Last verified October 16, 2026. The outside sources in this agenda are the CISA and Microsoft pages linked below. Who publishes these notes is on the about page.
A quarterly business review is the meeting where the client sees what changed in their environment and decides what to fund next. It is not a tour of the RMM. I have sat through the tour. The charts were green. The backup had not been restored since the previous technician, and nobody in the room knew that.
I run this agenda for managed clients who already pay for the work. The fillable version is the quarterly business review template, listed at $39 on the digital products page.
Who is in the room
I want the person who can approve money, and the person who feels the outages. Sometimes that is one owner. Sometimes the owner sends the office manager and then wonders why nothing was decided. I write the approver's name on the invite. If they cannot attend, I move the meeting. A QBR without the approver is a status email with snacks.
On our side I bring the technician who actually worked the account, not a stranger with a slide deck. One of us talks. The other takes the notes that become the leave-behind. Two people talking over each other is how the client hears three different versions of the backup story.
I book 45 minutes. The first time I booked 90, we spent the extra 45 on a printer. The printer can have its own ticket.
What I pull the week before
I pull numbers I can point at in a console, and I write the date I pulled them. A figure without a date gets argued.
Tickets: how many opened, how many are still open, and the one that sat because we were waiting on the client or on a vendor. I do not invent a "healthy" close-time and then grade us against it. If the client cares about a specific promise in the agreement, I read that promise back and I say whether we met it. If the agreement does not name a target, I do not borrow one from a blog.
Patching: which machines are behind, and which of those are past the vendor's support date. Microsoft's Windows 10 Home and Pro lifecycle page says, "Windows 10 will reach end of support on October 14, 2025." That page shows support dates in the Pacific Time Zone, and the Home and Pro retirement timestamp in the table is 10/15/2025 6:59:59 AM. Existing LTSC releases follow their own dates. If a Home or Pro PC is still on Windows 10, I check whether it is enrolled in Extended Security Updates before I call the row unpatched. Microsoft's consumer ESU page says eligible devices need "Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition," and that enrolled coverage continues through October 12, 2027. It also says that program is not offered for kiosk devices, devices joined to Active Directory or Microsoft Entra, or devices enrolled in MDM. Microsoft's commercial ESU page says enrolled commercial or education PCs "can receive security updates for a maximum of three years after end of support for Windows 10." I write which program the PC is on. If it is on neither, the row is a replacement date, not a patch percentage. CISA's Cyber Essentials says, "Replace unsupported operating systems, applications and hardware," and, "Leverage automatic updates for all operating systems and third-party software." The FTC's cybersecurity page says, "Turn on automatic updates." I show the machines where updates are not installing. I do not debug Windows Update in the meeting. That work, if we own it, is a ticket. If we do not own it, it is the vendor's support.
Backups: the date of the last restore test, what we restored, and whether the alert mailbox is still a person who works there. CISA's Stop Ransomware page says to maintain offline, encrypted backups and to test them regularly. "Last job succeeded" is a different sentence. If I do not have a restore date, I say that in the first five minutes. Hiding it until the appendix is how the meeting becomes a sales call.
Identity: who is an admin, and whether multifactor authentication is required for those admins and for mail. CISA says to start multifactor authentication with privileged, administrative, and remote-access users, and to grant admin on least privilege. If they are on Microsoft 365, Microsoft's security defaults page is the baseline I cite when they do not have Conditional Access, including the line that required licenses are "None," and the warning that P1 or P2 tenants should look at Conditional Access instead. I do not turn the QBR into an enablement workshop. The click path lives on Microsoft's page. If a user cannot sign in, that user calls Microsoft or the person who administers the tenant, during the week, not from the conference table.
Money: hours against the agreement, and any prepaid balance. I bring the ugly line, the after-hours block or the credit, because that is the line the client will ask about if I leave it out. If our PSA cannot show it, I bring the export. NinjaOne's PSA page says that since general availability in Q1 2026 the product has included billing and ticketing, and that QuickBooks Online is the accounting integration, not QuickBooks Desktop. I mention that only when the client's books are the thing we are reconciling. If the numbers disagree with their accountant, the accountant and the PSA vendor sort it out. I show the export I pulled and the date.
The 45 minutes
I use the same order every quarter so the client learns where the bad news sits.
Minutes 0 to 5. Last quarter's actions. I read the leave-behind from last quarter before I show a chart. Each item is done, slipped, or declined. Then I ask what they hired, what they opened, and what they plan to buy. I write the answers down. They become next quarter's scope.
