What to check in IT infrastructure
before you invest

Current state first, then the purchase

A new infrastructure investment often starts with an offer: a new server, new storage, a new network. The useful order is the other way round. First you need to know what you already have, which of it still does its job, and which problem you are actually trying to solve. Otherwise you buy capacity you do not lack, or you replace a part that is not the cause.

That is an IT infrastructure review: a technical picture clear enough that an investment decision can be defended.

A list of what exists

Servers, workstations, network devices, storage, backups, licences, names of who maintains what. Without that list every quote is a guess. The list does not have to be pretty. It has to be accurate: what is switched on, where it stands, what it is for.

In the same pass, mark what is business-critical — mail, invoicing, production, shared documents — and what is useful but can stand a pause. Investment without that distinction treats everything as equal, and the business does not.

CPU, memory and storage

CPU, RAM and disk tell you whether a machine is slow because it is old, because it is loaded, or because it is badly arranged. A full disk and a spare processor are not the same problem. Short memory and a slow disk are not either. Without that reading, “we need a stronger server” remains an impression.

Check how storage is divided as well: system, data, copies. If everything lives on one disk, a new purchase without separating them only repeats the same risk on faster hardware.

Lifecycle and vendor support

A device can still run and no longer receive patches. A vendor can stop supplying parts. Software on it can sit on a version nobody still repairs. That is not the same as slow performance. It is a date after which a fault or a hole has no proper answer.

Write down, for each important piece, how long support lasts. Investment makes sense when that date is arriving, or has already passed, and the business still depends on that piece. It does not make sense when the device is still supported and doing its job, and is being changed because an offer arrived.

The network

A server that users cannot reach is not a slow server — the network is not carrying it. Before you invest in machines you need to know how the network is arranged: who is allowed to talk to whom, whether there is a bottleneck, whether the wireless network is separate from business systems, whether there is a path when the main link fails.

New equipment on an old network with unreadable rules often just adds another device nobody knows where to plug in.

Backups

A backup that has never been test-restored has not yet been proven recoverable. Before you invest in new storage, ask: what is copied, where, who starts it, and whether a restore has ever been done on real work. If there is no answer, that has to be put in order first. Otherwise the new system inherits the same blind spot.

A copy on the same device it was taken from does not protect you from that device failing. That needs to be visible before you buy a larger disk in the same machine.

Licences and who holds them

Software, sign-in, subscriptions — whose name they are in, how long they run, what happens if the person who bought them leaves. Investing in a new system without that list means the old one stays paid for and the new one cannot be switched on properly, or the other way round.

Licences should be held by the company, not a private account. If they are not, that is an item on the review, not a footnote to the new purchase.

Dependencies

One programme waits on another, sign-in goes through a third, files live on a fourth. Replacing one piece without that map leaves the rest with no path to the data. That is why, before you invest, you sketch who depends on whom, even roughly.

Pay particular attention to things that “just work”: an old print server, a folder everyone maps, a tool that runs a night job. Those are dependencies you discover when the device is switched off.

Documentation

If the configuration lives only in one person's head, every change is a risk. A review should record what was found: addresses, roles, where secrets are stored, how the copy is run. That is not bureaucracy. It is the condition for the next decision not starting from nothing.

Capacity and the reason for change

Is what you lack space, power, people who know how to maintain it, or a way for the system to survive a fault? Those are different reasons, and they lead to different investments. Sometimes you need a disk. Sometimes you need a tidier arrangement of what you already have. Sometimes you need a plan for when the machine stops, not a faster machine.

If the reason is not named, postpone the purchase. IT consulting at this step is there so the reason can be seen, not so a device already chosen can be confirmed. Once the review is done, the other question is when to modernise infrastructure, and when it still does not make sense.

Sources and further reading

• NIST Cybersecurity Framework 2.0 — Resource and Overview Guide NIST's framework for understanding current cybersecurity risk and organising governance, protection, detection, response and recovery.
• CISA — Cross-Sector Cybersecurity Performance Goals A prioritised baseline of cybersecurity practices covering assets, identity, backups, vulnerability management and recovery planning.