IT documentation — operations overview

Výroba Novák & Syn s.r.o.

A Czech manufacturing company, 45 employees, one internal IT administrator (Martin Doubek) and an external supplier (Nováček IT s.r.o.). The environment is hybrid: on-premises servers (Active Directory) + Microsoft 365 in the cloud, connected by Entra Connect synchronization.

generated 14 Aug 2026 from source data · version 1.5

Sample documentation by ICT-GROUP. Výroba Novák & Syn s.r.o. is a fictional company — all names, addresses, IP addresses and figures are made up.

Next 5 deadlines

45 days past expiryWarranty / support: NS-NAS01details →47 daysLicence renewal: Bitwarden (password manager)details →60 daysEnd of support: Windows Server 2022details →66 daysDomain novak-syn-shop.czdetails →93 daysWarranty / support: NS-BCK01details →

How to read this document

This document is one page: everything an outside technician needs to take over operations within 48 hours — and everything the company's management needs to know what it owns.

No human drew it: it is generated from machine-readable source data (seed data), so after every change to the environment you simply regenerate the document — and it is current again.

The text is written for a regular reader; technical details (ports, protocols) live in the hover tooltips and in the small print.

01Environment profile

One site + cloud. Internal IT administrator: Martin Doubek. External supplier: Nováček IT s.r.o. (24/7 on-call).

employees and users

desktops and laptops managed by Intune

servers and network devices

systems in operation

network segments (VLANs)

backup jobs

Sites

Headquarters and production plant — Průmyslová 1420, 537 01 Chrudim, Czech Republic (fictional address) — office building + production hall; server room on the ground floor of the office building
Cloud — Microsoft 365 (tenant novaksynvyroba.onmicrosoft.com) + Azure (immutable backup storage)

Servers and network devices

Device	Type	IP address	Network (VLAN)	Role
NS-FW01	MikroTik CCR2116	10.10.70.1	Management	firewall and router between VLANs; backup LTE connection
NS-SW01	MikroTik CRS326-24S+	10.10.70.2	Management	core switch — server room
NS-SW02	MikroTik CRS326-24G	10.10.70.3	Management	switch — office building
NS-SW03	MikroTik CRS112-8P	10.10.70.4	Management	switch — production hall (PoE for cameras and APs)
NS-AP01–04	MikroTik cAP ax (4 pcs)	10.10.70.11–14	Management	Wi-Fi — SSIDs NovakSyn (internal) and NovakSyn-guest
NS-HV01	Dell PowerEdge R450	10.10.10.5	Servers	Hyper-V host 1 (VMs: DC01, ERP01)
NS-HV02	Dell PowerEdge R450	10.10.10.6	Servers	Hyper-V host 2 (VMs: DC02, SQL01, SYNC)
NS-DC01	VM — Windows Server 2022	10.10.10.11	Servers	domain controller, DNS, DHCP
NS-DC02	VM — Windows Server 2022	10.10.10.12	Servers	second domain controller, DNS
NS-SQL01	VM — WS 2022 + SQL Server 2022	10.10.10.21	Servers	ERP database
NS-ERP01	VM — Windows Server 2022	10.10.10.22	Servers	ERP application server + attendance module
NS-SYNC	VM — Windows Server 2022	10.10.10.15	Servers	Entra Connect — AD synchronization to Microsoft 365
NS-NAS01	Synology RS1221+	10.10.10.31	Servers	shared files
NS-BCK01	Dell PowerEdge T350	10.10.60.11	Backups	backup server (Veeam B&R + Veeam for M365)
NS-NAS-BCK	Synology DS923+	10.10.60.21	Backups	second backup medium
NS-NVR01	NVR — 14 cameras	10.10.50.11	Cameras	camera recording (30-day retention)
NS-UPS01	APC Smart-UPS SRT 3000	10.10.70.21	Management	server room backup power (runtime ~20 min)

source: seed data → devices, vlans

02Network matrix — who may talk to whom

Row = from, column = to. Every dot is one allowed traffic category — hover to see ports and purpose. An empty cell means: the connection is denied (default deny) — the firewall only allows what is in this matrix.

