract. Microsoft retains Entra ID audit and sign-in logs for seven days on the free tier and 30 days on P1 and P2, and Sophos found cases hampered by missing logs doubled over the previous year, largely driven by firewall appliances where the default was only seven days. If a change happened two months ago, the record of who made it may already be gone, and the document is the only account left.

The stakes are ordinary rather than exotic. Verizon found a third party involved in 48 percent of all breaches, and your provider is the third party holding administrator credentials in your systems. None of these five tests makes a document correct, and no honest provider promises that. They tell you whether anybody has maintained the record since the day it was written. If the answers come back thin, the shortlist is not, since our own directory data shows a median of 16 listed providers per market across 730 city datasets. The half-hour version of this conversation sits in the one-page service review a busy owner can actually run.

FAQ

How can I tell if my IT documentation is out of date?

Name three changes you know happened in the past year, then look for them in the document. If it predates all three and mentions none, it is stale. HIPAA sets the standard for covered organizations, requiring documentation reviewed periodically and updated in response to environmental or operational changes rather than on a fixed annual cycle.

Does any regulation require IT documentation to be updated?

Yes, for covered organizations. The HIPAA Security Rule requires review and update in response to environmental or operational changes, and the FTC Safeguards Rule requires a written risk assessment with further assessments performed periodically. CISA's voluntary goals ask that documentation be updated when network topology changes are made. None of the three binds a general small business.

Should IT documentation have a version number and a change record?

Yes as good practice, no as a published requirement. No rule we could find mandates a version number on an IT document. NIST defines configuration control as the process for controlling modifications to hardware, firmware, software, and documentation, and the federal nuclear quality rule requires revisions reviewed and approved by the same organizations that approved the original.

What should an incident response plan contain?

New York's cybersecurity regulation lists nine matters, including the plan's goals, internal response processes, clear roles, responsibilities and levels of decision-making authority, communications, remediation of weaknesses, reporting, recovery from backups, root cause analysis, and updating of incident response plans as necessary. Score the plan you were given against those nine and count what is missing.

Where should IT documentation be stored?

Somewhere reachable when the systems it describes are down. New York requires current copies distributed or are otherwise accessible, including during a cybersecurity event, and HIPAA requires documentation made available to those persons responsible for implementing the procedures. Ask who holds a copy outside your network and whether that copy is the current one.

← All Blogs