The IT Setup Checklist for a New Business

What order should you set up IT when you start a business?

Set it up in this order: domain and email first, then user accounts and devices, then security, then backup — and get all four right before you open, not after. The reason for the sequence is that each layer depends on the one before it, and doing them out of order means redoing work. Your email lives on your domain, your devices sign in with your accounts, your security wraps around those accounts, and your backup protects everything underneath.

Most new businesses get this backwards. They buy laptops first because that feels like progress, set up a free personal email to “get going”, and think about security and backup only after something goes wrong. Then six months in, everything has to be untangled and redone while the business is live — which is stressful, disruptive and far more expensive than doing it properly at the start. Here’s the checklist, in the order that actually saves you the pain.

1. Domain and email

Buy your domain first, because everything else hangs off it. Your website, your email addresses and a lot of your credibility all sit on that one name. Register it, and if you can, grab the obvious variations so a competitor or squatter can’t.

Then set up proper business email on that domain — you@yourbusiness.co.uk, not a free personal address. This is the decision new owners most often regret skipping. A free inbox tangles itself into every invoice, supplier account and signup within weeks, and moving off it later is genuinely painful. Start right instead. Most businesses use Microsoft 365 or Google Workspace, which give you business email, shared calendars, file storage and the everyday apps in one subscription. Pick one and stick with it — running both creates confusion. If you’d rather someone handle the whole thing cleanly, our email setup covers domain, accounts and mail records so nothing lands in spam.

2. User accounts and devices

With email in place, create a proper account for each person. In Microsoft 365 or Google Workspace, every member of staff gets their own login — that’s what your files, security and permissions attach to. Resist the urge to share one account between people; it makes everything harder to manage and impossible to secure.

Now the devices. Decide laptop or desktop, Windows or Mac, and buy business-grade kit rather than the cheapest consumer model — it lasts longer and is easier to support. Set each machine up against your business accounts from the start, so files sync to the cloud and nothing important lives only on one laptop. Standardise where you can; five identical laptops are far simpler to look after than five different ones. If buying and configuring hardware isn’t how you want to spend your first week, business device support handles procurement, setup and the ongoing care.

3. Security

Only now, with accounts and devices in place, do you wrap security around them — and this is the step people most want to postpone. Don’t. The basics are not expensive or complicated, and they matter from your very first day, because attackers don’t wait for you to grow.

The essentials are short and non-negotiable:

• Multi-factor authentication (MFA) on every account. A password alone is not enough. MFA is the single highest-value thing you can switch on, and it’s free.
• A password manager, so people use strong, unique passwords without trying to remember them.
• Updates turned on for every device, so security patches install automatically.
• Reputable protection running on each machine.
• Clear leaver process — know how you’ll remove someone’s access the day they leave.

None of this is exotic. It’s the foundation, and getting it right early means you never have to bolt it on in a panic later. Our cyber security service sets these up as a proper baseline and keeps them maintained rather than left to drift.

4. Backup and continuity

Backup is last on the list but first in importance the day something breaks. Cloud services like Microsoft 365 are reliable, but they are not a backup — if a file is deleted, an account is compromised, or ransomware encrypts your data, “it’s in the cloud” won’t always save you. You need a genuine, separate copy.

Set up a proper backup of your email, files and anything else you can’t afford to lose, and — this is the part people skip — check that it actually restores. An untested backup is a guess. A working backup and continuity setup means a lost laptop or a bad click is an inconvenience, not a disaster that ends the business.

Getting the sequence right

The order matters because each layer rests on the one before. Domain before email, accounts before devices, security around those accounts, backup underneath it all. Do it in this sequence before you open and day one is calm; do it piecemeal after you’re live and you’ll be redoing work while trying to run a business.

If you’d rather not assemble all of this yourself, this is exactly what Microsoft 365 setup and ongoing managed IT support are for — the foundations set up properly once, then looked after so you can get on with the actual work. Happy to walk through your setup and tell you honestly what you need on day one and what can wait.