IT monitoring: the 8 indicators an executive should receive every month

An executive should receive eight indicators every month: availability of critical services, incidents and response times, backup status, patches, security, capacity, end-of-life equipment and user requests. Many managed services contracts promise a “monthly report”. Few deliver it, and fewer still make it readable by someone who is not an IT specialist. Here are the indicators we put in ours, what each one reveals and how to read them in five minutes.

Why a monthly report, and for whom

Monitoring runs continuously: our tools watch servers, firewalls, backups and internet links 24/7 and raise an alert at the slightest deviation. But an alert is for the technician, not the executive. The monthly report answers a different question: is the company’s IT in better or worse health than last month, and what decisions need to be made?

It therefore has three readers: the executive, who wants to know whether the business is protected; the finance or administrative manager, who wants to anticipate spending; and the internal IT contact, if there is one, who wants to follow ongoing actions. A good report fits on a one-page summary, with details in an appendix for those who want them.

The 8 indicators at a glance

Indicator	What it measures	Warning sign
1. Availability	Uptime of critical services	Gap against the contract threshold with no explanation
2. Incidents	Number, severity, response and resolution times	Times outside commitments, recurring incidents
3. Backups	Job success and restore test	No recent restore test
4. Patches	Fixes deployed and devices behind	Same device behind several months running
5. Security	MFA, firewall, EDR, reported phishing	Accounts without MFA, unhandled alerts
6. Capacity	Disk, memory, CPU, bandwidth, licences	Trend that will hit the limit before the next budget
7. End of life	Warranties, unsupported systems, renewals	Critical equipment without vendor support
8. Requests	Volume, recurring themes, satisfaction	Same request coming back every month

1. Availability of critical services

Email, ERP, files, telephony, internet access: for each, the percentage of uptime over the month, compared with the threshold set in the contract. The figure alone is not enough. The report must state when the outage happened (during the working day or during a planned night-time maintenance), how many users it affected and what was done to prevent it happening again.

2. Incidents and response times

Number of incidents by severity, average response and resolution time, compared with the contract commitments. With us, a critical incident is handled in under 15 minutes: the report shows whether that commitment was met, incident by incident. Look above all at recurring incidents: the same problem handled three times is an underlying issue, not a series of failures.

3. Backup status

Job success rate, but above all the last successful restore test: what (a file, a mailbox, a whole machine), when, and how long it took. “100% successful backups” without a restore test proves nothing. The report also states whether a copy exists off site and out of an attacker’s reach, as explained in the immutable 3-2-1 rule.

4. Patches applied

Number of security patches deployed on workstations, servers and network equipment, list of devices behind and the reason: machine switched off, incompatible business application, restart refused. Firewall firmware is on the list, and is too often forgotten after installation.

5. Security

Accounts without MFA, intrusion attempts blocked by the firewall, EDR alerts and how they were handled, phishing emails reported by users, former employees’ accounts still active. A high number of reported phishing emails is rather good news: it shows that teams know how to recognise an attempt and report it. To go further, see our MFA rollout guide and EDR vs antivirus.

6. Capacity

Server disk, memory and CPU, internet bandwidth, licences in use against licences purchased. This is the indicator that prevents budget surprises: a trend followed month after month lets you plan a disk, a server or a bandwidth upgrade in the budget instead of suffering it as an emergency. It also reveals the opposite: licences paid for accounts nobody uses any more.

7. End-of-life equipment

Servers out of warranty, operating systems that will no longer receive updates, firewalls whose protection licence is expiring, licences to renew within the quarter. This list feeds directly into next year’s investment plan.

8. User requests

Volume, recurring themes, satisfaction. Often the best source of improvement: if the second-floor printer or password resets come back every month, a structural fix (replacement, self-service, training) costs less than treating the symptom forever.

How to read the report in five minutes

1. Start with the summary: a colour code per indicator, green, amber or red, and one sentence summing up the month.
2. Read the reds and ambers, with their cause and the planned action. If a box is red two months running, ask why the action was not enough.
3. Look at trends, not just the monthly snapshot: three months of rising capacity say more than an isolated figure.
4. Pick out the decisions expected from you: a purchase to approve, a rule to enforce, a budget to plan.
5. Note your questions for the quarterly review.

Mistakes that make a report useless

• Dozens of pages of charts exported straight from the monitoring tool: nobody reads them, and what matters gets lost.
• Figures without thresholds: a number of alerts says nothing if you do not know what is normal for your environment.
• A report that is always green: a provider who never reports a problem is not looking hard enough, or not saying so.
• “Successful” backups with no tested restore.
• No action and no owner against the red items.
• A report that is sent but never discussed: without a regular review, it ends up in a folder.

Checklist: what your monthly report must contain

• A summary page readable by a non-specialist.
• Availability of each critical service, compared with the contract threshold.
• Incidents by severity, with times compared with commitments.
• Date and result of the last restore test.
• List of devices behind on patches, with the reason.
• Accounts without MFA and former employees’ accounts still active.
• Capacity trends and unused licences.
• Equipment and licences reaching their term.
• Decisions expected from management.

If your current report does not tick these boxes, it is a good starting point for a discussion with your provider, or for evaluating another one with our checklist for choosing an MSP.

How we do it

It all starts with the free initial audit: it establishes the starting point and sets the threshold for each indicator with you. We then deploy monitoring on servers, workstations, the firewall (for example a FortiGate) and backups, with scheduled restore tests, notably with Veeam.

Every month you receive the one-page report, with details in an appendix. Every quarter we go through it together in a review: trends, completed actions, decisions to make and investments to plan. This follow-up is part of our managed IT services contract, with 24/7 monitoring, a reply within 24 business hours and critical incidents handled in under 15 minutes. Examples of our work are presented in our case studies.

Want to know what your monthly report would show today? Request your free audit.