it-estate-check

Read an IT estate inventory and print what is unprotected, unowned or about to expire.

This is the check INNERLUXES runs in week one of a managed IT engagement, before quoting a monthly fee. It takes the inventory you already have, in a CSV anyone can maintain, and answers the questions that decide what the first month is spent on: which assets have no backup, no monitoring, no patching, no owner; what is past end of support; what renews in the next ninety days.

Service page: https://innerluxes.dev/it-operations/managed

Usage

python estate_check.py examples/estate.csv
python estate_check.py estate.csv --json
python estate_check.py estate.csv --out report.md
python estate_check.py estate.csv --max-risk 40      # exit 1 when the risk score is above 40

The inventory file

One row per asset. Unknown columns are ignored, so you can keep your own extras.

Column	Meaning
name	Asset name
type	server, endpoint, network, saas, service, other
owner	The person accountable. Blank is a finding.
criticality	high, medium, low
backup	yes / no / n/a
last_restore_test	ISO date of the last restore, not the last backup run
monitoring	yes / no
patching	managed / manual / none
mfa	yes / no / n/a (identity and SaaS)
end_of_support	ISO date, blank if not applicable
renewal	ISO date of the next contract or licence renewal

What it reports

• Findings, each with a severity that rises with the asset's criticality: no backup, backup never restored, restore older than 90 days, no monitoring, no patching, no owner, past end of support, end of support inside 180 days, no MFA on identity or SaaS, renewal inside 90 days.
• A risk score (0-100) so two runs can be compared month to month. It is a weighted count of open findings, not a statement about your security posture; use it as a trend, not a grade.
• Coverage counts for backup, monitoring, patching and ownership.

Example:

IT estate check: 12 assets   risk score 46/100

HIGH
  DC01              server    past end of support (2026-01-14)
  DC01              server    backup has never been restore-tested
  FILE02            server    no monitoring
MEDIUM
  CRM (SaaS)        saas      MFA not enabled
  FW-HQ             network   patching is manual
LOW
  Laptop pool       endpoint  no named owner

RENEWALS IN 90 DAYS
  2026-10-01  CRM (SaaS)
  2026-11-20  FW-HQ support contract

COVERAGE  backup 8/10   monitoring 9/12   patching managed 7/12   owner named 10/12

No dependencies beyond Python 3.9+.

Licence

MIT.