Getting your small business IT setup right in the first month saves you from the expensive kind of cleanup later. Most owners do the opposite. They buy whatever is on sale, share one login across the team, and hope nothing breaks until there is money to fix it. Then something breaks.
You do not need an enterprise setup, and you do not need to buy everything at once. You need a small, sensible foundation that protects the business and that you can add to as you grow. Here is a practical plan, week by week, plus what can safely wait.
Your Small Business IT Setup at a Glance
| Week | Focus | What to do |
|---|---|---|
| 1 | Foundations | Business email and accounts, multi-factor authentication, a password manager, and a device list |
| 2 | Protection | Endpoint protection on every computer, and backups that someone monitors |
| 3 | Support | Decide who you call when something breaks |
| 4 | Documentation | Write down the keys to the business and set a review date |
Week 1: Lay the Foundations
- Set up business email and accounts. Use a proper business email and productivity suite, such as Microsoft 365 or Google Workspace, with every person on their own account. Shared logins make it impossible to tell who did what, or to cut off access when someone leaves.
- Turn on multi-factor authentication. Start with email, banking, and anything that holds customer data. CISA’s guidance for small businesses treats it as a core step.
- Use a password manager. It lets people use long, unique passwords without writing them on sticky notes.
- Start a device list. Write down every computer, phone, and tablet that touches business data, and who uses it. You cannot protect what you have not counted.
- Buy business-grade computers and keep them updated. Turn on automatic updates and disk encryption, which is BitLocker on Windows and FileVault on Mac, so a lost laptop is an inconvenience instead of a breach.
- Secure the network. Change default router passwords, move to business-class equipment as you grow, and put guests on a separate Wi-Fi network.
Week 2: Protect What You Have
Every computer is a door into the business. The free antivirus that came with the machine was built for yesterday’s threats, so give each computer real endpoint protection before you hire the next person.
The ArcLight Security Suite is built for this stage. It is endpoint protection sold per endpoint in three tiers. The Assistant tier includes next-gen antivirus, EDR, and automated incident response. Vice President adds vulnerability and patch management, and President adds managed threat hunting and 24/7 managed detection and response. Start with the depth you need and step up later.
Then handle backup. A backup you have never tested is a guess, so make sure copies are kept off-site, that someone is alerted when a job fails, and that you try a restore. CISA’s advice on backing up business data is a good checklist, and Data Fortress Keep covers workstations and servers with failure alerting built in.
Week 3: Decide Who You Call
Sooner or later something will break at a bad time. Decide now who you will call. There are three common choices:
- Do it yourself. Fine for a while if someone has the time and enjoys it. It gets expensive when that person is also running the business.
- Pay for help as you need it. On demand support means you pay by the minute with no monthly commitment. ArcLight’s support retainer has lanes for everyday fixes, project work, and emergencies, with rates listed on the eStore.
- Hire a managed provider. A flat monthly fee for proactive monitoring and support. It starts to make sense as you add people, handle sensitive data, or cannot afford downtime.
If you are weighing managed IT, our guide to small business IT support explains what to expect, and you can ask about the free 27-point IT Risk Assessment.
Week 4: Write It Down
The last step is the one most owners skip. Create one document, stored somewhere safe and not only on a laptop, that records where your accounts live and who has admin access, your software licenses and renewal dates, your vendors and how to reach them, who to call in an emergency, and how to remove someone’s access when they leave.
Then put a review on the calendar for three months out. Many cyber insurance applications ask about multi-factor authentication, backups, and endpoint protection, so this document also makes those forms much easier to complete.
What Can Wait
- An on-premise server. Many new businesses can run on cloud tools and skip the server, and the maintenance that comes with it.
- Expensive network gear. Business-class basics are enough until you grow.
- Formal compliance programs. Wait until a customer, contract, or regulation requires one, then build it deliberately.
The exception is regulated data. If you handle patient records or payment cards, bring in expert help from the start.
Mistakes That Cost New Businesses Money
- Shared logins. Nobody is accountable, and nobody can be cut off cleanly.
- Everyone as an administrator. One bad click then has the keys to everything.
- Personal accounts for business data. When the person leaves, so does the data.
- No tested backup. You find out it does not work on the worst day.
- Making your most tech-savvy employee the IT department. It works until they are busy, sick, or gone.
- Waiting until something breaks. Fixing it under pressure costs more than setting it up calmly.
Build Your Small Business IT Setup With ArcLight
ArcLight sells support, security, and backup as separate modules, so you add only what you need. There are no mandatory bundles and no long-term contracts, and you work with a local Tulsa team. If you would rather have someone design the setup with you, request an estimate or talk to us.
Frequently Asked Questions
What IT does a small business need to get started?
At minimum: business email with a separate account for each person, multi-factor authentication, a password manager, endpoint protection on every computer, monitored backups, and a plan for who to call when something breaks.
Does a small business need a server?
Often not. Many small businesses run on cloud email, file storage, and applications, which avoids buying and maintaining a server. The exceptions are specific software that requires one, or regulated data with special handling needs.
How much should a small business spend on IT?
It depends on headcount, how sensitive your data is, and how much downtime you can tolerate. A good way to start is to list the essentials, which are email, security, backup, and support, price each one, and add more as the business grows.
Should I hire an IT person or outsource?
For very small businesses, a single in-house IT person is often a single point of failure, and a full-time hire is hard to justify. Many small businesses use on demand support or a managed provider instead, and move to a mix of in-house and outsourced as they grow.
When should a small business move to managed IT?
Common signs include opening support requests every week, adding employees or locations, handling sensitive data, being asked about your security by customers or insurers, and downtime that costs more than prevention would.
What is the first security step for a new business?
Turn on multi-factor authentication for email and key accounts. Then add a password manager, endpoint protection, and a tested backup.
Get Your Setup Right From Day One
A few good decisions in the first 30 days will carry you for years. If you want a second set of eyes on your plan, talk to ArcLight and ask about the free 27-point IT Risk Assessment.
By Brian Largent, CEO & System Architect
Brian Largent
Father to five, husband to one, founder, CEO, and all around swell fella (or so I'm told)
