A monthly checklist for a small team fits in about an hour: refresh the inventory, review account access, apply machine and tool updates, test one backup restore, check alert coverage, and write a one-line report. Weekly work handles alerts. Monthly work handles the things that drift.
Weekly versus monthly
Weekly: read new alerts, check the exploited list, merge safe updates. Monthly: the slower-moving things that nobody notices until they fail. Keep the two lists separate so neither grows.
The checklist
| Area | Check |
|---|---|
| Inventory | Add new repositories and services, delete dead ones, mark which are internet-facing |
| Accounts | Remove leavers, check admin lists, confirm multifactor sign-in on critical accounts |
| Machines | Operating systems and browsers set to update, editors and container tools current |
| Dependencies | Scan every repository with a lockfile, including quiet ones |
| Secrets | Review where keys live, rotate anything old or broad |
| Backups | Restore one backup to a test place and time it |
| Alerts | Confirm alerts are still enabled and reach a human |
| Register | Close finished rows, re-date deferred ones |
Why the backup test matters
CISA advises keeping backups offline and encrypted and testing them regularly for availability and integrity, because many ransomware variants search for backups to destroy. Restoring one item each month spreads the effort and proves the process works.
Why the alert coverage check matters
Alert tools can quietly stop working. A repository can be archived, a lockfile can go stale, or a token can expire. GitHub notes that alerts depend on current manifest and lock files and are not generated for archived repositories. A monthly look at coverage catches silent gaps.
Keep a one-line report
At the end write one line: date, items fixed, items deferred, one thing to improve next month. Over a year that is twelve lines of evidence, and it helps when a buyer or auditor asks how you manage vulnerabilities.
What to leave for the quarter
Larger exercises belong quarterly: an incident drill, a vendor review, a policy refresh and a check of your biggest dependencies for maintainer health. Do not stuff them into the monthly hour.
Quick check
Who should run the monthly checklist?
Rotate it between people so the knowledge spreads, and keep one named owner for the register.
Is an hour realistic?
For a handful of repositories yes. If it regularly overruns, trim the list or automate the scans.
Try it yourself
Click through it at your own pace, or open it full screen.
Safeguard compliance and evidence automation can collect much of this routinely, and the free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