	Servers	Offices	Backups	INTERNET
Servers10.10.10.0/24			✕
Offices10.10.20.0/24
Production/OT10.10.30.0/24				✕
Print10.10.40.0/24
Cameras10.10.50.0/24				✕
Backups10.10.60.0/24
Management10.10.70.0/24
Guest10.10.80.0/24	✕	✕

Identity and names (AD, DNS)Files (SMB)ERP and databasesPrinting and scanningBackupManagement and monitoringInternet and cloud (HTTPS)Camerasinside one network✕explicitly deniedflow unverifiedempty cell = denied (default deny)

Why this matters: Note: the servers must not initiate connections into the backup network themselves (the red ✕ in the matrix). The backup server pulls the data itself — so ransomware that took over the servers cannot reach the backups. And the immutable copy in Azure is insurance even against deletion with admin rights.

source: seed data → flows, drops

03Network diagram

The same data as the matrix, just as a map. Hover over a segment or a link to highlight the related communication; click a legend item to hide that category.

Identity and names (AD, DNS)Files (SMB)ERP and databasesPrinting and scanningBackupManagement and monitoringInternet and cloud (HTTPS)Cameras

dashed = flow not verified yetred outline = the segment must not initiate any connection outside its own networkarrow = who initiates the connection

source: seed data → vlans, flows

04Systems inventory

Every system has an owner on the company side (who decides about it) and an administrator (who takes care of it). Without an owner a system is an orphan — nobody knows whether the company still needs it.

System	Purpose	Runs on	Owner (company)	Administered by	Documentation
ERP Helios Orange	production, warehouse, invoicing, accounting	NS-ERP01 + NS-SQL01	Jana Melicharová (finance manager)	Martin Doubek + service contract with the ERP vendor	SharePoint → IT documentation → ERP.md
Microsoft 365 Business Premium	mail, Teams, SharePoint/OneDrive, Intune, Defender	cloud — tenant novaksynvyroba.onmicrosoft.com	Petr Havlena (managing director)	Martin Doubek + Nováček IT (delegated access via GDAP)	SharePoint → IT documentation → M365.md
Active Directory (Novák & Syn)	accounts, computer sign-in, company policies	NS-DC01 + NS-DC02	Petr Havlena (managing director)	Martin Doubek	SharePoint → IT documentation → AD.md
Shared files	documents, drawings, department data	NS-NAS01	department heads	Martin Doubek	SharePoint → IT documentation → NAS.md
Backup (Veeam B&R + for M365)	backups of servers, NAS and cloud	NS-BCK01	Petr Havlena (managing director)	Martin Doubek; oversight: Nováček IT	SharePoint → IT documentation → Backup.md
Attendance system	attendance, payroll inputs	terminals at entrances + module on NS-ERP01	Jana Melicharová	attendance vendor (service contract)	SharePoint → IT documentation → Attendance.md
Camera system	site recording — 14 cameras, 30-day retention	NS-NVR01	Petr Havlena (managing director)	security vendor (service contract)	SharePoint → IT documentation → Cameras.md
Company website	www.novak-syn.cz — company presentation	external hosting (WordPress)	Lucie Vávrová (sales)	web studio (contract)	SharePoint → IT documentation → Web.md
Payroll	payroll processing	external — accounting firm	Jana Melicharová	accounting firm	SharePoint → IT documentation → Payroll.md

source: seed data → systems

05Expiry and lifecycle

The documentation tracks not only what the company HAS, but also what quietly EXPIRES on it: domains, certificates, licences, warranties, software support and service contracts. Expiry does not hurt — until the day something lapses. It is payment continuity (checklist area 9) in practice: every item has a deadline, a number of days remaining, and the name of whoever pays.

Who watches this: Reminders for all services go to the shared mailbox it@novak-syn.cz and the deadlines live in the shared “IT expiry” calendar (watched by J. Melicharová + M. Doubek) with reminders 60, 30 and 7 days ahead. No critical service hangs on a personal card or a private e-mail.

