On-Premise PBX Maintenance Checklist: Tasks and Costs
On-Premise PBX Maintenance Checklist: What It Really Takes to Run Your Own Phone System
Tom Reed · Updated 11 October 2026
Running an on-premise PBX means you own patching, TLS certificates, backups, firewall and SBC rules, SIP trunk security and hardware replacement. This checklist covers each task, how often to do it, how to cost the time honestly, and the signs it's cheaper to move to a hosted PBX.
What does maintaining an on-premise PBX actually involve?
A PBX (private branch exchange) is the call-control layer of your business phone system: extensions, ring groups, voicemail, opening hours and the routes to and from your SIP trunk. If you need the basics first, our guide to the PBX phone system explains each layer. With an on-premise or self-hosted PBX, that software runs on a server, appliance or virtual machine that you (or your MSP) operate.
That ownership is the point of the model, and also the workload. In practice, PBX maintenance covers six areas:
- Updates. The PBX software, its operating system, and firmware on phones, gateways and any session border controller (SBC).
- Security. SIP credentials, firewall rules, who can register from where, and which destinations each extension can call.
- Certificates. TLS certificates for the admin interface, encrypted SIP and provisioning, each with its own expiry date.
- Backups and restores. Configuration, voicemail, recordings and licences, plus proof you can restore them.
- Hardware and lifecycle. Disks, power, UPS batteries, phones and vendor support dates.
- People and process. Joiners, leavers, hours, documentation, and more than one person who can do it all.
None of these is hard alone. The cost comes from doing all of them, on time, every year, and from the one that gets missed.
Which tasks are weekly, monthly, quarterly and yearly?
Use this as a starting schedule and adjust it to your vendor's guidance. A task with no named owner is a task that doesn't happen.
| Task | Frequency | Owner | Risk if skipped |
|---|---|---|---|
| Confirm last night's backup completed and was copied off the server | Weekly | PBX admin | No recent copy to restore from after a failure |
| Review call logs and failed-login alerts for unusual activity | Weekly | PBX admin | Toll fraud runs unnoticed until the carrier bill arrives |
| Apply PBX, operating system and firmware security updates | As released (security fixes promptly), with a monthly review | PBX admin or MSP | Known vulnerabilities stay open on an internet-facing system |
| Remove leavers and unused extensions; reset shared credentials | Monthly | PBX admin with HR | Old accounts stay usable by people who shouldn't have them |
| Check disk space and recording storage | Monthly | PBX admin | Voicemail or recording stops when the disk fills |
| Compare the carrier bill with expected usage | Monthly | Finance | Unusual spend is found weeks late |
| Test a restore from backup onto a spare machine or VM | Quarterly | PBX admin or MSP | You find out the backup is unusable during an outage |
| Review firewall rules, IP allow-lists and SBC configuration | Quarterly | IT or MSP | Temporary openings become permanent exposure |
| Review dial-plan restrictions (international, premium-rate) by role | Quarterly | PBX admin | Every extension can reach expensive destinations |
| Test failover routes (broadband down, PBX down) | Quarterly | PBX admin | Callers hit silence during the first real outage |
| Renew TLS certificates before expiry | Per expiry date (calendar reminder) | IT | Phones, apps or the admin portal stop connecting |
| Check vendor support and end-of-life dates for every component | Yearly | IT lead | You run unsupported software without realising it |
| Review support contract, licences and documentation; run a recovery exercise | Yearly | IT lead with finance | Renewal surprises and a recovery plan nobody has tried |
The on-premise PBX maintenance checklist
Tick these off each quarter:
- Backups ran every day this quarter and at least one copy is stored away from the PBX.
- A restore was tested, timed and written down.
- All security updates released by your PBX vendor this quarter are applied, or there's a written reason why not.
- Phone, gateway and SBC firmware is on a supported version.
- Every SIP account has a unique, long, randomly generated password; no defaults remain.
- SIP registration and admin access are limited to known networks or IP addresses where your setup allows.
- Unused features are switched off: voicemail dial-through, external forwarding you don't need, unused extensions and trunks.
- International and premium-rate dialling is blocked except for the roles that need it.
- You've asked your carrier which spend limits, destination blocks and fraud alerts it offers, and switched on the ones you need.
