The IT basics to get right early

You do not need all of this on day one. If you only have an hour, start with the first two groups, then backups. Those protect you from the problems that hurt small teams most: being locked out of your own accounts, stolen passwords and lost data.

Own your accounts

• Register your domain in the company’s name, with a login the company controls.If the person who bought the domain leaves or forgets the password, you can lose your website and your email.
• Have at least two admins on every important account: email, domain, cloud, payments.One person on holiday, ill or leaving should never lock the business out.
• Sign up to business tools with a company email address, not a personal one.Accounts tied to a personal inbox are hard to recover and hard to hand over.
• Keep a short list of every tool you pay for: who owns it, what it costs, when it renews.You cannot secure, or cut, what you do not know about. The IT cost estimator can help you sanity-check the numbers.

Email and sign-in

• Run business email on your own domain (Google Workspace, Microsoft 365 or similar).It looks professional, and you control who has access when people join or leave.
• Turn on multi-factor authentication (MFA) for everyone, starting with email and admin accounts.With MFA, a stolen password alone is not enough to get in.
• Set up SPF, DKIM and DMARC for your domain.These records make it harder for others to send email that pretends to be you, and help your own email reach inboxes.
• Give the team a password manager, and stop sharing passwords in chat or spreadsheets.Strong, unique passwords are only realistic when nobody has to remember them.

Laptops and phones

• Turn on disk encryption on every laptop (BitLocker on Windows, FileVault on Mac).A lost or stolen laptop then does not mean lost customer data.
• Switch on automatic updates and a screen lock.Most attacks use known problems that an update already fixes.
• Make sure each device has working malware protection.The protection built into current Windows and macOS is a reasonable start. Managed tools add central visibility.
• Keep a simple list of who has which device.You need it when someone leaves, or when a device goes missing.
• Know how you would lock or wipe a lost phone or laptop.Decide this before it happens, not after.

People joining and leaving

• Give each person only the access their job needs.Fewer people with admin rights means fewer ways for a mistake or a stolen login to do serious damage.
• Write a short leaver checklist: disable email, remove tool access, collect devices, change shared secrets.Most access problems come from accounts that nobody remembered to switch off.
• Review who has admin access every few months.Put it in the calendar. Access tends to build up and never shrink.

Backups

• List what you could not afford to lose: customer data, code, finance records, contracts.Back up what matters first, rather than everything equally.
• Keep more than one copy, with one stored away from your main systems.A common rule of thumb is 3-2-1: three copies, on two kinds of storage, with one off-site.
• Test a restore, not just the backup.A backup you have never restored is only a hope.
• Check how long your email and file tools keep deleted items, and whether you need a separate backup.Do not assume a cloud tool keeps old versions forever. Read what your plan actually does.

Everyday security

• Keep software and plug-ins up to date, including your website if you have one.Old plug-ins and forgotten test sites are a common way in.
• Tell the team what phishing looks like, and make it easy to report a suspicious message.People who feel safe reporting a mistake early save you the most damage.
• Use separate admin accounts for admin work, not your everyday inbox login.It limits what a single phishing click can reach.
• Switch on sign-in alerts for email and key tools.You hear about a strange login while it is still a warning.
• Decide who to call, and what to do first, if something goes wrong.A name and a phone number written down beats working it out in a panic.
• If you have an office: change the default router or firewall password, keep its firmware updated, and use a separate guest Wi-Fi.Default passwords on network equipment are widely known.

Write things down

• Keep a one-page note of how things are set up: tools, owners, where recovery details live, how to reach each vendor’s support.Anyone covering for you, or any IT provider you hire later, can start from it.
• Store admin-account recovery codes somewhere safe and offline.They are what gets you back in if a phone with your MFA app is lost.

Customer data

• Write down what personal data you collect, where it is stored and who can see it.You cannot protect, or explain, data you have not mapped.
• Ask a lawyer what India’s Digital Personal Data Protection Act, 2023 means for your business.If you handle customers’ personal data it may apply to you. This checklist is not legal advice.

Questions about this checklist

Is this a security audit?

No. It is a general checklist of basics, not an assessment of your business. It does not replace advice about the rules that apply to your sector.

Do I need to do everything at once?

No. Start with owning your accounts, email sign-in and backups. Those protect you from the most damaging problems. Work through the rest as the team grows.

Is my progress saved or shared?

Your ticks are stored only in this browser on this device. They are not sent to us or anyone else, and clearing your browser data removes them.

Can you set this up for me?

Yes. The Startup Launch Pack covers many of these basics for teams of up to 10 people: business email, device security, a password manager and two-step sign-in, backups with a restore test, and an on- and off-boarding checklist. See what it includes, or book a free 30-minute call and we will tell you which items matter most for you.