Domains — all of them, not just the main one

Domain	Purpose	Registrar	Expires	Remaining	Auto-renewal	Paid by	Note
novak-syn.cz	main domain — web, e-mail, service sign-ins	Czech registrar — company account (it@)	4 Mar 2027	202 days	yes	company card	holder: Výroba Novák & Syn s.r.o., company ID 12345678 — verified against WHOIS on 12 Jun 2026
novaksyn.cz	defensive registration — redirects to the main site	same registrar	2 Dec 2026	110 days	yes	company card
novak-syn-shop.cz	e-shop pilot (2024) — unused today	same registrar	19 Oct 2026	66 days	NO	company card	decide by September: renew (protects the brand) or let it lapse
presna-mechanika.cz	from the acquisition of Přesná mechanika s.r.o. (2021) — old customers still e-mail it	different registrar — account transferred to the company in 2022	30 Jun 2027	320 days	yes	company card	keep at least until 2028, then reassess

TLS certificates

Certificate / where	Issuer	Expires	Remaining	Who handles it
www.novak-syn.cz (web)	Let's Encrypt (via hosting)	renews automatically every 90 days	—	watched by the hosting; checked at the half-yearly review
vpn.novak-syn.cz (SSTP VPN on NS-FW01)	public CA — annual certificate	22 Jan 2027	161 days	renewed by M. Doubek — task in the “IT expiry” calendar
erp.ad.novak-syn.cz (ERP web module, intranet)	self-signed	1 Mar 2028	565 days	replace with a trusted certificate during the ERP upgrade (Q4 2026)
Microsoft 365 (mail, sign-in)	managed by Microsoft	no action needed	—	—

SaaS and licences — including who they are assigned to

Service	Licence type	Qty	Assigned to	Renewal / commitment	Remaining	Paid by	Note
Microsoft 365 Business Premium	per user	45	all employees — group LIC-M365-BP (dynamic)	31 Jan 2027 (annual commitment)	170 days	invoice — CSP Nováček IT	the tenant and the data belong to the company; GDAP can be revoked at any time
Microsoft Defender for Business	included in Business Premium	45	all devices managed by Intune	with the M365 licence	—	—	EDR/antivirus — no separate payment
Power BI Pro	per user	3	P. Havlena, J. Melicharová, T. Hruška	monthly, no commitment	—	invoice — CSP
Adobe Acrobat Standard	per user	4	group LIC-Acrobat (finance + sales)	15 Feb 2027 (annual)	185 days	company card
Bitwarden (password manager)	organization	8	management + IT — collections by department	30 Sep 2026 (annual)	47 days	company card	organization owner: the company (managing director + IT)
ERP Helios Orange — maintenance	concurrent users	20	production, warehouse, finance — named list in ERP.md	31 Dec 2026 (annual)	139 days	invoice	support + updates; upgrade Q4 2026
Veeam Data Platform	instances (VUL)	10	servers + NAS — jobs see the DR card	15 May 2027 (annual)	274 days	invoice
Azure — immutable backup storage	pay-as-you-go	—	backup jobs no. 3 and 4	ongoing (monthly)	—	company card	30-day immutability
Web hosting	package	1	company website	28 Feb 2027 (annual)	198 days	company card
Attendance system	per terminal	3	terminals at the entrances	service contract — see Connectivity, service and insurance	—	invoice

Hardware — warranties and support

Device	Model	Serial number	Support / warranty	Until	Remaining	Plan
NS-HV01	Dell PowerEdge R450	ST 7GX2Q34	Dell ProSupport NBD	30 Sep 2027	412 days	extend by 2 years when the contract renews
NS-HV02	Dell PowerEdge R450	ST 7GX2Q41	Dell ProSupport NBD	30 Sep 2027	412 days	extend by 2 years when the contract renews
NS-BCK01	Dell PowerEdge T350	ST JW4T2P3	Dell Basic NBD	15 Nov 2026	93 days	upgrade to ProSupport — quote requested
NS-NAS01	Synology RS1221+	SN 2150SGR445901	manufacturer warranty	30 Jun 2026	45 days past expiry	out of warranty — replacement planned Q2 2027, quote with the supplier
NS-NAS-BCK	Synology DS923+	SN 2320TQK118002	manufacturer warranty	10 Feb 2028	545 days	—
NS-FW01	MikroTik CCR2116	SN D4E8-9F21	warranty	22 Apr 2027	251 days	on failure, replacement within 24 h from the supplier; the configuration is exported daily
NS-UPS01	APC Smart-UPS SRT 3000	SN AS2405123456	manufacturer warranty	15 May 2027	274 days	battery replacement 5/2028 (after 4 years) — see Connectivity, service and insurance

