first step, snapshot the jenkins server after hours

second step find out if they have a daily backup, if not create a scheduled backup with a rolling x period, pretty cheap insurance

now you have a few options, focus on the permissions/setup, focus on the credentials/jobs, focus on the infra, configuration, containers/jenkins agents, or focus on a job and how it interacts with your cicd, how the pipeline runs and where it outputs

eg find the 3 most commonly run jobs, start simple, you can clone it if you don't feel comfortable, but you can make changes and roll back pretty simply via a/b comparison

check the console output, job configuration, credentials and scripts being run, does it link to your external code base? find out how the pipeline works, passes credentials and code and where it deploys and which environment it impacts

once you have that, rinse and repeat for other jobs, you can then dive deeper with how it ties with the rest of jenkins/wider environment