What Good IT Documentation Looks Like (and Red Flags)

Real documentation isn't a binder of screenshots from three years ago. It's a living set of records that someone new could pick up and use to run your environment without calling the person who built it.

A network diagram that matches reality

This should show every firewall, switch, access point, server, and circuit — with IP addresses, VLANs, and physical locations. If the diagram still shows a router you replaced two years ago, it's decoration, not documentation. Good network technology management means the diagram gets updated the same week a change happens, not "eventually."

Credential management, not a spreadsheet

Passwords for firewalls, servers, and admin accounts belong in a proper password vault with access logging — not an Excel file on someone's desktop or, worse, in someone's head. This is also where privileged access management comes in: you want a record of who can get to what, and when they last used that access. Verizon's 2026 DBIR found credential abuse shows up at some point in 39% of breaches — Verizon 2026 DBIR — which makes sloppy credential tracking a direct security risk, not just an inconvenience.

Runbooks for the boring, repeatable stuff

How do you onboard a new employee? What's the exact process to restore a file from backup? What happens when the internet circuit at your Round Rock office drops? These procedures should be written down step by step, so the answer doesn't depend on one person's memory or availability.

A change log

Every firmware update, firewall rule change, and new server should get logged with a date, the reason for the change, and who made it. Six months later, when something breaks, this log is the difference between a ten-minute diagnosis and a two-day guessing game.

Vendor and license inventory

Who hosts your email? When does your cyber insurance policy renew? What's the support contract number for your line-of-business software vendor? This should live in one place, not scattered across inboxes and sticky notes.

Missing documentation almost never means "we haven't gotten around to it yet." It usually means one of two things: either the provider doesn't have the discipline to maintain it, or they're intentionally keeping you dependent on them. Both are problems.

The financial exposure is real too. When ransomware hits and nobody has a current network map or a tested recovery runbook, response time balloons. Sophos found the median cost to recover from a ransomware attack, not counting any ransom paid, runs $375,000 — Sophos State of Ransomware 2026. Businesses with clean documentation and tested recovery plans consistently land at the low end of that range because their team isn't relearning the environment while the clock runs. Notably, 69% of victims in that same study didn't pay the ransom at all, up from 65% — Sophos 2026 — which tells you recovery capability, not ransom payment, is what determines the outcome.

Patch management tells a similar story. The DBIR's 2026 data shows the median time to fully remediate a known-exploited vulnerability climbed to 43 days, up from 32 — Verizon 2026 DBIR, Fig. 13. Without a documented patch cadence and a log proving what got fixed and when, you have no way to know if you're at 43 days or 143.

Texas SB 2610, effective September 1, 2025, gives businesses with 20 to 99 employees protection from exemplary damages in a data breach lawsuit if they've implemented the CIS Controls IG1 safeguard set — Texas SB 2610. It bars exemplary damages specifically; it doesn't create a new right to sue, and it's not a blanket shield. But here's the catch: you can't claim that protection if you can't prove you did the work. Documentation is the proof. If your provider can't hand you evidence of the 56 IG1 safeguards in place — asset inventories, access controls, logging — that legal protection is worthless to you. This same documentation discipline overlaps heavily with what auditors expect under FTC Safeguards Rule compliance and, for healthcare and dental practices, HIPAA requirements.

Ask your current IT provider — internal staff or outsourced — for three things: the current network diagram, the credential vault access list, and the last three entries in the change log. If they can produce these in a day, you're in decent shape. If it takes a week or comes back incomplete, you've found your gap.

This same checklist is worth running before you sign with a new provider, too. Our guide to switching IT providers walks through exactly what to demand during a transition so you're not left holding an undocumented mess. And if you're weighing whether to bring on managed IT services for the first time, documentation quality is one of the fastest ways to separate a serious provider from one coasting on relationships.

Good documentation isn't glamorous. It's also the single clearest signal of whether the people running your network actually know what they're doing, or whether you're one resignation letter away from a very bad week.

Who owns IT documentation — us or our IT provider?

You should. A provider can maintain it, but you own the business and the risk, so you need guaranteed access to diagrams, credentials, and logs at any time, not just when the relationship is ending on good terms.

How often should documentation be updated?

Network diagrams and credential vaults should update the same week a change happens. Full documentation reviews should happen at least quarterly, and definitely after any significant infrastructure change or security incident.

Does documentation matter for a small business with under 20 employees?

Yes. SB 2610's exemplary-damages protection applies to the 20-99 employee band specifically, but the operational risk of undocumented IT — slow recovery, dependency on one person, unclear vendor obligations — hits businesses of every size.

What's the fastest way to find out if our documentation is any good?

Request the network diagram, the credential access list, and the last handful of change log entries. How fast and complete that response is tells you almost everything you need to know.

If you want a second set of eyes on what your current setup actually has on file, request a free IT assessment or contact our team — we're 100% Texas-based, with offices in The Woodlands and Round Rock, and we've cleaned up more undocumented networks than we can count.