Software end of support

Software	Runs on	End of support	Remaining	Beyond that	Plan
Windows Server 2022	NS-DC01/02, SQL01, ERP01, SYNC	13 Oct 2026 end of mainstream support	60 days	extended support until 14 Oct 2031	fine — security patches continue; OS upgrade with the server refresh (2028)
SQL Server 2022	NS-SQL01	11 Jan 2028 end of mainstream support	515 days	extended support until 11 Jan 2033	fine
Windows 11 Pro 25H2	41 computers	12 Oct 2027 end of support for this version	424 days	the version renews annually	Intune upgrades versions automatically
ERP Helios Orange 2024.2	NS-ERP01	31 Dec 2026 end of vendor support	139 days	—	upgrade to the new version planned for Q4 2026
MikroTik RouterOS 7	firewall, switches, APs	rolling updates	—	—	firmware check at the quarterly maintenance
Synology DSM 7.2	NS-NAS01, NS-NAS-BCK	rolling updates	—	—	firmware check at the quarterly maintenance

Connectivity, service and insurance

Contract / service	Supplier	Deadline / commitment	Remaining	Paid by	Note
Internet — fibre 500/500 Mb/s	connectivity provider	open-ended, 3-month notice period	—	invoice
Backup LTE connection	mobile operator	commitment until 30 Jun 2027	320 days	invoice	failover tested 9 Feb 2026
Mobile tariffs (18 SIMs)	mobile operator	framework contract until 31 Mar 2027	229 days	invoice
UPS — service and batteries	service partner	annual inspection — last 6 May 2026, next 5/2027	—	invoice	battery replacement 5/2028 (after 4 years)
Server room air conditioning — service	service company	annual service — last 12 May 2026, next 5/2027	—	invoice
Lease of multifunction printers (3 pcs)	leasing company	contract until 30 Sep 2027	412 days	invoice	decide before the end: buy out / replace
Cyber insurance	insurer	renewal 1 Apr 2027 — coverage limit CZK 10 million	230 days	invoice	the insurer requires MFA, backups and restore tests — evidenced by this documentation; supported software is a condition of coverage
IT supplier — service contract (Nováček IT)	Nováček IT s.r.o.	open-ended — 60-day exit, fixed rates (art. 12)	—	monthly invoice	24/7 on-call: +420 555 000 111

source: seed data → lifecycle (the “Remaining” column is computed from the generation date in meta — deterministically)

06Identity map — AD ⇄ Microsoft 365

Active Directory (on-premises)

ad.novak-syn.cz · NetBIOS Novák & Syn · NS-DC01, NS-DC02

45 user accounts
7 service accounts
4 admin accounts (adm-*)

⇄Entra Connect v2
every 30 minutes
on NS-SYNC

Microsoft 365 / Entra ID (cloud)

novaksynvyroba.onmicrosoft.com

45 users licensed with Microsoft 365 Business Premium
3 guests (external accounting firm, ERP vendor)

password hash sync — cloud sign-in keeps working even when the on-premises servers are down. self-service password reset with write-back to AD — enabled.

Synchronized

OU Users (45 accounts)
OU Groups

Not synchronized

service accounts
admin accounts (adm-*)
OU Retired

Privileged roles — who holds the keys

Role	Who	Note
Global Administrator (Microsoft 365)	bg-admin-01, bg-admin-02 (emergency) · adm.doubek (Martin Doubek)	adm.doubek is a separate cloud-only admin account — Martin does not use it for everyday work
Domain Admins (Active Directory)	adm-doubek (Martin Doubek) · adm-onovacek (Ondřej Nováček, supplier)	both are named accounts — no shared “administrator” for everyday work
Delegated supplier access (GDAP)	Nováček IT s.r.o. — roles User Administrator, Exchange Administrator, Intune Administrator	without the Global Administrator role; the company can unilaterally revoke the delegation at any time
Emergency account for AD (on-prem)	nouzovy-admin (member of Domain Admins)	password in a sealed envelope in the safe; rotated after every use

