Scorecard · free
Managed services scorecard
For IT leaders at midsized organizations who want a quick, honest read on how well their servers, network, cloud workloads and backups are watched, patched and recoverable. Score each statement 0 (no), 1 (partly) or 2 (yes), then add up your points out of 42.
Monitoring and alerting
| # | Statement | Score (0–2) |
|---|---|---|
| 1 | Critical infrastructure, including physical and virtual servers, is continuously monitored for availability, performance, capacity and service health. | 0 · 1 · 2 |
| 2 | Critical network infrastructure, including switches, firewalls and WAN connectivity, is monitored for availability, performance and potential failures. | 0 · 1 · 2 |
| 3 | Cloud workloads are monitored alongside on-premises systems, including VMs, storage capacity and latency, and VPN or private links to the cloud. | 0 · 1 · 2 |
| 4 | Someone watches and responds to alerts at night and at weekends, not just during business hours. | 0 · 1 · 2 |
| 5 | Alerts create tickets automatically, are tracked until closed, and thresholds have been tuned so real problems are not lost in noise. | 0 · 1 · 2 |
| 6 | Infrastructure performance and capacity trends are regularly reviewed to identify potential issues before they impact business operations. | 0 · 1 · 2 |
Patching
| # | Statement | Score (0–2) |
|---|---|---|
| 7 | Server operating systems and infrastructure platforms are patched according to a documented schedule, with appropriate pre-patch checks, post-patch validation and rollback procedures. | 0 · 1 · 2 |
| 8 | Common third-party applications are patched too, including critical vendor patches that fix known vulnerabilities (CVEs). | 0 · 1 · 2 |
| 9 | You know your current patch compliance level and which systems are critically behind or on unsupported versions. | 0 · 1 · 2 |
| 10 | Critical security vulnerabilities are assessed promptly, with documented procedures for emergency patching or implementing compensating controls when immediate patching is not possible. | 0 · 1 · 2 |
Backup and recovery
| # | Statement | Score (0–2) |
|---|---|---|
| 11 | Backup jobs are monitored daily, with failures and missed backups identified and escalated. | 0 · 1 · 2 |
| 12 | Failed backup jobs are investigated and remediated within defined timeframes, with recurring failures tracked and addressed. | 0 · 1 · 2 |
| 13 | At least one backup copy is immutable or isolated from the production network, and encryption is turned on. | 0 · 1 · 2 |
| 14 | Every critical system has current backup coverage, matched to documented recovery time and recovery point objectives (RTO and RPO). | 0 · 1 · 2 |
| 15 | A restore of a critical system has been tested in the last 12 months, and the result is written down. | 0 · 1 · 2 |
| 16 | Microsoft 365 or Google Workspace data is backed up, not just left to the platform. | 0 · 1 · 2 |
Documentation, access and escalation
| # | Statement | Score (0–2) |
|---|---|---|
| 17 | You have a current inventory of servers and network devices and an up-to-date network diagram, kept in one system of record. | 0 · 1 · 2 |
| 18 | Admin credentials sit in a secure vault with scoped access. They are never sent by email or chat or stored in documents. | 0 · 1 · 2 |
| 19 | There is a written escalation path that defines a critical (P1) incident, who can declare one and who responds. | 0 · 1 · 2 |
Reporting and review
| # | Statement | Score (0–2) |
|---|---|---|
| 20 | Service performance is reviewed at least quarterly, with incident and trend analysis and clear recommendations. | 0 · 1 · 2 |
| 21 | IT leadership has timely visibility into infrastructure health, incident trends, service performance and emerging operational risks. | 0 · 1 · 2 |
How to read your result
Add up your scores. The maximum is 42.
- 0–20: Significant gaps. Problems are probably found by users, or during a restore, rather than by monitoring. Start with any 0 scores in Backup and recovery, then overnight coverage (item 4).
- 21–33: Partial coverage. The basics are in place, but some areas depend on effort and goodwill rather than a routine. Look for groups where most answers are 1, and decide who owns each gap.
- 34–42: Strong coverage. Keep it that way by testing restores, reviewing alert thresholds and keeping documentation current as the environment changes.
Whatever your total, a 0 on items 11, 14 or 15 is worth fixing first. A backup that has never been checked or tested may not be there when you need it.
If you scored below 34, or 0 on items 11, 14 or 15, contact Kalosys today. We’ll walk through your results with you, and your note goes straight to our managed services team.