Identity + ownership

Domain registered to the business, with auto-renew on Registrar, DNS and cloud accounts owned by a role mailbox (e.g. it@) — not a person Two named, protected admin accounts; a written list of who has admin access Password manager for the team

02

Email + Microsoft 365

Microsoft 365 business email on your own domain Multi-factor sign-in on every account SPF, DKIM and DMARC published for your domain External auto-forwarding blocked Shared mailboxes for info@, billing@, etc.

03

Devices

Standard business-class laptop build (Dell / Lenovo) Disk encryption + endpoint protection (EDR) on every device Automatic patching Zero-touch setup so new hires sign in and go

04

Network + space

Internet ordered early (30–90 days at a new address) + backup connection Business firewall — not just the ISP's box Structured cabling: labeled, certified, documented Wireless survey + business access points Separate staff, guest, device and payment networks Network closet with dedicated power, cooling + UPS

05

Protect + recover

Backups for devices, files and Microsoft 365 (3-2-1) Test restore completed and documented Security awareness training at onboarding Incident contact list — who to call, day or night

06

Compliance (if it applies)

HIPAA security risk analysis + BAAs with vendors PCI-DSS scope reduced by segmenting payments SOC 2 / CMMC control owners identified Evidence calendar: monthly, quarterly, yearly reviews