Conditional Access policies (Conditional Access)

Policy	What it does	State	Exceptions
CA01 — MFA for all users	every sign-in is confirmed with a second factor (Authenticator app)	Enabled	bg-admin-01/02 (they have their own FIDO2 keys)
CA02 — Block legacy protocols	old sign-in methods without MFA support (IMAP/POP/SMTP basic) are blocked	Enabled	no exceptions
CA03 — Company data only from managed devices	the computer must be managed by Intune and healthy (compliant)	Enabled	mobiles: only apps with data protection (app protection)
CA04 — Geoblocking	sign-ins from countries outside the EU are blocked	Enabled	business trips — temporary exception on request
CA05 — Admins only with a FIDO2 key	privileged roles require phishing-resistant sign-in with a hardware key	Enabled	bg-admin-01/02 (excluded from all policies, they do have FIDO2 keys)
CA06 — MFA registration only from a trusted location	a new second factor can only be registered from the company network or a managed device	Enabled	no exceptions

source: seed data → identity

07Break-glass runbook — emergency access

Emergency “break the glass” accounts — the way into Microsoft 365 for the day the IT administrator is not available. Two cloud-only accounts with the Global Administrator role, sign-in exclusively with a FIDO2 hardware key, excluded from all Conditional Access policies.

bg-admin-01@novaksynvyroba.onmicrosoft.comcloud-only, Global Administrator, unlicensed · FIDO2 key no. 1 (YubiKey 5 NFC)

bg-admin-02@novaksynvyroba.onmicrosoft.comcloud-only, Global Administrator, unlicensed · FIDO2 key no. 2 (YubiKey 5 NFC)

Where the keys are

Key	Location	Who can reach it
FIDO2 key no. 1	safe in the managing director's office (with a sealed PIN envelope)	Petr Havlena (managing director), Jana Melicharová
FIDO2 key no. 2	bank safe-deposit box — bank branch, Chrudim	Petr Havlena; authorized: Jana Melicharová

Step-by-step procedure

Verify it really is an emergency: the IT administrator is unavailable and an intervention in Microsoft 365 is needed — restoring access, blocking an attacker, bringing a service back up.
Collect FIDO2 key no. 1 from the safe in the managing director's office. If it is not available, key no. 2 is in the bank safe-deposit box.
On a computer open admin.microsoft.com and sign in as bg-admin-01@novaksynvyroba.onmicrosoft.com — choose “Sign in with a security key” and present the key (the PIN is in the sealed envelope with the key).
An alert is automatically sent to the managing director and to it@ — that is expected, do not dismiss anything.
Do only what the emergency requires. Change nothing beyond that; if unsure, call the supplier's on-call line: Nováček IT s.r.o., +420 555 000 111.
Afterwards: return the key, replace the PIN envelope with a new one, log the intervention (SharePoint → IT documentation → Intervention log) and inform the IT administrator or the supplier within 24 hours — they will assess whether to rotate the account and the key.

Sign-in alert: Every sign-in with an emergency account sends an immediate alert to jednatel@novak-syn.cz and it@novak-syn.cz. The alerting is tested together with the accounts.

Last test: 15 Jul 2026 — both accounts: key sign-in, alert check — OK (logged). Next test: 13 Oct 2026 (every 90 days + after every personnel change in IT).

source: seed data → break_glass

08Backups and recovery plan (DR card)

How we back up: The 3-2-1 rule: three copies of the data, two different media, one off-site — plus one immutable on top. IT, which manages the backups, has access to them — and so does the managing director with his own account (Veeam console and Azure). The immutable copy is not about access but about deletion: once written, nobody can delete it for 30 days — not the administrator, not an attacker with an admin password.