- Every TLS certificate's expiry date is in a shared calendar with at least two named people.
- The dial plan, network diagram and admin logins are documented and stored where a second person can find them.
- Vendor support dates for every component have been checked this year.
How do you keep a self-hosted PBX secure from toll fraud?
Toll fraud is when someone uses your phone system to make calls you pay for, usually to expensive international or premium-rate numbers, often overnight. A self-hosted PBX is a target because it sits on the internet and connects straight to a trunk that will place any call it's asked to. Our VoIP toll fraud prevention guide covers detection and incident response; these are the maintenance habits that keep the door shut.
Patch promptly. Subscribe to your vendor's security notices, apply fixes after a quick test, and don't let "the phones work, leave it alone" become policy. That includes the operating system, phones, gateways and SBC.
Use strong, unique SIP credentials. Every extension and trunk gets its own long, random password. Never reuse a SIP password for a web login. Change credentials when a device is lost, someone with access leaves, or a password has been shared by email.
Limit who can connect. Where your setup allows, accept SIP registrations and admin logins only from known IP addresses, or put remote access behind a VPN. Block addresses after repeated failed logins.
Switch off what you don't use. Voicemail dial-through, external forwarding, unused extensions, test accounts and default admin accounts are common ways in. Remove them.
Restrict destinations by role. Block international and premium-rate dialling by default and allow it only for named roles.
Use your carrier as a second line of defence. Ask your carrier whether it offers spend limits, destination blocks, concurrent-call caps and fraud alerts on your trunk, and who to call out of hours. If the PBX is compromised, trunk-side controls can still cap the damage.
Watch the call logs. A weekly look at outbound calls by destination and time of day catches problems early. Make sure alerts reach two people through a channel that doesn't depend on the phone system.
What about certificates, backups and restores?
Certificates. If your PBX uses TLS for encrypted SIP, the admin portal or provisioning, each certificate has an expiry date. When one lapses, phones can stop registering or browsers refuse the admin page. Keep a simple certificate register:
- what it protects and which hostname it covers;
- the expiry date and how renewal works (automatic or manual);
- two named people who get the calendar reminder.
If renewal is automatic, still check afterwards that phones re-registered and the admin page loads.
Backups. Back up more than the configuration file. A useful PBX backup includes the configuration and dial plan, voicemail and greetings, recordings if you keep them, custom prompts, licence details, and a note of the software and firmware versions. Keep at least one copy away from the PBX, so a failed disk or ransomware doesn't take the backup with it.
Restores. A backup you've never restored is a hope, not a plan. Once a quarter, restore onto a spare machine or virtual machine and check that it boots, the extensions appear, a test phone can register on an isolated network, and voicemail plays. Time it: that's the minimum time your phones could be down after a hardware failure.
Write the restore steps down; the person restoring during an outage may not be the person who built it.
How do you cost PBX upkeep honestly?
Most on-premise cost comparisons count the hardware and support contract and stop. The bigger costs are usually staff time and the task that gets skipped. The worksheet deliberately has no example numbers: fill each line from your own timesheets, invoices and quotes.
| Cost line | How to work it out | Your annual figure |
|---|---|---|
| Routine admin time | Hours per month on the weekly and monthly tasks × 12 × loaded hourly rate | ______ |
| Patching and testing | Hours per update cycle × cycles per year × hourly rate | ______ |
| Restore tests and recovery exercises | Hours per test × tests per year × hourly rate | ______ |
| Incidents and outages | Hours spent fixing faults last year × hourly rate, plus any call-out fees | ______ |
| After-hours cover | On-call allowance, or the out-of-hours rate in your MSP contract | ______ |
| Hardware refresh | Replacement cost of server or appliance ÷ expected years of service | ______ |
| Phones, gateways and SBC refresh | Replacement cost ÷ expected years of service | ______ |
| Support, maintenance and licence renewals | Annual invoices from the PBX vendor or reseller | ______ |
| Certificates, backup storage, UPS and power | Annual invoices and estimates | ______ |
| SIP trunk and call charges | Annual carrier invoices (often similar on either model) | ______ |
| Total | Sum of the lines above | ______ |
A few rules keep the worksheet honest:
- Use a loaded rate for staff time, not just salary, and agree it with finance.