Minutes 5 to 15. What broke, and what we did. Three tickets at most, chosen because the client felt them. I say what the cause was when we know it, and I say when we do not. I do not narrate a root-cause story I cannot show. If the cause sits inside a vendor product, I name the vendor ticket and I stop. Their support owns the next step.
Minutes 15 to 25. The four checks. Admins and multi-factor authentication. Backup restore date. Machines behind on updates, including anything past the vendor's support date, and whether a Windows 10 PC is on consumer ESU, commercial ESU, or neither. The "who to call" sheet, if it is stale. CISA's Cyber Essentials says, "Learn who to call for help (outside partners, vendors, government/industry responders, technical advisors and law enforcement)." I leave a printed copy if the one on the wall still has the old provider's phone number.
Minutes 25 to 35. The decision. One recommendation that costs money or time, with the reason tied to a row we just looked at. A Windows 10 PC in the warehouse. A mailbox with no offline backup. An admin list that still includes a former employee. I name what it costs and which quarter it lands on the roadmap. If it does not fit the budget they just described, I say so. I ask for a yes, a no, or a date. A no comes off the roadmap. A date stays on it. "We'll think about it" gets written down as a no unless they name the date.
Minutes 35 to 45. What we will do before next quarter, and what we will not. I read the list back. If they added a project in minute 3, it is on the list or I say it does not fit the agreement. Surprises belong in this block, not in the invoice.
What I leave behind
One page, sent the same day. It has:
- The date of the meeting and who was there
- The restore-test date, or the sentence "no restore test this quarter"
- The admin names we reviewed
- The machines we agreed to replace or patch, with the date
- The decision they made, in their words
- The vendor tickets still open, with the vendor's name
I do not attach a 20-page export unless they asked for it. The export is how I prepared. The page is how they remember. I file the page in the documentation system the same day, in the client's space, so the next technician can find it without asking me. If the documentation product is down, I use that vendor's support and I still email the page to the approver. The email is the copy that does not depend on the tool.
What I stopped putting in the deck
Green donut charts with no decision under them. A security score the tool invented, unless I can show the failed check in a list the client recognizes. A comparison of our response time to "the industry," because I do not have a sourced number for "the industry" and I will not type one into their slides. Ticket volume with no split between "waiting on the client" and "waiting on us."
I also stopped demonstrating the RMM. The time I spent clicking through alerts was time I did not spend on the restore date. If they want to see the console, I book a working session. The QBR is the decision meeting.
How this connects to onboarding
The first QBR is easier when onboarding wrote the baseline down. I compare this quarter to the access table, the admin list, and the first restore test, not to a vague sense that things are better. If those pages do not exist, this meeting is where we create them, and I say so. The onboarding checklist is the other half of that folder. The stack I am willing to trust for the numbers is a separate question, scored on the stack evaluation sheet before I depend on a console for a quarterly claim.
Pull the restore date before you build a slide. If you do not have one, that is the meeting.
How a paid PDF is delivered is on the site FAQ.
Works Cited
"About." ITOps Desk, itopsdesk.org/about. Accessed 16 Oct. 2026.
"Cyber Essentials." CISA, www.cisa.gov/resources-tools/resources/cyber-essentials. Accessed 16 Oct. 2026.
"Cybersecurity for Small Business." Federal Trade Commission, Sept. 2025, www.ftc.gov/business-guidance/small-businesses/cybersecurity. Accessed 16 Oct. 2026.
"Digital products." ITOps Desk, itopsdesk.org/products. Accessed 16 Oct. 2026.
"FAQ." ITOps Desk, itopsdesk.org/faq. Accessed 16 Oct. 2026.
Microsoft. "Configure Security Defaults for Microsoft Entra ID." Microsoft Learn, 16 Oct. 2026, learn.microsoft.com/en-us/entra/fundamentals/security-defaults. Accessed 16 Oct. 2026.
Microsoft. "Extended Security Updates (ESU) program for Windows 10." Microsoft Learn, 17 Nov. 2025, learn.microsoft.com/en-us/windows/whats-new/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Consumer Extended Security Updates (ESU)." Microsoft Windows, www.microsoft.com/en-us/windows/extended-security-updates. Accessed 16 Oct. 2026.
Microsoft. "Windows 10 Home and Pro." Microsoft Learn, learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro. Accessed 16 Oct. 2026.
"PSA Software for MSPs." NinjaOne, www.ninjaone.com/msp/psa/. Accessed 16 Oct. 2026.
"Stop Ransomware." CISA, www.cisa.gov/stopransomware. Accessed 16 Oct. 2026.