Backup jobs

Job	What	To	When	Retention	Immutable	Last success
VMs + NAS — local	all VMs from NS-HV01/02 + NAS shared folders	NS-BCK01	daily 22:00	30 days	—	13 Aug 2026 22:41 — OK
Copy to second medium	copy of job no. 1	NS-NAS-BCK	daily 03:00	30 days	—	14 Aug 2026 03:12 — OK
Offsite — immutable	VMs + NAS	Azure Blob (30-day immutability)	daily 04:30	30 days + 12 monthly	yes	14 Aug 2026 05:03 — OK
Microsoft 365	Exchange, SharePoint, OneDrive, Teams	NS-BCK01 + copy to Azure	daily 20:00	1 year	yes	13 Aug 2026 20:37 — OK

Test restores — proof the backups work

A green light only says a job ran. This records when something was actually restored last.

Type	Date	What was restored	Result	Next
Monthly sample	5 Aug 2026	restore of 3 random files from the NAS	OK, 12 minutes	5 Sep 2026
Quarterly application	18 Jun 2026	restore of the ERP database into a test VM	OK, 74 minutes	18 Sep 2026
Annual full exercise	21 Mar 2026	restore of DC + ERP + files into an isolated network	OK, 6 h 20 min	21 Mar 2027

Disaster scenarios

Scenario	What we do	RTO	RPO	Last tested
Failure of one VM or service	restore from the local backup on NS-BCK01 (runbook R1)	4 h	24 h	18 Jun 2026 — ERP database restore, 74 min
Ransomware — servers encrypted	disconnect the network, pay nothing, restore from the immutable copy in Azure (runbook R2)	24–48 h	24 h	21 Mar 2026 — tabletop exercise + test restore
Server room destroyed (fire, water)	replacement hardware / temporary operation in Azure, restore from the cloud copy (runbook R3)	5 business days	24 h	21 Mar 2026 — tabletop exercise
Internet outage	firewall fails over automatically to the backup LTE connection	15 min	—	9 Feb 2026 — live failover test
IT administrator unavailable	break-glass emergency account (chapter above) + supplier Nováček IT takes over using this documentation	24 h	—	15 Jul 2026 — emergency account test

Printed copy of the DR plan: safe in the managing director's office + at the managing director's home. The plan is known to: Petr Havlena, Martin Doubek, Jana Melicharová. Supplier on-call: Nováček IT s.r.o., +420 555 000 111 (24/7).

Last tabletop exercise: 21 Mar 2026 — scenario: the IT administrator unreachable in the morning and the servers encrypted overnight. Next exercise: March 2027.

source: seed data → backup, dr

09Critical access register — filled in

A filled-in copy of the “Critical access register” template from the checklist Will your company survive losing its IT admin? — ten areas the company owns, not a person. For every item: where it is, who can reach it, and when it was last verified to work.

CompanyVýroba Novák & Syn s.r.o.

Filled in byMartin Doubek (generated from source data, reviewed)

Date filled14 Aug 2026

Next review14 Feb 2027

Rule no. 1: A copy of this register must not live only on the server it describes. Printed copy: safe in the managing director's office; second copy: bank safe-deposit box. After every regeneration of the documentation, both copies are swapped for the current one.

1. Domains and DNS critical area

The domain carries the website, e-mail and sign-ins to most services. The holder must be the company (company ID), not a person.

What	Where it is stored	Who has access	Last tested	Next test
Account at the domain registrar (novak-syn.cz)	Bitwarden — collection “Company – critical”	managing director, M. Doubek	12 Jun 2026	12 Jun 2027
Domain holder in the WHOIS record	Výroba Novák & Syn s.r.o., company ID 12345678 — extract: SharePoint → IT documentation → Domain	the record is public	12 Jun 2026	12 Jun 2027
DNS hosting (where the domain records live)	at the registrar; record export: SharePoint → IT documentation → DNS.md	M. Doubek, Nováček IT	12 Jun 2026	12 Jun 2027
Domain expiry and whose card pays for it	4 Mar 2027 — company card; see the Expiry and lifecycle chapter	J. Melicharová (card)	12 Jun 2026	12 Jun 2027
Contact e-mail at the registrar	it@novak-syn.cz (shared mailbox, not personal)	managing director, M. Doubek, Nováček IT	12 Jun 2026	12 Jun 2027

2. Tenant and licence ownership critical area

The tenant — the Microsoft 365 environment — and the data belong to the company. The managing director can sign in to the admin portal even without the supplier.