- Count your MSP's hours, even if they're bundled into a wider contract.
- Spread hardware over its real life. If you've passed the expected replacement date, the refresh cost is due now.
- Note the single-person risk. If only one person can fix the PBX, what happens when they're on holiday?
For a like-for-like view, run the same exercise for a hosted option: plan cost, remaining admin time, phones and headsets, and the same SIP trunk. Our guide to small business phone system costs in the UK shows how to put quotes into one ledger.
When is it time to replace an on-premise PBX?
There's no fixed age at which a PBX has to go. A supported, documented system can keep earning its place. These signs mean PBX replacement should move onto the plan:
- End-of-life software or hardware. The PBX version, operating system or server is past its vendor's published support date, or will be within your next budget cycle.
- Updates you can't apply. You're stuck on an old version because an upgrade would break a licence, a module or a handset model.
- A single admin. One person knows how the dial plan works, and nothing is written down.
- Remote and hybrid staff. People need the company number on laptops and mobiles, and every new remote user means another VPN or firewall exception.
- Repeated outages. The same faults keep coming back: disks, power, registrations, one-way audio after a firmware update.
- Costs that only grow. Your worksheet total keeps rising while the system does the same job.
If two or three apply, make the decision properly. Our comparison of SIP trunking vs cloud PBX walks through whether to keep the PBX and modernise the trunk, or move call control to a hosted platform. For how the cloud model works in general, see our guide to the cloud-based phone system.
What changes if you move to a hosted PBX?
With a hosted PBX, the provider runs the call-control layer, so most of the server-side tasks in this checklist stop being yours. On SessionPBX, our hosted PBX for small business, the hosted PBX page says "we take care of hosting and maintenance", while you manage your people, numbers and call settings from the portal. It also says:
- Encryption by default. SIP signalling, messaging and the admin portal "all use TLS by default".
- Trunk credentials encrypted. SIP trunk usernames and passwords are "stored encrypted at rest with AES-256-GCM".
- Abuse protection built in. "IP access controls and automated blocking help protect your phone system against repeated login attempts, suspicious traffic, and toll fraud."
- Bring your own trunk. You connect the SIP trunk you already use; "any SIP-compliant carrier works", authenticated by IP or by credentials. Your carrier still supplies and bills your numbers and calls; SessionPBX doesn't.
- Regional hosting in Europe, the Americas and Asia, with native apps for Windows, macOS, iOS and Android.
You still own joiners and leavers, call flows, your carrier's fraud controls and your number arrangements with that carrier. Teams Phone and Teams Business are the two SessionPBX plans, and they're not Microsoft Teams.
This post doesn't cover the move itself. When you're ready, follow our step-by-step guide to migrate from an on-premise PBX to a hosted PBX, which covers the call-flow audit, pilot users, testing and rollback. You can try the SessionPBX hosted phone system with a 14-day free trial, and your team can answer on the SessionTalk softphones on desktop and mobile.
FAQ
Is an on-premise PBX cheaper than hosted?
It depends on your setup. An on-premise PBX can look cheaper because the hardware is paid for, but staff time, after-hours cover and hardware refresh often aren't counted. Fill in the cost worksheet above for both options using your own figures, then compare the totals.
How often should a PBX be patched?
Apply updates as your vendor releases them, and apply security fixes promptly rather than waiting for a quarterly window. Include the operating system, phones, gateways and any SBC, not just the PBX software.
Do I need an SBC for a self-hosted PBX?
Not always, but many self-hosted setups benefit from one. A session border controller sits at the network edge, controls which SIP traffic reaches the PBX, and handles NAT and differences between your PBX and carrier. If your PBX accepts connections from the internet, from remote users or from more than one trunk, ask your PBX vendor or carrier whether they recommend one. Either way, firewall rules and IP allow-lists still need regular review.
Can I keep my SIP trunk if I move to hosted?
With SessionPBX, yes. The hosted PBX page says you can connect the SIP trunk you already use, and any SIP-compliant carrier works, authenticated by IP or by credentials. Your carrier keeps supplying and billing your numbers and calls. Check with your carrier how to point the trunk at a new platform, for example by updating the IP addresses it accepts.