What	Where it is stored	Who has access	Last tested	Next test
Managing director's sign-in to the Microsoft 365 admin portal	havlena@novak-syn.cz — Global Reader role (sees everything, changes nothing; interventions go through break-glass)	Petr Havlena	20 May 2026	20 May 2027
List of global administrators	the Identity map chapter of this document (generated)	management + IT	14 Aug 2026	14 Feb 2027
Contract with the partner (CSP) and a list of their permissions	SharePoint → Contracts → Nováček IT; GDAP permissions in the Identity map chapter	managing director, J. Melicharová	20 May 2026	20 May 2027
Licence overview and subscription renewal dates	45× Business Premium, renewal 31 Jan 2027 — the Expiry and lifecycle chapter (incl. licence assignments)	managing director, M. Doubek	20 May 2026	20 May 2027

3. Systems documentation

The yardstick: an outside technician takes over operations within 48 hours using it. A copy belongs outside the systems it describes.

What	Where it is stored	Who has access	Last tested	Next test
Systems inventory (everything the company runs)	this document — the Systems inventory chapter (generated from seed data)	management + IT	14 Aug 2026	14 Feb 2027
Network diagram	this document — the Network matrix and Network diagram (generated)	management + IT	14 Aug 2026	14 Feb 2027
List of admin accounts and their owners	this document — the Identity map chapter	management + IT	14 Aug 2026	14 Feb 2027
Supplier contacts	the Systems inventory and DR card chapters	management + IT	14 Aug 2026	14 Feb 2027
Step-by-step recovery procedure	runbooks R1–R3: SharePoint → IT documentation → DR; summary in the DR card chapter	IT; printed copy with the managing director	21 Mar 2026	21 Mar 2027
Copy of the documentation outside the systems it describes	PDF export: safe + bank safe-deposit box; swapped after every regeneration	managing director	14 Aug 2026	14 Feb 2027

4. Emergency admin accounts critical area

Break-glass — the way into Microsoft 365 even if the admin does not show up tomorrow. Detailed procedure: the Break-glass runbook chapter.

What	Where it is stored	Who has access	Last tested	Next test
Emergency account no. 1 (sign-in name)	bg-admin-01@novaksynvyroba.onmicrosoft.com	holders of key no. 1	15 Jul 2026	13 Oct 2026
Emergency account no. 2 (sign-in name)	bg-admin-02@novaksynvyroba.onmicrosoft.com	holders of key no. 2	15 Jul 2026	13 Oct 2026
FIDO2 hardware key no. 1 — location	safe in the managing director's office (+ sealed PIN envelope)	P. Havlena, J. Melicharová	15 Jul 2026	13 Oct 2026
FIDO2 hardware key no. 2 — a second, separate location	bank safe-deposit box, Chrudim branch	P. Havlena	15 Jul 2026	13 Oct 2026
Sign-in alerts — where they go	e-mail to the managing director + it@ (immediately)	—	15 Jul 2026	13 Oct 2026

5. Backups you can reach yourself critical area

Three copies, two media, one off-site — plus one immutable. IT has access to the backups; so does the managing director.

What	Where it is stored	Who has access	Last tested	Next test
What is backed up (list of data and systems)	the Backup jobs table in this document (generated)	IT + managing director	14 Aug 2026	14 Feb 2027
Where the backups live (media and locations)	NS-BCK01, NS-NAS-BCK, Azure (off-site)	IT + managing director	5 Aug 2026	5 Sep 2026
Immutable copy — where it is	Azure Blob — 30-day immutability	IT + managing director (own account)	18 Jun 2026	18 Sep 2026
The company's own access to the backups	the managing director has his own account for the Veeam console and Azure	Petr Havlena	5 Aug 2026	5 Sep 2026
Password or key for decrypting the backups	sealed envelope in the safe; also known to the managing director (outside IT)	P. Havlena + IT	3 Apr 2026	3 Oct 2026
Record of the last test restore	the Test restores table + the log on SharePoint	IT + managing director	5 Aug 2026	5 Sep 2026

6. Disaster recovery plan

Who restores what and in what order — available even during an IT outage, printed, known to at least two people.

What	Where it is stored	Who has access	Last tested	Next test
Written recovery (DR) plan — printed copy	safe in the managing director's office	P. Havlena, J. Melicharová	21 Mar 2026	21 Mar 2027
Copy of the plan outside the company	at the managing director's home + bank safe-deposit box	P. Havlena	21 Mar 2026	21 Mar 2027
Who knows the plan (at least two people)	P. Havlena, M. Doubek, J. Melicharová	—	21 Mar 2026	21 Mar 2027
Minutes of the last tabletop exercise	SharePoint → IT documentation → DR → exercise 2026	management	21 Mar 2026	21 Mar 2027

7. Password management and access escrow

The password vaults belong to the company, not to one person's head — with an emergency mechanism on top.

What	Where it is stored	Who has access	Last tested	Next test
Company password manager — who owns the vaults	Bitwarden — organization Novák & Syn (owner: the company; admins: managing director + M. Doubek)	everyone per collections	1 Jul 2026	1 Oct 2026
Sealed envelope in the safe — date of last rotation	safe in the managing director's office	P. Havlena, J. Melicharová	3 Apr 2026	3 Oct 2026
Emergency access (Bitwarden Emergency Access)	P. Havlena is the emergency contact for M. Doubek's account (3-day waiting period)	Petr Havlena	1 Jul 2026	1 Oct 2026
Third-party escrow	not used — covered by the envelope and emergency access	—	—	—

8. Contract with your IT supplier

Continuity is negotiated while the relationship is good. Access and documentation are handed over continuously, not at the break-up.

What	Where it is stored	Who has access	Last tested	Next test
Contract with the IT supplier — where it is stored	SharePoint → Contracts → Nováček IT s.r.o.	managing director, J. Melicharová	20 May 2026	20 May 2027
Clause: data, backups and documentation belong to the client	art. 7 of the contract — explicitly	—	20 May 2026	20 May 2027
Cooperation on termination (notice period, rates)	art. 12 — 60 days, fixed rates	—	20 May 2026	20 May 2027
Last continuous hand-over of access and documentation	14 Aug 2026 — regeneration of this documentation + spot check of access	managing director	14 Aug 2026	14 Feb 2027

9. Payment continuity

Expiry does not hurt — until the day a certificate lapses. Everything on the company card and role-based e-mail, not a person.

What	Where it is stored	Who has access	Last tested	Next test
Domains — whose card pays, when they expire	the Expiry and lifecycle chapter — all 4 domains (company card)	J. Melicharová	12 Jun 2026	12 Dec 2026
Certificates — who renews them, when they expire	web: Let's Encrypt, renews automatically; watched by the hosting	—	12 Jun 2026	12 Dec 2026
Hosting and other key services — whose card	everything on the company card or invoice; no personal cards	J. Melicharová	12 Jun 2026	12 Dec 2026
Reminder e-mail (a role, not a personal mailbox)	it@novak-syn.cz (shared mailbox)	IT + finance manager	12 Jun 2026	12 Dec 2026
Expiry calendar — who watches it	shared “IT expiry” calendar in Microsoft 365	J. Melicharová + M. Doubek	12 Jun 2026	12 Dec 2026

10. Offboarding and secret rotation

At every departure from IT: revoke privileged access within an hour, rotate shared passwords and keys.

What	Where it is stored	Who has access	Last tested	Next test
Written procedure for a departure from IT	SharePoint → IT documentation → Offboarding.md	management + IT	30 Jun 2026	at the next departure
Shared passwords — list to rotate on departure	Bitwarden — collections tagged “rotation”	IT	30 Jun 2026	at the next departure
API keys and service accounts — list to rotate	the Identity map chapter + ERP documentation (Veeam→Azure, attendance→ERP)	IT	30 Jun 2026	at the next departure
Record of the last departure	30 Jun 2026 — temporary worker (IT support): accounts disabled the same day, shared passwords rotated	management	30 Jun 2026	—

source: seed data → evidence